Skip to content

Commit 30378ed

Browse files
pliceaseplicease
committed
start working on blog for alien security related changes
1 parent 87741fa commit 30378ed

3 files changed

Lines changed: 165 additions & 0 deletions

File tree

‎docs/blog/2022-09-21-reining-in-unruely-aliens.blog_item.md‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
## Reining In Unruely Aliens
2+
3+
By <b>Graham Ollis</b> on 21 September 2022
4+
5+
When I have talked to Perl developers about the Alien technique, some are
6+
rightly concerned about the security implications of downloading arbitrary
7+
stuff off the internet. My response to this has always to point out that
8+
if you are installing modules from CPAN then you are doing the same.
9+
10+
In fact the default for one of the most popular cpan clients is to use an
11+
unencrypted http connection to fetch modules off the internet. The default
12+
for the Perl's in core HTTP client is to not verify server identity making
13+
man in the middle attackes much easier. There are historical reasons for
14+
these decisions, but overall I think these are examples of how Perl is
15+
increasingly out of step with the rest of the internet.
16+
17+
The team responsible for M<Alien::Build> and M<Alien::Base::ModuleBuild>
18+
plan on making it easier for users to control the security model for
19+
downloading and installing alienized packages for M<Alien>s that use them.
20+
We also plan on changing the default model to err on the side of more
21+
secure. None of these changes is a substitue for properly auditing
22+
the open source code that you use, if your threat model dictates that.
23+
At the end of the day, although there are a few Perl modules that can
24+
be installed statically, the vast majoirty still rely on executing a
25+
`Makefile.PL' or `Build.PL` which is arbitrary Perl code.
26+
27+
The TL;DR is that if you are an Alien author, or if you are the author
28+
of an M<Alien::Build plugin|Alien::Build::Plugin> you should check to
29+
see if your modules still work when `ALIEN_DOWNLOAD_RULE` is set to
30+
`digest_or_encrypt`, which will soon become the new default. This
31+
will require that alienized packages be either
32+
33+
* Downloaded using a secure protocol such as `https`
34+
* Checked with a cryptographic signature included in the M<alienfile> (or `Build.PL` for M<Alien::Base::ModuleBuild> based aliens)
35+
* Bundled within the M<Alien> itself.
36+
37+
For more details on the security implications please see
38+
M<Alien::Build::Manual::Secirty>.
39+
40+
I have already gone through all of the plugins that I am aware of and
41+
fixed them. (Unfortunately even plugins that do not modify the
42+
fetch or download stages of L<Alien::Build> are potentially susceptible
43+
because their tests often need to fake the fetch and download steps
44+
and may do so in a way that seems unsafe to L<Alien::Build>). I will
45+
also go through all of the aliens that I have control over to make sure
46+
they work with this new default.
47+
48+
None of this completely removes the peril of downloading arbitrary
49+
software off the internet, but it does improve the default security
50+
model, and gives the end user more control over the security model
51+
via the `ALIEN_DOWNLOAD_RULE` environment variable.

