Warning: mkdir(): No space left on device in /var/www/tg-me/post.php on line 37

Warning: file_put_contents(aCache/aDaily/post/ManjusakaH/--): Failed to open stream: No such file or directory in /var/www/tg-me/post.php on line 50
Manjusaka 的碎碎念(以及摇曳露营 S4 制作确定!) | Telegram Webview: ManjusakaH/405 -
Telegram Group & Telegram Channel
https://peps.python.org/pep-0768/
PEP 768 出来几天了,在官方 thread 里也参与了讨论。
聊下我自己的想法吧
首先来说我对这个提案是持正面态度的,对于开发者工具的良好体验我都是支持的。
但是从一个 SRE 以及兼职的 Security 人员的视角来看,我的 concern 在于,这个进程引入了特别鲜明的攻击特征以及极大的减小了攻击成本,配合 RCE 会造成更大的破坏面
我以 PyTorch 来作为解释下,PyTorch 序列化漏洞大家可能都有所耳闻(很多人没用 safe load), 那么我在网上发一个恶意模型,只要有人加载了,那么我就执行下面几件事

1. 判断你机器上所有进程
2. 进程判断有没有 .PyRuntime 字段
3. 有的话,我调用remote_exec 执行偷数据的 code

换句话说,只要你机器上有一个 flag 没有在启动期关闭, 我就能在不破坏你的进程的情况下窃取你的数据

结合字节跳动最近实习生的事情来说,就可以在不破坏进程的情况下去侵入机器上其余进程

同时现有的针对 Python 的一些加壳工具可能也会失效

在讨论中其余几位 Core 也确认以及持有和我类似的 concern。看作者后续怎么做 trade off 吧



tg-me.com/ManjusakaH/405
Create:
Last Update:

https://peps.python.org/pep-0768/
PEP 768 出来几天了,在官方 thread 里也参与了讨论。
聊下我自己的想法吧
首先来说我对这个提案是持正面态度的,对于开发者工具的良好体验我都是支持的。
但是从一个 SRE 以及兼职的 Security 人员的视角来看,我的 concern 在于,这个进程引入了特别鲜明的攻击特征以及极大的减小了攻击成本,配合 RCE 会造成更大的破坏面
我以 PyTorch 来作为解释下,PyTorch 序列化漏洞大家可能都有所耳闻(很多人没用 safe load), 那么我在网上发一个恶意模型,只要有人加载了,那么我就执行下面几件事

1. 判断你机器上所有进程
2. 进程判断有没有 .PyRuntime 字段
3. 有的话,我调用remote_exec 执行偷数据的 code

换句话说,只要你机器上有一个 flag 没有在启动期关闭, 我就能在不破坏你的进程的情况下窃取你的数据

结合字节跳动最近实习生的事情来说,就可以在不破坏进程的情况下去侵入机器上其余进程

同时现有的针对 Python 的一些加壳工具可能也会失效

在讨论中其余几位 Core 也确认以及持有和我类似的 concern。看作者后续怎么做 trade off 吧

BY Manjusaka 的碎碎念(以及摇曳露营 S4 制作确定!)




Share with your friend now:
tg-me.com/ManjusakaH/405

View MORE
Open in Telegram


telegram Telegram | DID YOU KNOW?

Date: |

Launched in 2013, Telegram allows users to broadcast messages to a following via “channels”, or create public and private groups that are simple for others to access. Users can also send and receive large data files, including text and zip files, directly via the app.The platform said it has more than 500m active users, and topped 1bn downloads in August, according to data from SensorTower.

How Does Bitcoin Work?

Bitcoin is built on a distributed digital record called a blockchain. As the name implies, blockchain is a linked body of data, made up of units called blocks that contain information about each and every transaction, including date and time, total value, buyer and seller, and a unique identifying code for each exchange. Entries are strung together in chronological order, creating a digital chain of blocks. “Once a block is added to the blockchain, it becomes accessible to anyone who wishes to view it, acting as a public ledger of cryptocurrency transactions,” says Stacey Harris, consultant for Pelicoin, a network of cryptocurrency ATMs. Blockchain is decentralized, which means it’s not controlled by any one organization. “It’s like a Google Doc that anyone can work on,” says Buchi Okoro, CEO and co-founder of African cryptocurrency exchange Quidax. “Nobody owns it, but anyone who has a link can contribute to it. And as different people update it, your copy also gets updated.”

telegram from us


Telegram Manjusaka 的碎碎念(以及摇曳露营 S4 制作确定!)
FROM USA