• carrylex@lemmy.worldOP
    link
    fedilink
    arrow-up
    43
    ·
    edit-2
    5 months ago

    I also personally ask myself how a PyPI Admin & Director of Infrastructure can miss out on so many basic coding and security relevant aspects:

    • Hardcoding credentials and not using dedicated secret files, environment variable or other secret stores
    • For any source that you compile you have to assume that - in one way or another - it ends up in the final artifact - Apparently this was not fully understood (“.pyc files containing the compiled bytecode weren’t considered”)
    • Not using a isolated build process e.g. a CI with an isolated VM or a container - This will inevitable lead to “works on my machine” scenarios
    • Needing the built artifact (containerimage) only locally but pushing it into a publicly available registry
    • Using a access token that has full admin permissions for everything, despite only requiring it to bypass rate limits
    • Apparently using a single access token for everything
      • When you use Git locally and want to push to GitHub you need an access token. The fact that article says “the one and only GitHub access token related to my account” likely indicates that this token was at least also used for this
    • One of the takeaways of the article says “set aggressive expiration dates for API tokens” - This won’t help much if you don’t understand how to handle them properly in the first place. An attacker can still use them before they expire or simply extract updated tokens from newer artifacts.

    On the other hand what went well:

    • When this was reported it was reacted upon within a few minutes
    • Some of my above points of criticism now appear to be taken into account (“Takeaways”)
    • bleistift2@sopuli.xyz
      link
      fedilink
      English
      arrow-up
      27
      ·
      5 months ago

      This will inevitable lead to “works on my machine” scenarios

      Isn’t that what Python is all about?

    • dohpaz42@lemmy.world
      link
      fedilink
      English
      arrow-up
      18
      arrow-down
      2
      ·
      5 months ago

      Yes kids, the only stuff in ANY repo (public or otherwise) should be source code.

      If it is compiled, built, or otherwise modified by any process outside of you the developer typing in your source code editor, it needs to be excluded/ignored from being committed. No excuses. None. Nope, not even that one.

      No. 👏 Excuses. 👏

      • bleistift2@sopuli.xyz
        link
        fedilink
        English
        arrow-up
        3
        ·
        5 months ago

        Two choices: Either the production software isn’t in the exact state the repo was when the software was built. Or I can’t get build timestamps in the software.

    • dan@upvote.au
      link
      fedilink
      arrow-up
      9
      ·
      5 months ago

      This will inevitable lead to “works on my machine” scenarios

      Isn’t this why Docker exists? It’s “works on my machine”-as-a-service.

    • Jayjader@jlai.lu
      link
      fedilink
      English
      arrow-up
      2
      ·
      5 months ago

      When you use Git locally and want to push to GitHub you need an access token.

      I don’t understand; I can push to GitHub using https creds or an ssh key without creating access tokens.