Public posts preserved on my own site.
This weekends project(s)
- Readme Rater. I'm going to have to use LLMs for this. Ordinary NLP approaches fail miserably, I tried.
- Is this Done Rater for source code. Searching for TODO and NotImplemened isn't enough, I tried. It fails miserably because of false positives, false negatives and natural language in comments.
Sandboxing scenarios
- vs motivate nation state
- vs script kiddie, griefer
- vs an AI that doesn't really understand the consequences of its actions
- vs a known sort of commercially motivated malice (ransomeware, API key stealing)
By default we run with no sandboxing and rely on social signals for trust.
For people just trying out a new library/app
docker- you've eliminated 95% of people willing to try your app
VM- 99%
RestrictedPython - 99.99%
Pyscript - 5%, I think most people could click a link and look at a library/apps behavior.
A useful app is an expensive signal (would DPRK make a useful app to steal your API keys? It is easier to just lie about an apps usefulness and immediately steal your API keys on first run)
After that tho, people drop the sandbox and now your library/app runs with full permissions and trust.
What would be cool is pipx/uv secure mode
pipx run foobar --secure-ish
uv run foobar --secure-ish
That would disable subprocess, native interop, etc. That would have an impact, my app is going to get ~52 installs per year
THEORY: when everyone watched TV, the news got to almost everyone. With internet and social media, only, maybe 40% of the population anywhere has any awareness of what is going on in the news.
I remember the story of a young (6 year old?) kid who was play acting "russian funeral" with his toys because of the back-to-back Soviet dictator funerals.
That kid and 60% of every are now watching baby shark and its adult equivalent.
I got no particular data for this.
DNS servers are T-5000s. I like this postmortem. Makes obvious why it is called a post mortem, with all the terminating.
@krusynth Qatar? I'm betting it is just Qatar.
Twitter - Finding out who got serious inertia, social conservative opinions, or wants to read AI new
Bluesky - Everyone with a college degree now
Mastodon - Eurovision, pypi jokes and finding sympathy for coping with docker control planes & IaC
CDK: UPDATE_ROLLBACK_FAILED. I guess our job is done and we will never deploy code again.
Oh, I have to do
`aws cloudformation continue-update-rollback --stack-name blerg`
or click "Stack Actions, Continue update rollback"
I miss terraform.
I'd been deleting stack to get out of the rollback failed stated.
Star Wars quotes when your app crashes from an error using `sys.excepthook`
https://pypi.org/project/jedidebug/
(also comes in philosopher and insult versions)
Aggressively anonymous. A good example of a package where there is *no* info about who wrote, other than the style is clearly ChatGPT, no clues about who mashed control-c, control-v
What day of the week has the fewest #CVE s reported?
Because all I can do to "fix" a CVE is upgrade and a CVE was released yesterday, I upgrade that and a day later there are more CVEs and so on, it is in my interest to only scan on days where few CVEs are reported. (Friday?)
French Lesson
Il a plu - It rained
Il a glu - It was sticking
Il a chu - It was sneezing
@acdha What did they think socialism meant??
Is CAFEBABE sexual harassment?
Archived poll
6 voters
Kpop trope: main character looks like they're going to do something horrible, like suicide, murder or litter, but they change their mind by end of video
IDEA: a #python package, but it acts as my #pypi profile page.
This idea isn't all that novel, (package-as-resume) but this time I want to make it easy for people to copy & useful on installation. And of course it is ironic to install a package a way to get info about a user as a trust building exercise. I guess if I got it to run in pyscript that would be a good exercise.
Have your bot talk to my bot.
@ebooksyearn @gfitzp Rats don't even have phones.
@burningTyger "Wish I got weekends off" well
Ghosts' calendars are always like, "OOO"
Do you wish you could remove certain libraries from the #python standard library? Sort of like CAS in .NET?
Well I got you covered.
Not a replacement for docker. Works like pytest-socket.
Anyhow, looking forward to examples of exploits, which I imagine would be un-monkeypatching or just using other libraries.
Still I think this would be a nice way to seal apps you distribute against highjacked 3rd party libraries that weren't specifically targetting this defense.
And why is this called `hermetic-seal?` ? Well after searching for a perfect name I picked `hermetic`, which is 404 on pypi, free to take? Nope, if you register trusted publisher for that name #pypi says it is **taken**!
IDEA: logging library crossed with remote desktop so we can crowdsource fixing servers. The last time this was tried, it wasn't a GUI and was difficult to use.
IDEA: youtube channel where I'll talk about how my favorite IDE is great because I spent the last 10 years learning all the keyboard shortcuts. This is evidence that your IDE is bad, because I don't know the short cuts to that.
Look! Paul D Smith published on pypi.
(not really. Published by a Chinese college student.)
Look! Paul D Smith published on pypi.
(not really. Published by a Chinese college student.)
I'm brainstorming how to work out if stuff like this is trust worthy.
