TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Backdoor in ssh-decorator package

50 点作者 jbfoo大约 7 年前

5 条评论

lrvick大约 7 年前
The solution to the impersonation aspect of this is commit signing. It is literally built into Git. There are no good excuses for project maintainers to not sign commits at this point. Grab a yubikey or other gnupg smartcard and do it. Else someone is going to impersonate you and use your name, reputation, and repos to spread malware like this. Have your git hosting provider refuse unsigned commits (github&#x2F;gitlab allow this).<p>Secondly stop trusting pip&#x2F;pypi. You -can- upload gpg package signatures but clients totally ignore them. There is no way to verify the author of a pip package except by hand today.<p>Let me be really clear here. When you install a pip package you are executing arbitrary code from the internet with unknown authorship.<p>Pip is fundamentally broken until signature validation is implemented. Whenever possible use OS package managers like apt which actually verify authorship and integrity.
评论 #17029792 未加载
评论 #17030813 未加载
amingilani大约 7 年前
That is such a dick move. There should be a blacklist of people that pull these kinds of stunts. I understand that blacklists aren&#x27;t Sybil resistant but they&#x27;re better than nothing. At the very least the scum would have to rebuild their reputation.
评论 #17027454 未加载
评论 #17028437 未加载
jwilk大约 7 年前
Maintainer&#x27;s response:<p><a href="https:&#x2F;&#x2F;webcache.googleusercontent.com&#x2F;search?q=cache:vjUIkPX1-0EJ:https:&#x2F;&#x2F;github.com&#x2F;urigoren&#x2F;ssh_decorator&#x2F;issues&#x2F;11%2B%22ssh-decorate.cf%22" rel="nofollow">https:&#x2F;&#x2F;webcache.googleusercontent.com&#x2F;search?q=cache:vjUIkP...</a><p><a href="https:&#x2F;&#x2F;github.com&#x2F;pypa&#x2F;warehouse&#x2F;issues&#x2F;3896#issuecomment-387184492" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;pypa&#x2F;warehouse&#x2F;issues&#x2F;3896#issuecomment-3...</a>
评论 #17030106 未加载
parliament32大约 7 年前
The module starts with &quot;import requests&quot; which should be a red flag even for a cause skim of the source. The &quot;it&#x27;s open source, I&#x27;m sure someone else read over it&quot; excuse only works when the code is popular enough... and some obscure pip package definitely isn&#x27;t.<p>The author of the package claims to be a &quot;victim&quot; here, but it&#x27;s hard to tell. Too bad pip doesn&#x27;t support package signing.
craftyguy大约 7 年前
Two questions:<p>1) can paramiko.RSAKey handle other encryption schemes (ED25519) ? If not, folks using non-RSA keys wouldn&#x27;t be affected..<p>2) Having a (strong) passphrase for your key file would help prevent the perp from doing any harm with the key(s), or at the very least would give you time to invalidate the key(s). Right?
评论 #17030170 未加载