Quote:
Originally Posted by
Komintasavalta
So, you would not run binaries in your main system outside a VM but you will run open source pip python packages, blindly trusting them, without code auditing it for security when it is not even an official debian etc... package etc ?
Are you trusting open source blindly? Then you're in for a world of hurt!
Published on 2021-02-10.
So, you normally do pip install foo, or composer install foo, or npm install foo, or perhaps go get foo, and you never read the source code of the package you just pulled down? Well guess what, that's one (almost) sure way to blow up your project!
Pulling down open source code as a dependency without ever reading the code and verifying that it doesn't contain any backdoors or other malicious content has become one of the easiest ways to introduce malicious content into a code base.
All you have to do is this:
Fix some code and create a pull request.
Fix some more code, perhaps add a new feature, and create more pull requests.
Upstream "rewards" you with commit access.
Keep a low profile for a while longer.
Make a few mistake to check how fast "mistakes" are discovered.
Create some malicious code disguised as a bug, an honest programming mistake.
Repeat.
Of course you cannot validate every single line of code in every open source projects you might use, but I cannot fathom how just about everyone today are completely and blindly trusting every package out there. This is a madness and level of ignorance and naivety in the software industry not previously seen.
...
https://www.unixsheikh.com/articles/...d-of-hurt.html
Don't get me wrong the code could be fine but I don't care enough to code audit it when I can just use GEDmatch, vahaduo , DNAgenics, Genoplot instead but your reasoning sounds retarded.