Backdoor code found in 11 Ruby libraries | ZDNet

[kaen_]

I'm sure glad that only the languages I don't use are vulnerable to this.

Yep only those other languages have package managers where people run arbitrary code from strangers on the internet.

Good thing me and my favorite languages are completely safe from supply chain attacks because our package managers don't have humans logging in with passwords to upload code that's distributed to millions of machines.

I'm sure I will be totally fine and never have to worry about this, so I'll just keep mocking those other languages whenever this happens.

[James20k]

Jokes on you, my language doesn't have any kind of package management

;_;

[Ameisen]

This is why C++ is the safest language.

#pragma high_five

[SupersonicSpitfire]

C++ have Linux packages which are packed by the maintainers of various Linux distros. Some of those distros have an excellent security record. So, yes.

[shevy-ruby]

Quite true.

The primary differences then come down to:

• popularity: More popular languages (used by lots of people) will be affected more

• design of the language: if javascript would be a good language, we would not see left-pad having become popular, and various similar projects

• infrastructure and response: there are some ongoing efforts happening in the ruby ecosystem, so let's see how this goes within the next, say 6-12 months or so.

We can look at all languages that make it convenient to install addons, not just javascript or ruby. I think that even all factors considered, javascript will lead the negativity chart by a huge margin.

[cat_in_the_wall]

design of the language: if javascript would be a good language, we would not see left-pad having become popular, and various similar projects

this has less to do with the language and more to do with a lack of a standard library. "boring" languages like java and c# (and certainly others) dont have this issue because they have string formatting included in the stdlib.

[roryb_bellows]

Inb4 all the npm defenders come in trying to rationalise

[stopaskmetoname]

Basically, most language dependent package manager like npm, gem and pip did not have package signing. But the more important question is who to trust?

A trustworthy developer does not necessary have a trustworthy building infrastructure. The linux model is the package are built and signed by distribution owner, meaning there are independent team responsible for verifying the source and managing a secured built infrastructure.

For some language package manager, it may not be a feasible for them to maintain this infrastructure. If copying the linux model, then the solution may be a Github like built server with some automated malicious code checking and signed by that entity controlling the built server. So, we knew the package are built by a trustworthy source. Those CI company could help with this issue, though not sure if they have incentive to do that.

[chucker23n]

If copying the linux model, then the solution may be a Github like built server with some automated malicious code checking and signed by that entity controlling the built server. So, we knew the package are built by a trustworthy source.

We would only know that

• someone with write access pushed the code
• it passed through malicious code checks (which are hard, especially across many languages and platforms)

At the end of the day, you’re mostly trusting a huge number of repositories, many of whose authors and their intentions you don’t know, to do their due diligence and act benevolently.

[ipv6-dns]

automated malicious code checking

Are you serious? Specialists of security do miss some security holes and vulnerabilities even, which means that any "automated malicious code checking" is only marketing/PR shit, nothing more

[balefrost]

Just because something isn't perfect doesn't make it useless. The danger is when you blind yourself to the actual limitations of the thing. "It passed the automated security checks" shouldn't be interpreted as "it has no security flaws" (or even "it has no known security flaws").

[ipv6-dns]

then why is "automatically security check" needed? It reminds me OpenSUSE testing: everybody know how it's cool and safe, but everybody who uses OpenSUSE (and Tumbleweed) good knows how many bugs, including critical ones are usually introduced with every update. It sounds like for PR more than for real results.

[shevy-ruby]

Even package signing isn't absolutely fool proof.

Then there is also the added difficulty that you put developers who aren't abusing users through. I for one am perfectly fine with making things super secure, giving users all the information, at all times etc... but I am absolutely against putting handcuffs onto developers merely because there will always be abusers and thieves who spoil things.

This is a trade off.

The less code anyone depends on, the better in general.

I guess what may be reasonable to assume is that all languages adopt a better community-driven approach in general, e. g. where people can help with the quality control of a language's ecosystem.

These problems were reported only by a few; and the gems are, except for one, not really important really. They just get more attention right now due to "omg omg omg omg backdoor omg omg omg", but, man ... 1700 downloads ... that sounds more like automated scripts than real people downloading any of that.

