Security And Modern Software Deployment
summary
Shows that piping a fetched shell script into sh (so‑called curl bashing) actually hands root or install‑time power to many parties; package managers run post‑install hooks, metasploit bind shells prove arbitrary code can give root, and sample uploads sit on repos for weeks. NPM hosts ~150,000 packages (≈300/day), repos lack curation and widespread signing, and a bogus setuptools package reaches ~245 installs. Practical fixes tested include internal repositories, AV/sandboxing and reproducible builds but full protection remains unresolved.
AI-written summary · about
chapters (38)
- 0:00Intro
- 2:06Stack Exchange
- 2:50Software Deployment
- 3:18Trust
- 5:01Dependencies
- 5:32Repository Provider
- 5:53Cloud Provider
- 7:12Its All Software
- 7:23Colonel Bashing
- 7:40Other options
- 8:11Attackers viewpoint
- 8:29Rule 34 of security
- 9:48Short Con
- 10:19Get The Code
- 12:23Root Shell
- 13:16Push A New Version
- 13:29Access Control
- 15:13Lack of curation
- 16:31Lack of digital signing
- 17:00Linux repositories
- 17:19Darker files
- 18:09Profit Chels
- 18:22Metasploit
- 19:06Audit The Code
- 19:21Metasploit Packages
- 20:30Trusted Repository
- 21:51Better Repository Security
- 23:22Update Framework
- 24:05Long Con
- 24:35Open Source Libraries
- 25:25Start Your Own Package Repository
- 26:05If I Was A Bad Guy
- 26:40Fixing This
- 28:16Problem
- 28:27Module Count
- 28:51Python
- 30:47Conclusion
- 32:28Questions
related talks
29mThink Like an Attacker: Why Your npm install Is a Hacker's Dream
32mIt's a Jungle Out There! – Open Source Supply Chain Attacks
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
52mBest Practices for Developers to Master Security
37mSponsored Session: The Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
53mLessons From NPM's Dark Side: Preventing the Next Shai-Hulud
42mSecuring Your Software Supply Chain
59mThere's somebody in my package manager!