NuGet official package source: Should I be worried about the safety of the packages? -

-

according this page:

no central approval process adding packages. when upload package nuget package gallery (which doesn’t exist yet), won’t have wait around days or weeks waiting review , approve it. instead, we’ll rely on community moderate , police when comes feed. in spirit of how codeplex.com , rubygems.org work.

this makes me feel uneasy. before download firefox add-on, know should not contain malicious code, because afaik add-ons on addons.mozilla.org reviewed mozilla. before download open source project codeplex.com or code.google.com, know should safe because can check it's source code. , can use wot (web of trust) check how other people think project.

but before download package nuget official package source. take this one example. no know made package, nor contained in package. seems me can pack package, give name want (like "microsoft prism", long name not taken), upload official package source.

should worried safety of packages on nuget official package source?

your uneasyness should apply software obtain source:

  1. binaries downloaded sourceforge.net, codeplex.com, etc feasibly contain malicious code (either planted original submitter or, more likely, inserted hacker website) may pass unnoticed until (you?) gets bitten , raises alarm.
  2. even if compile own binaries source downloaded 1 of former websites, still perform malicious acts unless go on source code , understand does.
  3. even software downloaded 'app stores' (e.g. apple itunes, android market) feasibly contain malicious code; of these review processes partially automated still not infallible, , human review occurs not infallible!
  4. there have been examples in past of boxed software containing malware!

perhaps there continuum of trust can have in software (delivered binaries or source code), , nuget package gallery (and codeplex.com , rubygems, etc) lies on less-trustworthy end of continuum.

there potential solutions sort of problem, such proposed trusted computing platform alliance, come huge restrictions on freedoms enjoy in developing software , sharing software develop see fit, without need licenses or cryptographic keys obtained central authorities @ great expense.

i believe community come conventions , mechanisms ensuring nuget becomes trustworthy source of software libraries .net developers, whilst retaining agility has not requiring formal review process. however, ultimate responsibility rests user ensure security isn't compromised, , precautions take function of criticality of security in context of software writing (e.g. home projects; low. banking, medical, process control projects; high!)


Comments

Post a Comment

Popular posts from this blog

linux - Mailx and Gmail nss config dir -

-
i trying send mail linux command line using mailx command. can send local domain no problem want set mail send gmail account receive mail sent gmail account. after configuring mail.rc so: account gmail { set smtp=smtps://smtp.gmail.com:587 set smtp-auth=login set smtp-auth-user=username@gmail.com set smtp-auth-password=password set ssl-verify=ignore } i error: resolving host smtp.gmail.com . . . done. connecting 74.125.25.109 . . . connected. missing "nss-config-dir" variable. "/home/username/dead.letter" 11/354 . . . message not sent. after looking "nss-config-dir" here , located certn.db , keyn.db files , added mail.rc so: account gmail { set smtp=smtps://smtp.gmail.com:587 set smtp-auth=login set smtp-auth-user=username@gmail.com set smtp-auth-password=password set ssl-verify=ignore set nss-config-dir=/home/user/.mozilla/firefox/location.default } now when try send mail using command: echo "sent gmail account" | mailx -v -a
Read more

c# - Is it possible to remove an existing registration from Autofac container builder? -

-
something along lines: builder.registertype<mytype>().as<itype>(); builder.registertype<mytype2>().as<itype>(); builder.deregistertype<mytype>().as<itype>() var container = builder.build(); var types = container.resolve<ienumerable<itype>>(); assert.istrue(types.count == 1); assert.istrue(types[0].gettype == typeof(mytype2)); scenario: go through bunch of assemblies , go register types want make sure have 1 implementation of given type. need before create container. track on own nice if autofac me bit. this cannot done directly using containerbuilder , unless start on new one. mind you, having first built container should able construct new container filtering away unwanted types , reusing registrations first container. this: ... var container = builder.build(); builder = new containerbuilder(); var components = container.componentregistry.registrations .where(cr => cr.activator.limittype != typ
Read more

php - Mysql PK and FK char(36) vs int(10) -

-
i have read mysql can handle indexes , searches better if tables keys integers rather char(36) uuid's. is worth converting int(10)? note: use 1 server , have have plans use multiple databases concurrently therefore removing 1 of big reasons using uuid. our tables innodb if makes difference. thanks in advance. usually rdbms can handle integer keys pk more efficient, other datatypes. reason how build index column, yes: long dont require string (or other typed) keys, should use integers. however: char(36) , int(10) far away being equal, because int(10) much smaller, char(36). dont know, if require many different keys, should keep in mind. update, complete last paragraph: int(10) 32-bit, char(36) 36 - ^byte^ (= 288-bit). not mean, int consumes less space, means, char(36) has 4 times more different keys.
Read more