11 ms·
PyPI Prohibits inbox.ru email domain registrations
- deleted 1y ago[deleted]
- Scene_Cast2 1y agoOh hey, I was the person who reported this.
- mananaysiempre 1y agoI have to say that I don't understand the approach. On one hand, addresses @inbox.ru are administered by Mail.Ru, the largest Russian free email host (although I have the impression that its usage is declining), so quite a few (arguably unwise) real people might be using them (I’ve actually got one that I haven’t touched in a decade). On the other, the process for getting an address @inbox.ru is identical to getting one @mail.ru and IIRC a couple of other alternative domains, but only this specific one is getting banned.
- takipsizad 1y agopypi has blocked signups from outlook before. I don't think they care about the impact it creates
- dewey 1y agoI know a bunch of sites who do that and the problem is usually that register emails get flagged by outlook and never arrive, causing a lot of support burden. Easier to then nudge people into the direction of Gmail or other providers that don't have these issues.
- takipsizad 1y agoit was in the context of blocking email providers because of malicious mass signups (https://blog.pypi.org/posts/2024-06-16-prohibiting-msn-emails/ https://blog.pypi.org/posts/2024-06-16-prohibiting-msn-email...)
- jrockway 1y agoI've been down that road before. Blocking Outlook and Protonmail filters out 0% of legitimate users and 75% of bots. You do what you can so you're not always 1 step behind.
- f311a 1y agoDo you have special access or such thing can be tracked from outside somehow? Could be a fun project to detect this kind of abusive behavior automatically
- miketheman 1y agoSadly the majority of this data is not externally visible.
- miketheman 1y agoThank you!
- ajross 1y agoThe whole model is broken. The NPM/PyPI idea (vscode extensions got in similar trouble recently) of "we're just a host, anyone who wants to can publish software through us for anyone in the world to use with a single metaphorical click" is just asking for this kind of abuse. There has to be a level of community validation for anything automatically installable. The rest of the world needs to have started out by pulling and building/installing it by hand and attesting to its usefulness, before a second level (e.g. Linux distro packagers) decide that it's good software worth supplying and supporting. Otherwise, at best the registries end up playing whack-a-mole with trickery like this. At worst we all end up pulling zero days.
- jowea 1y agoAnd who is going to do all this vetting and with what budget?
- ajross 1y agoRight now: we are. And we're collectively paying too much for a crap product as it stands. Debian figured this out three decades ago. Maybe look to them for inspiration.
- zahlman 1y ago> And we're collectively paying too much for a crap product as it stands. Last I checked, we pay $0 beyond our normal cost for bandwidth, and their end of the bandwidth is also subsidized.
- notatallshaw 1y agoIf you want to offer a PyPI competitor where your value is all packages are vetted or reviewed nothing stops you, the API that Python package installer tools to interact with PyPI is specified: https://packaging.python.org/en/latest/specifications/simple-repository-api/ https://packaging.python.org/en/latest/specifications/simple... There are a handful of commercial competitors in this space, but in my experience this ends up only being valuable for a small % of companies. Either a company is small enough and it wants to be agile and it doesn't have time for a third party to vet or review packages they want to use. Or a company is big enough that it builds it's own internal solution. And single users tend to get annoyed when something doesn't work and stop using it.
- nerevarthelame 1y agoThis is the first time I've heard of slopsquatting, but it does seem like a major and easily exploitable risk. However, blocking an email domain will dissuade only the lowest effort attacker. If the abusers think slopsquatting is effective, they'll easily be able to find (or create) an alternative email provider to facilitate it. And assuming that the attacks will persist, sometimes it's better to let them keep using these massive red flags like an inbox.ru email so that it remains a reliable way to separate the the fraudulent from legitimate activity.
- halJordan 1y agoOf course this is true. It's the worst reason to denigrate a proactive measure. Speeders buy radar detectors. Wife beaters buy their wife long sleeves. This complaint is levied all the time by everyone which makes it low effort and not useful.
- genidoi 1y agoThe problem with using random real world situations as analogies for niches within Software Engineering is that they're not only (almost) ways wrong, but always misrepresentative of the situation in it's entirety
- redserk 1y agoOur entire profession is “how can we make thing difficult enough to not be used incorrectly” That applies from user experience: “how do I get user to click button”, to security “how do I lock things down enough to prevent most attacks I can think of”, to hardware design: “how do I ensure the chipset won’t melt down under really stupid software conditions” Starting with the low hanging fruit isn’t always the worst option. Sometimes it’s enough to dissuade people to give up.
