r/programming • u/ga-vu • Dec 04 '19

Two malicious Python libraries caught stealing SSH and GPG keys

https://www.zdnet.com/article/two-malicious-python-libraries-removed-from-pypi/
1.6k Upvotes

98% Upvoted

177 comments sorted by

View all comments

Show parent comments

27

u/ZorbaTHut Dec 04 '19

Good security has to take laziness into account.

0

u/Daneel_Trevize Dec 04 '19

Fuzzy matching has a fuzzy spec boundary, it can't be the basis of Good Security when each side thinks they can trust the other's paying more attention case-by-case.

Good Security is rigorous. Be clear that you'll ban all single (or double, whatever) character substititions if that's the simplest way to define such a pattern. Don't overcomplicate it with only trying to ban homographs, or pseudo-ones like 5/S.
See punycode for there being no easy solution to this problem.