search

crystal-lang / shards

Dependency manager for the Crystal language
Other
765 stars 102 forks source link

Malware detection/notification #357

Closed didactic-drunk closed 4 years ago

didactic-drunk commented 4 years ago

Perhaps it's time to plan for supply chain attacks before crystal is targetted.

Topics for discussion:

Todo:

https://www.zdnet.com/article/clipboard-hijacking-malware-found-in-725-ruby-libraries/ https://blog.reversinglabs.com/blog/mining-for-malicious-ruby-gems

Sija commented 4 years ago

FWIW, shard releases based on git tags are a seriously weak point, since any1 can re-tag them at any given moment.

jhass commented 4 years ago

I'm not sure what you expect the action points to be here. If you have any, opening a separate issue per concrete suggestion seems to be more productive.

j8r commented 4 years ago

This isse will limit a type of attacks, by pinning the commit hash along with the version.

asterite commented 4 years ago

Yes, please detail an action plan, otherwise there's no point in keeping this issue open.

didactic-drunk commented 4 years ago

I have. It was shot down. Where exactly can we discuss what action plan(s) would be acceptable without me writing multiple detailed plans that are all rejected?

straight-shoota commented 4 years ago

An open discussion without any actionable plans is best suited for the forum. As soon as some ideas are born they can be turned into an issue here.

didactic-drunk commented 4 years ago

@jhass I've seen other people on crystal-lang/crystal keep updating a list of action point items in a single issue which is what I intended here. It doesn't matter as the forum post is up.

straight-shoota commented 4 years ago

The difference: This issue does not have a list of action point items.

didactic-drunk commented 4 years ago

@straight-shoota I didn't want to propose any as my proposals seem to gather opposition. There is a list now.

asterite commented 4 years ago

So this is something to do on thr shards side, right? If that's the case, there's no need to discuss it in this repo.

straight-shoota commented 4 years ago

"Topics for discussion" are not actionable items in this repo. The only actionable item is #242 and we don't need a tracking list to track a single issue. Let's continue this topic at https://forum.crystal-lang.org/t/malware-detection-notification/1971