- reconnecting 1y ago'tirreno guy' here. You can use open-source security analytics (1) to detect fraudulent accounts instead of blocking domain names. Blocking domains only shows your system is fragile and will likely just shift the attackers to use other domains. Feel free to contact us if you need assistance with setup. (1) https://github.com/tirrenotechnologies/tirreno https://github.com/tirrenotechnologies/tirreno
- PokemonNoGo 1y agoOdd installation steps.
- reconnecting 1y agoCan you elaborate, please?
- kassner 1y agocomposer install should be pretty much what one needs nowadays. Any installing scripts (although you really shouldn’t) can also be hooked into it.
- lucb1e 1y agoThis requires running the install scripts with your shell permissions rather than with the webserver's permissions, if I'm not mistaken. I could see why one might prefer the other way, even if shared hosting is less common nowadays and shells more often an option
- snickerdoodle12 1y agoThe instructions aren't all that unusual for PHP software, especially those that target shared hosting, but are unusual compared to most other software. > Download a zip file and extract it "where you want it installed on your web server" The requirements mention apache with mod_rewrite enabled, so "your web server" is a bit vague. It wouldn't work with e.g. `python -m http.server 8000`. Also, most software comes bundled with its own web server nowadays but I know this is just how PHP is. > Navigate to http://your-domain.example/install/index.php http://your-domain.example/install/index.php in a browser to launch the installation process. Huh, so anyone who can access my web server can access the installation script? Why isn't this a command line script, a config file, or at least something bound to localhost? > After the successful installation, delete the install/ directory and its contents. Couldn't this have been automated? Am I subject to security issues if I don't do this? I don't have to manually delete anything when installing any other software.
- lysace 1y agoI don't understand why this is newsworthy. Spam never ends.
- perching_aix 1y agoBecause of: > See a previous post for a previous case of prohibiting a popular email domain provider.
- lysace 1y agoThat was outlook.com/hotmail.com. So? Incompetent/malicious/disengaged mail providers come in all shapes and forms.
- perching_aix 1y agoThe implication is that this other email host also being one of the popular ones means there'll be a more widespread user impact than when they block smaller providers. So just like with Outlook, they put out this statement on why they're doing this.
- lysace 1y agoAh, I see your point. Although: I don't think the kind of developers that use low quality email providers like that follow HN. Edit: Remember those 7+ hours back in 1999 when all Microsoft Hotmail accounts were wide open for perusal? https://time.com/archive/6922796/how-bad-was-the-hotmail-disaster/ https://time.com/archive/6922796/how-bad-was-the-hotmail-dis... > Yesterday a Swedish newspaper called Expressen published the programmer’s work, a simple utility designed to save time by allowing Hotmail users to circumvent that pesky password verification process when logging into their accounts. The result? As many as 50 million Hotmail accounts were made fully accessible to the public. Now that the damage has been done, what have we learned? > It wasn’t until the lines of code appeared in Expressen that people realized how vulnerable Hotmail really was. The utility allowed anybody who wanted to to create a Web page that would allow them log into any Hotmail account. Once the word was out, dozens of pages such as this one were created to take advantage of the security hole. Unfortunate programmers at Microsoft, which owns Hotmail, were rousted out of bed at 2 AM Pacific time to address the problem. By 9 AM Hotmail was offline. https://www.theregister.com/1999/08/30/massive_security_breach_affects_hotmail/ https://www.theregister.com/1999/08/30/massive_security_brea... https://www.theguardian.com/world/1999/aug/31/neilmcintosh.rorycarroll https://www.theguardian.com/world/1999/aug/31/neilmcintosh.r... https://www.salon.com/1999/09/02/hotmail_hack/ https://www.salon.com/1999/09/02/hotmail_hack/
- nzeid 1y agoI don't understand how a mere account signup is the bar for publishing packages. Why not queue the first few publishes on new accounts for manual review?
- stavros 1y agoProbably because that would be too expensive for PyPI.
- akerl_ 1y agoWho would do the manual review?
- vips7L 1y agoA staffer from the Python foundation? This is how maven central works. Someone physically verifies that you own the reverse domain of your package.
