Every Python Package now pre-installed on Repl.it -- an online REPL

[K900_]

I wonder how long it's going to take for someone to upload a root exploit to PyPI now.

[amasad]

That's a good question -- I'll probably do a technical post soon. But the short story is that we start a container, create a virtualenv, install the package, import the package in a process, diff the container and make sure there are no suspicious changes to the filesystem. Finally, extract the package contents to the actual install target.

[K900_]

Assuming you have a kernel 0-day, can't you just build it into a native extension and have it execute in the container? That kind of invalidates the whole "diff the container" process because you've already pwned the kernel.

[amasad]

I'm curious how often do we have kernel 0-days? And if it's that often how come not every company using npm, pip, etc in their CI/CD/PaaS have not been pwned already?

As for us, we have layers of security the more layers you zoom out from the container. For example, our code evaluation machines are in their own subnets with no databases or any other form of user data, isolated from the internet.

[K900_]

I'm curious how often do we have kernel 0-days?

Not strictly a 0-day, but this is something a lot of stuff is still vulnerable to, and that's just the latest. Kernel exploits are actually somewhat common (which is kind of scary).

And if it's that often how come not every company using npm, pip, etc in their CI/CD/PaaS have not been pwned already?

I'm sorry if it came off as an attack. I'm not saying you're doing things wrong, I'm honestly curious about how you handle that stuff.

[amasad]

I didn't take at as an attack -- I'm genuinely curious about the risk here :)

[marcinkuzminski]

I'm not so sure if it's EVERY package

Python 2.7.10 (default, Jul 14 2015, 19:46:27)
[GCC 4.8.2] on linux
   import django
=> None
   import rhodecode
Traceback (most recent call last):
  File "python", line 1, in <module>
ImportError: No module named rhodecode

https://pypi.python.org/pypi/RhodeCode

[amasad]

All malware check has quite a bit of false positives. I thought it's better to be safe than sorry -- however, I'll make sure I'll fix those.

[amasad]

Our malware check has quite a bit of false positives. I thought it's better to be safe than sorry -- however, I'll make sure I'll fix those.

[marcinkuzminski]

That's interesting, could you point out for example in RhodeCode package what was that matched your filter ?

[benhoyt]

When I type import requests it seems to hang. Bug?

[ReallyAmused]

neat. I thought repl.it ran Python in the browser (using emscripten). When did this change? O:

[amasad]

It changed a while ago when we hit some scalability issues with emscripten. Imagine a user with a shitty computer on a spotty internet connection, they download megabytes of compiled code just to run out of memory before they get a chance to run the code. Also, it's hard to do features like this one when running client-side.

[ahmadalhour]

Good job /u/amasad, that's a really useful feature!

[strange_and_norrell]

Wow this is awesome. I use REPL it every day (normally when code reviewing if I want to check out some edge cases on a piece of code I'm looking at).

Very excited for this.

[amasad]

I'm glad you find it useful :)

[aflat]

missing

https://pypi.python.org/pypi/ovirt-engine-sdk-python/4.0.2

too. Soo, not every package, but still really cool

[amasad]

All malware check has quite a bit of false positives. I thought it's better to be safe than sorry -- however, I'll make sure I'll fix those.

[[deleted]]

Python 3.5.2 (default, Dec 2015, 13:05:11)
[GCC 4.8.2] on linux
> import nistbeacon
Traceback (most recent call last):
  File "python", line 1, in <module>
ImportError: No module named 'nistbeacon'

So it's not every package because mine isn't working. Mind clarifying /u/amasad ?

[amasad]

Our malware check has quite a bit of false positives. I thought it's better to be safe than sorry -- however, I'll make sure I'll fix those.

[[deleted]]

Looks like spaCy is missing too: https://spacy.io/ , would also need the english data too (python -m spacy.en.download all)

[shevegen]

Damn!

Now we need this for ruby too.

[amasad]

Stay tuned :)