@nightpool Chapter four billion, seven hundred thirty-eight thousand, nine hundred twenty-four in why you shouldn't blindly install stuff from a package system anyone can upload to.

**Sean R. Lynch ☑️** @seanl@literati.org · May 10, 2018, 20:36

**Sean R. Lynch ☑️** @seanl@literati.org · May 10, 2018, 20:36

@nightpool Or even with your eyes open, since at any time a package could change hands.

**Dr. Equivalent the Incredible** @drequivalent@mastodonsocial.ru · May 10, 2018, 20:37

**Dr. Equivalent the Incredible** @drequivalent@mastodonsocial.ru · May 10, 2018, 20:37

@nightpool wow what the fuck

**mx. fluffy** @fluffy@queer.party · May 10, 2018, 20:43

**mx. fluffy** @fluffy@queer.party · May 10, 2018, 20:43

@nightpool @codl holy shit IN PLAINTEXT even what the jesus everfucking shit

**Austin Dern** @Austin_Dern@mastodon.social · May 10, 2018, 22:10

**Austin Dern** @Austin_Dern@mastodon.social · May 10, 2018, 22:10

@fluffy @nightpool @codl And if it weren't bad enough: logging it as 'passowrd'.

**mx. fluffy** @fluffy@queer.party · May 10, 2018, 23:09

**mx. fluffy** @fluffy@queer.party · May 10, 2018, 23:09

@Austin_Dern @nightpool @codl I can actually see them having done that on purpose to fool automated warning/checker things. It’s an anti pattern I saw a few times at Amazon internally to escape a code auditor process.

**Austin Dern** @Austin_Dern@mastodon.social · May 10, 2018, 23:59

**Austin Dern** @Austin_Dern@mastodon.social · May 10, 2018, 23:59

@fluffy @nightpool @codl Surely is to sneak past automated checking, yes. It's the laziness that gets me. If they titled like, 'networkSuccess' or 'connectStatus' or even 'misc1' then you'd have something too boring to pay attention to if you caught it being passed on your network.

**rrix 🍕🌎** @rrix · May 10, 2018, 20:46

**rrix 🍕🌎** @rrix · May 10, 2018, 20:46

@nightpool lol.

**~sanlyx** @sanlyx@pleroma.soykaf.com · May 10, 2018, 20:54

**~sanlyx** @sanlyx@pleroma.soykaf.com · May 10, 2018, 20:54

@nightpool

**~sanlyx** @sanlyx@pleroma.soykaf.com · May 10, 2018, 20:58

**~sanlyx** @sanlyx@pleroma.soykaf.com · May 10, 2018, 20:58

@nightpool which also reminds me that each npm package I install, each shady library I git clone and build is executing arbitrary code in my self-signed-certificate-secure-boot-and-full-disk-encryption-TPM-enabled-machine

paranoid mode (re)activated, I'll probably be installing "CleanMyPC" in like four days or so

**Rain 🚱** @grainloom · May 10, 2018, 21:15

**Rain 🚱** @grainloom · May 10, 2018, 21:15

@nightpool they could have at least obfuscated it or something

**meejah** @meejah@mastodon.social · May 10, 2018, 21:18

**meejah** @meejah@mastodon.social · May 10, 2018, 21:18

@nightpool It's almost like that practice of basically forcing people to put plaintext passwords in ~/.pypirc and never checking signagures wasn't the best idea :/

**🦄 jоsнυα 🌈** @DC7IA@chaos.social · May 10, 2018, 23:48

**🦄 jоsнυα 🌈** @DC7IA@chaos.social · May 10, 2018, 23:48

@nightpool @andreas 1234'); DROP TABLE passwords;--

and done..?

**Andreas DC6AP (JO43) 📻 💻🤓🏕** @andreas@mastodon.aventer.biz · May 11, 2018, 06:32

**Andreas DC6AP (JO43) 📻 💻🤓🏕** @andreas@mastodon.aventer.biz · May 11, 2018, 06:32

@DC7IA @nightpool könnte Funktionieren 😃

**Aarkon** @Aarkon@metalhead.club · May 11, 2018, 07:10

**Aarkon** @Aarkon@metalhead.club · May 11, 2018, 07:10

@nightpool So Twitter uses a Python backend? 😂