- akerl_ 1y agoThat’s basically no validation at all. Python doesn’t even have that kind of namespacing to need to validate. The kind of validation being discussed here would take way more than “a staffer”.
- nzeid 1y agoI mean... don't let perfect be the enemy of good? I'm insisting that even the barest minimum of human/manual involvement solely on account signup would be a major security improvement. It would be exhausting to have to audit your entire dependency tree like your life depended on it just to do the most mundane of things.
- akerl_ 1y agoThis isn’t about perfect vs good. The thing you’re suggesting is outright not possible given the staffing that the Python maintainers have.
- Tiberium 1y agoI'm really not following -- why does the ban specifically focus on a single domain instead of attempting to solve the core issue? Do the maintainers not know that accounts for any big email provider (gmail, outlook, you name it) can be bought or created for very, very cheap. Which is obviously what the attackers will now do after this ban. The blog post references [0] which makes it seem like the maintainers do, in fact, just ban any email providers that attackers use instead of trying to solve the issue. [0] https://blog.pypi.org/posts/2024-06-16-prohibiting-msn-emails/ https://blog.pypi.org/posts/2024-06-16-prohibiting-msn-email...
- snickerdoodle12 1y agoWhat is the core issue and how would you solve it?
- deleted 1y ago[deleted]
- WmWsjA6B29B4nfk 1y agoIt’s funny they are talking about low hundreds of emails. This is what a single properly instructed human can create with any provider in a few hours, no bots needed.
- bobbiechen 1y agoAgreed, I thought it was going to be something automated, but 250 accounts in 7 hours seems pretty manual. That does make it harder to stop. * 2025-06-09 first user account created, verified, 2FA set up, API Token provisioned * 2025-06-11 46 more user accounts created over the course of 3 hours * 2025-06-24 207 more user accounts created over the course of 4 hours I do run https://bademails.org https://bademails.org , powered by the same disposable-email-domains project, and I'll be the first to say that it only cuts out the laziest of attempts. Anyone even slightly serious has cheap alternatives (25 to 100+ accounts for $1 on popular email hosts).
- ajsnigrutin 1y agoYep, and if a human is doing that, it's easy to switch over to a different email provider, until that gets banned too, then another, until you can't do anything without a gmail address anymore.
- klntsky 1y agoGoogle accounts are $0.50 on hstock. It's impossible to stop spam
- OldfieldFund 1y agoYup, and Microsoft with access tokens are $0.05
- sysrestartusr 1y ago[flagged]
- ynbl_ 1y agoand mail.ru is not even a real internet service: > Please enter the phone number you'll use to sign in to Mail instead of a password. This is more secure.
- codedokode 1y agoMail.ru is more than real, there is just a trend to move away from passwords because they are not secure when used by ordinary people and can be stolen with a keylogger. So Russian services move to SMS codes, mobile apps or government services for authorization. Also it is a legal requirement to implement a system that doesn't allow anonymous registration, not linked to real identity.
- joecool1029 1y agoThat disposable-email-domain project is a good one. Over 10 years ago I did a dumb thing and pointed some of my domains MX's to Mailinator before I used them for real email with Fastmail and now the domains are flagged all over the place as disposable even though they haven't been used that way in ages. This project has an allowlist you can submit a PR to so it doesn't get sucked back in every time people submit outdated lists of free email provider domains. I've sent dozens of PR's to de-list my domains on various projects across Github and it's like fighting the sea, but the groups making opensource software to use these lists are at least very apologetic and merge the PR's quickly. However, the biggest ASSHOLES are Riot Games. I've reached out to and they will not ban new user registrations on my domains. I eventually just had to block all the new account registration emails for League of Legends I was getting in my catch-all. The maintainer of the tool people were using to make new accounts was very responsive and apologetic (quickly merged my PR) but it doesn't stop people who used the old versions of it from continuing.
- Nickste 1y agoMike is doing an incredible job of finding ways to make it harder for attackers to abuse PyPI (see the PyPI quarantine project). At Safety (previously PyUp) we've been tracking a significant increase in malicious packages that compromise you as soon as you install them. We've extended our open-source CLI tool with a "Firewall" capability that aims to protect against some of these kinds of attacks (typosquatting, slopsquatting) while not requiring any changes to the tooling you use (e.g. pip, uv, poetry). You can check it out with: pip install safety && safety init