Hi all, Thanks Thomas for starting the thread on the mailing list. And Big, for pointing the hashes.
> We already asked everyone with commit rights to enable two-factor > authentication Is that true for all repositories ? I know that at least all organisations owners have 2FA, as owner have inherently push rights on all the repositories, for individuals on teams and repos, I'm not certain. Should we start a process enforce for everyone ? We can also turn on Protected branches, that force master to be modified only through PRs, which is less strict, but can still block some workflows. I've been considering signing my git commits as well as the releases with a PGP key. I need to re-create one. I haven't investigated how to automatically verify these though. And if there are common practices on the Python world to deal with that. I would also like at some point – in a hypothetic future – to investigate reproducible build[1], to check that different users/machines building the same commit would get the same hashes, why not with an option on warehouse/pypi to "+1 I have the same hash"/"-1 not the same hash" to have an indicator of whether there is something fishy. Note also that last time I checked, git does not check the integrity of repository while pushing/pulling by default. Which mean that a commits could have been tampered with, without changing its recorded hash. It that the case it's easy to have that unnoticed [2]. Some people suggest to issue a $ git config --global transfer.fsckobjects true To make that permanent. It might make cloning a bit slower, and **some** already existing repositories, are actually corrupted, so you won't be able to clone them before turning that option off. Sidenote, I feel like these kind of questions are coming up more and more regularly at SciPy, in particular this year during the CondaForge BOF for example. -- M [1]: flit does reproducible builds. [2]: I did experience non-matching hash with likely a bit flip, where the actual commit hash was wrong, but git was not complaining until a manual fsck. On Wed, Aug 10, 2016 at 3:55 PM, Thomas Kluyver <[email protected]> wrote: > At least on PyPI, I believe that the hashes are more intended to check > download integrity than security. The new PyPI that's in the works does > appear to show SHA256 hashes (see https://pypi.org/project/ipython/#files ). > But the strongest hash function in the world won't protect us if someone > steals our PyPI login credentials and uses them to upload valid releases. > > On 10 August 2016 at 23:01, Big Stone <[email protected]> wrote: >> >> pypi , R , anaconda are showing mainly md5 on their website (and >> plumbing?) : shouldn't they use and popularize stronger hash technics ? >> >> On Wednesday, August 10, 2016 at 11:09:14 PM UTC+2, takowl wrote: >>> >>> Someone tried to get access to Kenneth Reitz's Github account, possibly >>> with the intent of tampering with requests. As maintainers of another >>> prominent Python project, we should be vigilant with our own accounts. >>> >>> We already asked everyone with commit rights to enable two-factor >>> authentication. This demonstrates that was a good idea. But we should be >>> aware of other attack vectors, like DNS providers and PyPI (you typically >>> store PyPI passwords in plain text in a hidden .pypirc file). >> >> -- >> You received this message because you are subscribed to the Google Groups >> "Project Jupyter" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected]. >> To post to this group, send email to [email protected]. >> To view this discussion on the web visit >> https://groups.google.com/d/msgid/jupyter/acdc4d6d-373a-410d-b9e8-7f01e29b287b%40googlegroups.com. >> For more options, visit https://groups.google.com/d/optout. > > > -- > You received this message because you are subscribed to the Google Groups > "Project Jupyter" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To post to this group, send email to [email protected]. > To view this discussion on the web visit > https://groups.google.com/d/msgid/jupyter/CAOvn4qg6icTxNzJBjAm7BCLiGLnFHZKjvwaHMoq5ujj7rZ1FJQ%40mail.gmail.com. > > For more options, visit https://groups.google.com/d/optout. -- You received this message because you are subscribed to the Google Groups "Project Jupyter" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/jupyter/CANJQusV8BMt0pAtvnYb0iz8E9Rd5ZTaKaibU2iowPmN-BcA%3Dcg%40mail.gmail.com. For more options, visit https://groups.google.com/d/optout.