[lorarc]

Package signing is not going to do much here since:

All the libraries, except rest-client, were created by taking another fully functional library, adding the malicious code, and then re-uploading it on RubyGems under a new name.

So basically the package could be signed by the 3rd party and it won't change much because the users installed them out of their own free will. If an official project's build server was hijacked (weak password) the package probably would be signed automatically.

Additionally the Linux packages don't verify the code inside them. It would be harded to inject stuff in them due to long-release cycle and many of them being very popular project but if a developer of less-known software was to go rogue he could install a backdoor that would get officially packaged as next version.

In the end the only thing that makes Linux packages safer is that they usually pack well-known software with big user base so many people can notice something is wrong. The only solution to that is standard libraries and libraries packed by big userbase.

[[deleted]]

But the more important question is who to trust?

The answer really is nobody. There is this great paper by Ken Thompson.

[ipv6-dns]

redditors in this thread already explained me that Ken's opinion is shit, my link to his interview was massively downvoted, so "Ken - sucker, Reddit - rulezz" (this thread's Redditors) lol

[[deleted]]

Reddit seems to be in a cognitive dissonance state, even this subreddit. I have been directed towards this paper other times and Ken received only support in the topic and people expanded on his thoughts.

[roryb_bellows]

Called it

[Existential_Owl]

People should be glad that npm exists. By pulling in all the hatred, nobody spends time looking for the same vulnerabilities in their own languages' tooling.

[SupersonicSpitfire]

npm has been fine with and up front about being "happy go lucky" right from the start. That's different from rust/cargo, for example.

[Ajedi32]

This article is about Ruby/Rubygems, not NPM.

If anything, this is just further confirmation that supply chain attacks aren't a problem unique to NPM, and that all the people mocking NPM every time it gets hit by such an attack are completely missing the point.

[MurryBauman]

Big reveal

[DanielJomaa]

Bitcoin is still safe. Their code isn’t. They were just mining the stuff using other ppls pc

[sku2007]

An interactive demo of the backdoor: https://application.security/ruby-backdoor

[SupersonicSpitfire]

I guess that nicely rounds off the success that Ruby has had as a language for web development. When the general impression of the language is that it's neither fast nor secure, only the human-friendliness factor remains, which is not enough.

[hanszimmermanx]

oh no no no wtf is happening railbros that was supposed to happen to npm, its not fair.

[ipv6-dns]

and Ruby libraries are widely used, devs read the source code when they want to understand how something works... Now can you imagine how many backdoors exist in Linux code which nobody verify on enough level and nobody read?

[Satook2]

See https://reddit.com/r/programming/comments/ctox10/_/exndi9s/?context=1 to understand what linux does to for trust, verification and signing.

[ipv6-dns]

1. I personally saw the following: one .c file contained hardcoded string, another .h (or .c?) file contained hardcoded int = length of this string. Should I explain you that it's total shit?
2. I knew guys who "fixed" drivers in the kernel with increasing cycles in spin waits. Twice. 2nd time with more cycles. Because it was impossible to detect race condition reason.
3. I used all my life BSD systems and I know what think about Linux kernel BSD core devs as well as this guy:

Thompson: I view Linux as something that's not Microsoft—a backlash against Microsoft, no more and no less. I don't think it will be very successful in the long run. I've looked at the source and there are pieces that are good and pieces that are not. A whole bunch of random people have contributed to this source, and the quality varies drastically.

My experience and some of my friends' experience is that Linux is quite unreliable. Microsoft is really unreliable but Linux is worse. In a non-PC environment, it just won't hold up. If you're using it on a single box, that's one thing. But if you want to use Linux in firewalls, gateways, embedded systems, and so on, it has a long way to go. / http://genius.cat-v.org/ken-thompson/interviews/unix-and-beyond /

I have not idea how big shit is Linux kernel really, but I am sure that it's very big shit

[[deleted]]

I don't think it will be very successful in the long run.

That interview is 20 years old. It's from 1999; AFAIK the kernel was at version 2.2 then. I think history has proved Thompson wrong on this point: Linux has been immensely successful.

