<story><title>Remote code execution vulnerability in Google they are not willing to fix</title><url>https://giraffesecurity.dev/posts/google-remote-code-execution/</url></story><parent_chain><item><author>kelnos</author><text>While the Java ecosystem tends to get a lot of criticism, this is one thing they got right: fetching a package name from a public repository involves prefixing the name with the reverse-DNS name of the uploader (the &amp;quot;group ID&amp;quot; in Java&amp;#x2F;maven parlance).  Uploaders can only submit packages after they&amp;#x27;ve proven they have control over the domain.&lt;p&gt;It&amp;#x27;s really unfortunate that even newer package management ecosystems like Rust&amp;#x27;s haven&amp;#x27;t learned that lesson.  Yes, it increases initial setup friction, but dependency confusion and name squatting issues more or less just go away when you do that.  Sure, you might run into issues where people register domains for common misspellings of popular domain names, but that&amp;#x27;s already a problem with website resolution, and there are ways to mitigate that.</text></item></parent_chain><comment><author>kibwen</author><text>The problem described in the post isn&amp;#x27;t the fault of package naming schemes, it&amp;#x27;s due to `pip install --extra-index-url` apparently ignoring the user-specified registry if the package exists on PyPI, which, if true, is baffling, because it throws out the concept of private registries altogether in favor of treating PyPI as some sort of universal namespace.</text></comment>
<story><title>Remote code execution vulnerability in Google they are not willing to fix</title><url>https://giraffesecurity.dev/posts/google-remote-code-execution/</url></story><parent_chain><item><author>kelnos</author><text>While the Java ecosystem tends to get a lot of criticism, this is one thing they got right: fetching a package name from a public repository involves prefixing the name with the reverse-DNS name of the uploader (the &amp;quot;group ID&amp;quot; in Java&amp;#x2F;maven parlance).  Uploaders can only submit packages after they&amp;#x27;ve proven they have control over the domain.&lt;p&gt;It&amp;#x27;s really unfortunate that even newer package management ecosystems like Rust&amp;#x27;s haven&amp;#x27;t learned that lesson.  Yes, it increases initial setup friction, but dependency confusion and name squatting issues more or less just go away when you do that.  Sure, you might run into issues where people register domains for common misspellings of popular domain names, but that&amp;#x27;s already a problem with website resolution, and there are ways to mitigate that.</text></item></parent_chain><comment><author>bqmjjx0kac</author><text>What happens in the Java ecosystem when someone loses ownership of their domain name?</text></comment>