‎docs/blog/2022-09-21-reining-in-unruely-aliens.html‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
<!doctype html>
2+
<html lang="en">
3+
<head>
4+
<meta charset="utf-8" />
5+
<title>Reining In Unruely Aliens</title>
6+
<script type="text/javascript" src="https://shjs.wdlabs.com/sh_main.min.js"></script>
7+
<script type="text/javascript" src="https://shjs.wdlabs.com/lang/sh_perl.min.js"></script>
8+
<link type="text/css" rel="stylesheet" href="https://shjs.wdlabs.com/css/sh_acid.css">
9+
<link type="text/css" rel="stylesheet" href="https://hatch.wdlabs.com/css/default.css">
10+
</head>
11+
<body onload="sh_highlightDocument();">
12+
<div class="nx-header-flag-1"></div>
13+
<div class="nx-header-flag-2"></div>
14+
<div class="nx-header-title"><a href="/">🌻</a> <a href="/blog/">🪵</a> Reining In Unruely Aliens</div>
15+
<p>By <b>Graham Ollis</b> on 21 September 2022</p>
16+
17+
<p>When I have talked to Perl developers about the Alien technique, some are
18+
rightly concerned about the security implications of downloading arbitrary
19+
stuff off the internet. My response to this has always to point out that
20+
if you are installing modules from CPAN then you are doing the same.</p>
21+
22+
<p>In fact the default for one of the most popular cpan clients is to use an
23+
unencrypted http connection to fetch modules off the internet. The default
24+
for the Perl's in core HTTP client is to not verify server identity making
25+
man in the middle attackes much easier. There are historical reasons for
26+
these decisions, but overall I think these are examples of how Perl is
27+
increasingly out of step with the rest of the internet.</p>
28+
29+
<p>The team responsible for <a href="/pod/Alien/Build.html" class="module">Alien::Build</a> and <a href="/pod/Alien/Base/ModuleBuild.html" class="module">Alien::Base::ModuleBuild</a>
30+
plan on making it easier for users to control the security model for
31+
downloading and installing alienized packages for <a href="/pod/Alien.html" class="module">Alien</a>s that use them.
32+
We also plan on changing the default model to err on the side of more
33+
secure. None of these changes is a substitue for properly auditing
34+
the open source code that you use, if your threat model dictates that.
35+
At the end of the day, although there are a few Perl modules that can
36+
be installed statically, the vast majoirty still rely on executing a
37+
<code>Makefile.PL' or</code>Build.PL` which is arbitrary Perl code.</p>
38+
39+
<p>The TL;DR is that if you are an Alien author, or if you are the author
40+
of an <a href="/pod/Alien/Build/Plugin.html" class="module">Alien::Build plugin</a> you should check to
41+
see if your modules still work when <code>ALIEN_DOWNLOAD_RULE</code> is set to
42+
<code>digest_or_encrypt</code>, which will soon become the new default. This
43+
will require that alienized packages be either</p>
44+
45+
<ul>
46+
<li>Downloaded using a secure protocol such as <code>https</code></li>
47+
<li>Checked with a cryptographic signature included in the <a href="/pod/alienfile.html" class="module">alienfile</a> (or <code>Build.PL</code> for <a href="/pod/Alien/Base/ModuleBuild.html" class="module">Alien::Base::ModuleBuild</a> based aliens)</li>
48+
<li>Bundled within the <a href="/pod/Alien.html" class="module">Alien</a> itself.</li>
49+
</ul>
50+
51+
<p>For more details on the security implications please see
52+
<a href="https://metacpan.org/pod/Alien::Build::Manual::Secirty" class="module">Alien::Build::Manual::Secirty</a>.</p>
53+
54+
<p>I have already gone through all of the plugins that I am aware of and
55+
fixed them. (Unfortunately even plugins that do not modify the
56+
fetch or download stages of L<Alien::Build> are potentially susceptible
57+
because their tests often need to fake the fetch and download steps
58+
and may do so in a way that seems unsafe to L<Alien::Build>). I will
59+
also go through all of the aliens that I have control over to make sure
60+
they work with this new default.</p>
61+
62+
<p>None of this completely removes the peril of downloading arbitrary
63+
software off the internet, but it does improve the default security
64+
model, and gives the end user more control over the security model
65+
via the <code>ALIEN_DOWNLOAD_RULE</code> environment variable.</p>
66+
67+
68+
<div class="nx-footer">
69+
<p>
70+
[
71+
<a href="https://wdlabs.com">wdlabs.com</a> |
72+
<a href="https://alienfile.org">alienfile.org</a> |
73+
<a href="https://pl.atypus.org">pl.atypus.org</a> |
74+
<a href="https://perlwasm.github.io">perlwasm</a> |
75+
<a href="https://uperl.github.io">uperl</a>
76+
]
77+
Copyright &copy; 2022 Graham Ollis
78+
</p>
79+
</div>
80+
</body>
81+
</html>

‎docs/blog/index.html‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,39 @@
2222

2323

2424

25+
<article>
26+
<h2><a href="2022-09-21-reining-in-unruely-aliens.html">Reining In Unruely Aliens</a></h2>
27+
28+
<p>By <b>Graham Ollis</b> on 21 September 2022</p>
29+
30+
<p>When I have talked to Perl developers about the Alien technique, some are
31+
rightly concerned about the security implications of downloading arbitrary
32+
stuff off the internet. My response to this has always to point out that
33+
if you are installing modules from CPAN then you are doing the same.</p>
34+
35+
<p>In fact the default for one of the most popular cpan clients is to use an
36+
unencrypted http connection to fetch modules off the internet. The default
37+
for the Perl's in core HTTP client is to not verify server identity making
38+
man in the middle attackes much easier. There are historical reasons for
39+
these decisions, but overall I think these are examples of how Perl is
40+
increasingly out of step with the rest of the internet.</p>
41+
42+
<p>The team responsible for <a href="/pod/Alien/Build.html" class="module">Alien::Build</a> and <a href="/pod/Alien/Base/ModuleBuild.html" class="module">Alien::Base::ModuleBuild</a>
43+
plan on making it easier for users to control the security model for
44+
downloading and installing alienized packages for <a href="/pod/Alien.html" class="module">Alien</a>s that use them.
45+
We also plan on changing the default model to err on the side of more
46+
secure. None of these changes is a substitue for properly auditing
47+
the open source code that you use, if your threat model dictates that.
48+
At the end of the day, although there are a few Perl modules that can
49+
be installed statically, the vast majoirty still rely on executing a
50+
<code>Makefile.PL' or</code>Build.PL` which is arbitrary Perl code.</p>
51+
52+
<p><a href="2022-09-21-reining-in-unruely-aliens.html">... read more</a></p>
53+
54+
</article>
55+
56+
57+
2558
<article>
2659
<h2><a href="2017-06-13-the-many-ways-to-use-alien.html">The many ways to use Alien</a></h2>
2760

0 commit comments

Comments
 (0)