Options
- just trust it
- run it a sandbox and if appears to work, then trust it (e.g. malicious code might not implement the useful stuff, why implement a build tool if you just need to write enough code to steal aws keys)
**- let some other fool install it and ask them how it went (security by relying on reckless fools)**
- decompile the native code & read the pure python.
- Always sandbox it in docker
- Never use it
When we rely only on *many people installed this code and it was okay*, then we late comers are exploiting the gullibility of the early adopters.
I just don't like systems that are founded on exploiting someone.
Crossed state lines to get my Covid and flu vaccine. One more to go this year.
Retweeting yard signs from takona park, md
We have heard you loud & clear. Your job has no opportunities for promotion. To address that, you can now sign up to promote Athletic Greens during the Daily Scrum Standup meeting. You will be paid 15% of first months revenue for anyone that uses your sign up code.
I didn't post a bad take. This post is so you can like that.
What will happen?
```python
a = Person()
if not a:
print("No one here")
else:
print("Things make sense")
```
Prints "No one here" of course!
Override bool and delegate that to just whatever because people are Falsy until they eat lunch.
```
class Person():
def __init__(self):
self.lunch = None
def eat(self, lunch):
self.lunch = lunch
def __bool__(self):
return bool(self.lunch)
```
Brought to you by a certain caching library.
Do I know mypy? Did you mean, "Do I know how to type ` # type: ignore[arg-type]`?" Yes.
Thinking
- we can trust packages with millions of installs because that's 1m people who haven't complained about a past problem
- we just need to worry about **that** trusted package being high-jacked
- this isn't a way to demonstrate initial trust
- we don't have to worry about it because each maintainer in the dependency graph will interpret trust the *same* way you do
-except for people adding a new dep because it looks useful
-except at some point someone does the first install of a package
package highjacking would be prevented by oauth to show that the code came from the same repo as usual, that the repo credentials are 2 factor
For new dependencies who don't have reputation by dint of 1 million installs (that is the blue check on pypi now, just is hard to see https://pypi.org/stats/ as if bluecheck membership was only published to big table, but it is there!) ... for those packages, we're trusting them by some other mean, like "Do I like the spelling of the readme.md" and...
I think we can do better.
(like rel=me and backlinks, until I can think of a better idea.)
package highjacking would be prevented by oauth to show that the code came from the same repo as usual, that the repo credentials are 2 factor
For new dependencies who don't have reputation by dint of 1 million installs (that is the blue check on pypi now, just is hard to see https://pypi.org/stats/ as if bluecheck membership was only published to big table, but it is there!) ... for those packages, we're trusting them by some other mean, like "Do I like the spelling of the readme.md" and...
I think we can do better.
IDEA: parasitic trust & identity. In the US for a long while there wasn't a nice unique identifier for everyone, EXCEPT Social Security. So everyone began using that for trust, identity, disambiguation. Social security numbers do not
- have check digits
- cryptographic signatures
- claims
Successful because it was better than the other options (i.e nothing).
Social Security Agency never promoted themselves as identity or trust. Their system was used without coordination.
OPS HULK SMASH GLASS
ρ(ρ(ρ(your boat)))
The sequel to "naive_backlinks" will be "street_wise_backlinks"
"you can't trust these links, kiddo... there's no crypo...alice and bob, they'll betray you, they betrayed us all... they're all out to get you...come back here... <whimpering>"
Let's do a backlink checker!
Oh no, HTTP 999 from linkedIn.com
Oh no, 403 from reddit.com
Oh no, 403 from all the big sites with profile pages and user created hyperlinks.
Pypi gives you a page with javascript and even if you "curl-it-with-playwright" you still don't get back the real page. 200, but not really.
The goal of "Attestations" and associated is to
promise "when I download sampleproject4, I know it came from the repo it's supposed to and PyPI served the same file to me as everyone else."
and .. that it is now an attackers job to high two machines to attack.
(me: but if I lose my github credentials to Alice and Bob, they can publish package now with 1 compromised credential?)
I guess this does clarify that
- we still don't know who the pypi user is, nor do we know who controls the repository and it isn't a goal
Should we be using that package in the first place? Shouldn't be using any packages in the first place! We can trust the 2nd and 3rd packages are from the repo & are just as trust worth as the initial package, but Alice and Bob were publishing the 1st and they're North Korean state actors.
Almost got a skip-trace tool working, but the most interesting idea is naive-backlinks, and the feature was sliding sideways, so I extracted it to a brand new library.
Wow, so many sites got crawler blocking active now.
I'm tempted to create a HTML version of the pypi json API response to simulate what a crawler would return because pypi block html (but not json, the json is all edge cached if I understand correctly.)
And naive_backlinks almost works.
https://github.com/matthewdeanmartin/naive_backlink?tab=readme-ov-file#naive_backlink
This isn't a rabbit hole, it's the Mandelbrot set!
Funny how whois is now aggressively setup to make sure you have no idea who owns most domains.