PyPI has completed its first security audit

https://blog.pypi.org/posts/2023-11-14-1-pypi-completes-first-security-audit/

by miketheman • 3 years ago

137 22 3 years ago

blog.pypi.org

lyu07282• 3 years ago

Link to the report: https://github.com/trailofbits/publications/blob/master/revi...

They seem to not have analysed client-side of PIP itself, but I suppose there isn't anything you could say that isn't already obvious to everyone.

woodruffw2• 3 years ago

PyPI and pip are both under the "umbrella" of PyPA, but they're separate projects with (largely) separate maintainers. The audit was only scoped to the former, not the latter.

(FWIW, I don't think the security posture of pip is obvious to everyone[1], and I do think it would benefit from a separate audit!)

[1] https://yossarian.net/res/pub/hushcon-west-2022.pdf

gnomewascool• 3 years ago

Interesting slides! Thanks!

`pip download --no-deps` allowing arbitrary code-execution is non-obvious, and IMO broken.

the_common_man• 3 years ago

How much does an audit cost?

eli• 3 years ago

It's a bit like asking how much does a vacation cost. It rather depends where you're going and what you're doing.

I'd guess high five figures or maybe low six figures?

Terretta• 3 years ago

Five and six figure vacation costs are why so many security audits are staycations, working from home.

capableweb2• 3 years ago

Depends widely on scope, complexity, client and consultancy. Example from Trail of Bits regarding blockchain audits:

    +---------+---------------------------+-------------------------+----------------------+
    | Size    | Small                     | Medium                  | Large                |
    +---------+---------------------------+-------------------------+----------------------+
    | Project | ERCs (20, 71, 4626, ...)  | Standalone arithmetic   | AMM or lending       |
    |         |                           | lib                     | protocol             |
    +---------+---------------------------+-------------------------+----------------------+
    | Pricing | $25k                      | $25-50k                 | $50-100k             |
    +---------+---------------------------+-------------------------+----------------------+
    | Timeline| 1 week                    | 1-2 weeks               | 2-4 weeks            |
    +---------+---------------------------+-------------------------+----------------------+

https://www.trailofbits.com/services/software-assurance/

easylion• 3 years ago

Good to know. But how often are they going to do it ? Is it going to be an annual event from now on ?

miketheman• 3 years ago

Depends on funding. Ask your employer to pitch in!

mrbonner• 3 years ago

My understanding reading the report is that the audit is for PyPI code and infrastructure itself and not the packages it hosts. Am I right?

woodruffw2• 3 years ago

Yes, that's correct.

thenerdhead• 3 years ago

Congrats! Thanks for trailblazing and being transparent to help other central registries follow.

PyPI has completed its first security audit

Related Stories