4 ms·
it's a stretch to "executing a script with a build user" or "from a validated distro immutable package" to "allowing something to download evergreen code and in
by 1oooqooq 11mo ago
it's a stretch to "executing a script with a build user" or "from a validated distro immutable package" to "allowing something to download evergreen code and install files everywhere on the system".
- teruakohatu 11mo agoA vanilla python can write files, edit ~/.zsh to create an sudo alias that executes code next time you invoke sudo and type in your password. uv installing deps is hardly more risky.
- 1oooqooq 11mo agopoint is that a script executes the script in front of you. uv executes http://somemirror.com/some-version http://somemirror.com/some-version most people like their distro to vet these things. uv et all had a reason when Python2 and 3 were a mess. i think that time is way behind us. pip is mostly to install libraries, and even that is mostly already done by the distros.
- jrnng 11mo agoThat's sneaky. Do any code scanners check for that class of vulnerability? Scanning for external dependencies is common but not so much internal private libraries.
- emmelaich 11mo agohttps://linuxsecurity.expert/compare/tools/linux-auditing-tools/ https://linuxsecurity.expert/compare/tools/linux-auditing-to... shows a few. I've used Tiger/Saint/Satan/COPS in the distant past. But I think they're somewhat obsoleted by modern packaging and security like apparmor and selinux, not to mention docker and similar isolators.
- saagarjha 11mo agoCode scanners cannot protect you from code execution on your machine.