<story><title>Two malicious Python libraries caught stealing SSH and GPG keys</title><url>https://www.zdnet.com/article/two-malicious-python-libraries-removed-from-pypi/</url></story><parent_chain><item><author>simias</author><text>The problem is convenience vs. security, and we all know that even knowledgeable users will often sacrifice the latter for the former.&lt;p&gt;Technically on many OSs you already have dozens of ways to achieve what you&amp;#x27;re saying. You could spawn a VM, use a different user, use some container framework, use SELinux, etc... The problem is that usability is generally terrible. Or maybe not terrible but bad enough that many people will start mashing the &amp;quot;allow&amp;quot; button indiscriminately when they&amp;#x27;re in a hurry and want the thing to Just Work. There&amp;#x27;s only one thing I know for sure how to do with SELinux without having to lookup a guide or manual, it&amp;#x27;s how to disable it.&lt;p&gt;Look at the modern Linux desktop for instance, you need admin privileges to configure a printer but your sensitive private files are just lying on your home directory with user privileges. That makes no sense.&lt;p&gt;This is not really a technical problem, that was solved when we invented the MMU, it&amp;#x27;s an UI problem.</text></item><item><author>greggman2</author><text>I don&amp;#x27;t know what the solution is but it feels like this is a much bigger issue and we need some rethinking of how OSes work by default. Apple has taken some steps it seems the last 2 MacOS updates where they block access to certain folders for lots of executables until the user specifically gives that permission. Unfortunately for things like python the permission is granted to the Terminal app so once given, all programs running under the terminal inherit the permissions.&lt;p&gt;Microsoft has started adding short life VMs. No idea if that&amp;#x27;s good. Both MS and Apple offer their App stores with more locked down experiences though I&amp;#x27;m sad they conflate app security and app markets.&lt;p&gt;Basically anytime I run any software, everytime I run &amp;quot;make&amp;quot; or &amp;quot;npm install&amp;quot; or &amp;quot;pip install&amp;quot; or download a game on Steam etc I&amp;#x27;m having to trust 1000s of strangers they aren&amp;#x27;t downloading my keys, my photos, my docs, etc...&lt;p&gt;I think you should be in control of your machine but IMO it&amp;#x27;s time to default to locked down instead of defaulting to open.</text></item></parent_chain><comment><author>greggman2</author><text>I agree it can be inconvenient but don&amp;#x27;t iOS and Android kind of show that for most users the experience can be just fine? For us devs we can still either open our systems or find better ways but I&amp;#x27;d prefer the default to be more closed.&lt;p&gt;I&amp;#x27;d also prefer the default to be VM-ish. Right now I have 275 projects in my &amp;#x2F;home&amp;#x2F;me&amp;#x2F;src folder. Every one of them has at least a build process that executes code I have mostly not reviewed. Many of them execute more code after being built. Some of them execute code when they were installed for dependencies. Maybe I&amp;#x27;m just not used to it but I&amp;#x27;d really like if the process for isolating all 275 of those projects was somehow easier. Or maybe I&amp;#x27;d prefer they were all isolated by default and that we could work on ways of making them easy to do the things they really need to do and hard&amp;#x2F;discouraged to do anything that would also be a security issue.&lt;p&gt;Maybe people have suggestions. I don&amp;#x27;t want an actual VM if it means I have to install 275 copies of OSes and 275 sets of semi global dependencies (like I don&amp;#x27;t want to have to install python 3.8 200 times) but I do want all 275 of those projects not to be able to read my private keys or my photos etc or write outside designated areas</text></comment>
<story><title>Two malicious Python libraries caught stealing SSH and GPG keys</title><url>https://www.zdnet.com/article/two-malicious-python-libraries-removed-from-pypi/</url></story><parent_chain><item><author>simias</author><text>The problem is convenience vs. security, and we all know that even knowledgeable users will often sacrifice the latter for the former.&lt;p&gt;Technically on many OSs you already have dozens of ways to achieve what you&amp;#x27;re saying. You could spawn a VM, use a different user, use some container framework, use SELinux, etc... The problem is that usability is generally terrible. Or maybe not terrible but bad enough that many people will start mashing the &amp;quot;allow&amp;quot; button indiscriminately when they&amp;#x27;re in a hurry and want the thing to Just Work. There&amp;#x27;s only one thing I know for sure how to do with SELinux without having to lookup a guide or manual, it&amp;#x27;s how to disable it.&lt;p&gt;Look at the modern Linux desktop for instance, you need admin privileges to configure a printer but your sensitive private files are just lying on your home directory with user privileges. That makes no sense.&lt;p&gt;This is not really a technical problem, that was solved when we invented the MMU, it&amp;#x27;s an UI problem.</text></item><item><author>greggman2</author><text>I don&amp;#x27;t know what the solution is but it feels like this is a much bigger issue and we need some rethinking of how OSes work by default. Apple has taken some steps it seems the last 2 MacOS updates where they block access to certain folders for lots of executables until the user specifically gives that permission. Unfortunately for things like python the permission is granted to the Terminal app so once given, all programs running under the terminal inherit the permissions.&lt;p&gt;Microsoft has started adding short life VMs. No idea if that&amp;#x27;s good. Both MS and Apple offer their App stores with more locked down experiences though I&amp;#x27;m sad they conflate app security and app markets.&lt;p&gt;Basically anytime I run any software, everytime I run &amp;quot;make&amp;quot; or &amp;quot;npm install&amp;quot; or &amp;quot;pip install&amp;quot; or download a game on Steam etc I&amp;#x27;m having to trust 1000s of strangers they aren&amp;#x27;t downloading my keys, my photos, my docs, etc...&lt;p&gt;I think you should be in control of your machine but IMO it&amp;#x27;s time to default to locked down instead of defaulting to open.</text></item></parent_chain><comment><author>fauigerzigerk</author><text>I sort of agree, but I think that user interfaces need an underlying conceptual model that is familiar to users separately from the actual UI. Otherwise any purely presentational change implies arbitrary new rules that no one can remember.&lt;p&gt;One conceptual model that has worked to some degree on mobile platforms is the idea that programs not users have permissions.&lt;p&gt;But mobile platforms are overdoing it in a way that makes data centric work impractical.&lt;p&gt;I&amp;#x27;m not quite sure how to overcome these issues, but I feel that making the distinction between permissions assigned to users vs permissions assigned to programs more explicit and more visible could take us a step further.</text></comment>