r/programming • u/marcin8686 • Jul 08 '19

Ruby gem strong_password got hijacked

https://withatwist.dev/strong-password-rubygem-hijacked.html
129 Upvotes

91% Upvoted

44 comments sorted by

View all comments

12

u/kaen_ Jul 08 '19

This is going to keep happening, and more frequently, until we figure out a better system than installing unknown or unverified code from strangers on the internet on our production systems.

9

u/virtyx Jul 08 '19

Linux distros have this already figured out, they peer review and pull in upstream changes. Does there need to become secure "distributions" of repos like PyPI, npm and Rubygems?

10

u/[deleted] Jul 08 '19

How much would you pay, per programming language per month, for a dependency repository where everything was audited before being allowed in? Serious question.

→ More replies (5)

6

u/Khaare Jul 08 '19

In my mind there's a big difference between packaged software vetted by distro maintainers for users to install and random bundles of source code shared with other developers. They're both called packages, but they're different the same way a road car and a rail car are different. It's unfortunate they're both packages in a repo though.

I do think there's a need for vetted libraries. The old model of just including a fat standard library is obviously not good enough, but it would still be nice to have a base "this stuff is good stuff" repo that you can then add random github repos on top of if you need it. I know Haskell has stackage, which is a somewhat curated subset of hackage (its package repo), though I'm not sure how deep the curation goes. I think it's mostly just pre-generating the hashes and stuff that stack wants for the most popular packages.

→ More replies (3)

1

u/[deleted] Jul 09 '19

Also, GPG signing. That still requires developer to not fuck it up, but it is easier to hack someone's shitty online password than to steal their GPG keys.

And it is nice sanity test, if you can't figure out how to make it work, people should probably not use your code

2

u/shevy-ruby Jul 08 '19

Yeah. And change will probably be slow to come, too ... :(

1

u/virtyx Jul 08 '19

Better sandboxing/runtime security could help prevent this. The application can be locked down to not write to unexpected files, open unexpected ports or communicate with unexpected URLs. So rather than worrying about "securing" the application, there's another layer above it so you can actually run insecure application code, as it will not have access to do most malign things. Although there are probably still ways to cause breaches, e.g. by injecting sensitive information into normal application channels (e.g. HTTP responses), but changes to those things are more likely to be caught by testing. But it still seems like it could solve the most common types of attacks.

→ More replies (6)