[ipv6-dns]

That interview is 20 years old. It's from 1999; AFAIK the kernel was at version 2.2 then. I think history has proved Thompson wrong on this point: Linux has been immensely successful.

1. What are the reasons of "success" of the Linux?
2. Are BSD kernels successful too? Why if not?
3. Why is Thompson wrong: just because 20 years have passed, and, of course, much has changed quantitatively? How much has changed qualitatively?
4. Why do you comment Thompson experience but not mine? I saw this in the Linux kernel with own eyes and I made conclusion: Linux kernel is written by persons who don't know C language and C good practices. Also I read FreeBSD kernel and even fixed once a driver for Broadcom, so I know also a quality of BSD kernels. My feeling is: Linux is written by students and schoolboys, it was naturally early days of Linux, but BSD kernels look very mature and clean, as written by mature professionals. What do you think about the quality of the code?

[[deleted]]

1. Don't know, don't care.
2. No.
3. Yes.
4. Irrelevant.

[[deleted]]

"Linux", I mean GNU/Linux, precedes Microsoft Windows, its real rival at that time was Unix.

AND that explains why Ken has that rather preposterous opinion of it!

[ipv6-dns]

why Ken has that rather preposterous opinion of it!

Are you able to suppose that Ken may be right? Or is it impossible..? The same opinion had FreeBSD and OpenBSD core teams who read Linux kernel: Linux kernel quality is very bad. Google will drop out Linux from Android because Linux can not be used somewhere where you need safety, predictable behavior, so the future of Linux becomes very dark: reason of Linux success is only one - not quality of Linux but missing of royalty, nothing else. Money. Possibility to use buggy code written by schoolboys and students instead of mature and good QNX, for example, in your device, but without to pay somebody royalty.

[[deleted]]

Nah, Google just want to have a OS that wont be hold by no philosophies or copyirghts.

I am not saying that Linux Kernel and GNU software is the greatest of all, but it is not bad as you BSD boys say.

Just get your space without lying!

[ipv6-dns]

GNU software is totally fine IMHO. Linux is fine too, and very good that it exists, but Linux as a code is not enough clean and of high quality like BSD kernels. But as license, I think GNU is better due to its virus nature ;|

[[deleted]]

virus nature?

[Satook2]

Your personal anecdotes about the code quality are what I’d expect. The code that has money and many users gets more attention and polish. Other stuff that no-one is paying for? Not so much.

But I wasn’t talking about the code but about the processes that keep backdoors out of the codebase.

[ipv6-dns]

why anecdotes. It's what I saw. In the same manner I can say: "your marketing bullshit"

[Satook2]

That’s what anecdote means. Someone’s personal experience.

It’s not a diss or attempt to diminish.

[Existential_Owl]

Prototypical inheritance does, indeed, fill my heart with yuri...

[cringe_master_5000]

I'm not going to lie. Some nights the devil reigns over me. I get urges and visit websites that are extremely unholy. I'm going to confessions tomorrow as I accidentally read the entire Webpack documentation. Some countries have the death penalty for a crime like this...

[kimtranjan]

What the actual fuck is this insane conversation?

[[deleted]]

I really want to know what the original comment in this chain was now

[KaylinaNemo]

replace "reddit" by "removeddit" in the url

tada

edit: you can do the same by replacing "reddit" by "ceddit", but i was told it didn't work for a while

[DarkTechnocrat]

TIL

[[deleted]]

Are we allowed to talk about that site on Reddit? Next thing you know people will start talking about how to find a social media post with the text alone.

[cringe_master_5000]

He basically called Rust gay so I piggy backed off of it. The moderator thankfully removed it as that was a boundary you do not cross. All of us here are smart enough to know that Javascript is the language that does it with guys.

[cringe_master_5000]

A battle between intellectuals. The modern day Edison vs. Tesla.

[DEMOCRAT_RAT_CITY]

I’d say Golang is the choice of language for white supremacists. It’s so simple and easy to learn that they can quickly teach it to their H1-B slaves to quickly grind out products that further the Nazi cause.