PyTorch and the PyPI supply chain [LWN.net]

PyTorch and the PyPI supply chain

Posted Jan 14, 2023 19:42 UTC (Sat) by KJ7RRV (subscriber, #153595)
In reply to: PyTorch and the PyPI supply chain by ms
Parent article: PyTorch and the PyPI supply chain

Doesn't using the minimum version instead of maximum result in not receiving security updates for dependencies until the depending package is also updated? That seems like a much worse outcome for security, especially considering dependencies of dependencies, etc. Or does Go have a way of specifying that an update is a security update?

to post comments

PyTorch and the PyPI supply chain

Posted Jan 15, 2023 11:14 UTC (Sun) by farnz (subscriber, #17727) [Link] (1 responses)

There cannot be a way to specify that an update is a security update without losing any gains from the "minimal version" route; there is no way to distinguish "malicious actor flags version with back door as security update" from "good actor flags version removing back door as security update".

As with so many things, it all comes down to trust. If you trust upstream to release good updates, you want to take their latest code. If you don't trust upstream, you should be locking exact versions, and reviewing every new release upstream manually before you bring it in (which, in turn, has to be your top priority in case the fixes are security relevant to your code).

PyTorch and the PyPI supply chain

Posted Jan 15, 2023 12:18 UTC (Sun) by ms (subscriber, #41272) [Link]

Exactly. There is tooling to help find vulnerabilities, but yes, the basic premise is that you the developer must explicitly give permission for some dependency (even transitively) to be updated. Doing anything less gated than this is really just giving other developers permission to execute arbitrary code on your machine.

Both of these are relevant:
https://go.dev/blog/vuln
https://go.dev/blog/supply-chain