carols10cents

How does a user become a Trusted User? Who is paying them to review everything?

If you're writing the tests after writing the code, you're not doing TDD though.

Since Shai-Hulud scanned maintainers' computers, if the signing key was stored there too (without a password), couldn't the attackers have published signed packages?

That is, how does signing prevent publishing of malware, exactly?

Yeah, npm has orders of magnitude more users than crates.io. This attack's success, or lack thereof, has no bearing on the savviness of JavaScript or Rust developers.

So why are you upgrading?

Who is requiring you to use large numbers of transitive dependencies? You can always write all the code yourself instead.

Why wouldn't you knit a chicken???

And the architect is a volunteer for Habitat for Humanity.

who is going to pay for the review of packages and updates? how do we know we can trust the reviewers?

github actions are name-spaced and that didn't help anything here...

Do not try to equalize a maintainer guarding their time and energy from having to deal with an issue that has already been fixed and users that refuse to search or read with trying to cover up for gross negligence and bugs.

No maintainer is obligated to maintain access to a discussion space for their users.

> One now doesn't even know and cannot even estimate the number of other issues that must have gone unreported. It's not safe or wise to use a package that is so shrouded in mystery. It is in fact foolhardy.

Issues don't get reported for any number of reasons. All open source is use at your own risk.

It's the Charles Anderson Bridge. https://engage.pittsburghpa.gov/charles-anderson-bridge

What would prevent the sock puppet accounts from signing each others' keys?

How are these two problems unique to Rust though?

It looks like accounts can be entirely anonymous. How are you planning on handling moderation of comments? What happens if I post on a neighbor's house "jagoff who lets their dogs poop everywhere lives here, please evict"?

Tell me you don't know anyone from Pittsburgh without telling me you don't know anyone from Pittsburgh.

> these are the folks who do the Lawfare podcast, right?

Yep, and they had a podcast episode with the author of this paper: https://www.lawfaremedia.org/article/the-lawfare-podcast-jim...

I wish Bluey hadn't introduced the concept of a "bush wee" to my kid, I've had to explain that no, we can't pee in someone's yard in the middle of our busy neighborhood...

Namespaces can't be typosquatted?

Crates.io has publisher information-- namespacing is not required for that. For example, here are all the crates owned by the `azure` GitHub organization and published by the `azure-sdk-publish-rust` team: https://crates.io/teams/github:azure:azure-sdk-publish-rust

How do namespaces measurably increase security?

I'm one of the crates.io team members, and we're very grateful to Phylum for doing this analysis and alerting us!

As a volunteer member, I'm also very thankful to the Rust Foundation for funding and hiring Walter Pearce, Adam Harvey, and Tobias Bieniek to work on security and crates.io (in varying proportions). They've helped lower our response time to incidents like this and made proactive improvements.

Regardless of any improvements they have or will make, there's always the possibility of malware getting through defenses. Reports are important to us, taken seriously, and handled as promptly as possible. More details here: https://www.rust-lang.org/policies/security

Making crev part of the official Rust toolchain won't magically make enough time in the day for me to want to volunteer any of it doing code review.

That's what TideLift's goals are too. https://tidelift.com/

You're very welcome, I'm glad you like it! <3

Hi! Book author here. I think the other comments were answering when the feature will be available in a stable release. No content has been written for this, and it's not entirely clear to me yet how best to work this into the book.

The RFC is probably the best documentation for now.

No. This was released yesterday: https://pittsburghpa.gov/press-releases/press-releases/5590

> Hang your shingle out by publishing negative (vote-against) attestations of vulnerable versions of open source software and positive attestations (e.g. code-review) of the versions that mitigated the issues they disclosed.

So you're imagining that a bunch of people trying to break into security work will do work for free in hopes of gaining potential employers'/clients' trust?

And you're imagining that this ecosystem of attestations will be seeded by a bunch of people looking to gain the community's trust?

So who audits the auditors? And how long do you expect it to take to get a critical mass of people reviewing code who have gained the community's trust to be reviewing enough packages to solve open source supply chain security?

Yup, this. And in places where logging companies aren't ruining forests, it's because of government regulation.

Yes, the worst is when so much silence is removed that it sounds like someone is laughing over themselves.