Making Python safer than ever

Cheuk Ting Ho

@cheukting_ho@fosstodon

Cheukting

https://cheuk.dev

@cheuktingho

Grab the slides:
slides.com/cheukting_ho/python-safer

Hello I am Cheuk

  • Open-Source contributor


     
  • Organisers of community events


     
  • PSF director and fellow
     
  • Consultant and trainer at CMD Limes

What is important when choosing a place to live?

Safety is important

Even when using software at home

Security in Python

If you ask me, it is extra important

Who is using Python?

  • Researchers
  • Data Scientist
  • Bank - financial industry
  • Government
  • Teachers
  • Anyone - you and me

What makes Python vulnerable?

  • Broad adaptation
  • Diverse user profile
  • First programming language
  • Users not nesscery having engineering background

There are also policies to protect consumers

  • US Executive Order 14028 for cybersecurity
  • NTIA (National Telecommunications and Information Administration) Minimum Elements for an SBOM
  • CRA is being effective in a few years
  • AI act, PLD etc

We need to protect Python users and devlopers

Do you know what are the most commmon issues in OSS?

Top 10 risks with OSS

drum rolls.....

source: https://www.endorlabs.com/blog/top-10-oss-risks-press-release

Top 10 risks with OSS

  1. Known Vulnerabilities
  2. Compromise of Legitimate Package
  3. Name Confusion Attacks
  4. Unmaintained Software
  5. Outdated Software
  6. Untracked Dependencies
  7. License Risk
  8. Immature Software
  9. Unapproved Changes (mutable)
  10. Under/over-sized Dependency

https://slides.com/cheukting_ho/oss-security-pitfall

PSF has hired 2 full-time engineers to help us

Seth Michael Larson

Security Developer-in-Residence
(funded by Alpha-Omega)

Mike Fiedler

PyPI Safety & Security Engineer
(funded by AWS)

This is what we do

How do you know if a
    Python release artifact is legitimate?

Signed Releases
with Sigstore

https://www.python.org/download/sigstore/

Sigstore

  • Sign and verify software
  • identity-based, “keyless” signing
  • Signing events are logged in Rekor
  • transparency log providing an auditable record

https://docs.sigstore.dev/signing/overview/

Starting with the Python 3.11.0, Python 3.10.7, Python 3.9.14, Python 3.8.14, and Python 3.7.14 releases

 

 CPython release artifacts are additionally signed with Sigstore

https://www.python.org/download/sigstore/

Use Sigstore to verify

https://pypi.org/project/sigstore/

jobs:
  sigstore-python:
    steps:
      - uses: sigstore/gh-action-sigstore-python@v0.2.0
        with:
          inputs: foo.txt

PSF has become a CVE Numbering Authority (CNA)

https://www.cve.org/Media/News/item/news/2023/08/29/Python-Software-Foundation-Added-as-CNA

CVEs are numbers for documenting vulnerabilities

  • A unique, alphanumeric identifier
    e.g. CVE-2022-48564
  • Enhance communication to discuss, share, and correlate information about a specific vulnerability

By becoming a CNA we can assign CVE IDs to vulnerabilities in CPython and Pip

PSF advisory database

https://github.com/psf/advisory-database

2FA Enforcement on PyPI

  • PyPI has supported adding 2FA since 2019
  • enforcing 2FA for all users by the end of 2023
  • protect the libraries attacked by baddies

Inbound Malware Volume Report Improvement

Before: most within 8 hours

https://blog.pypi.org/posts/2023-09-18-inbound-malware-reporting/

Inbound Malware Volume Report Improvement

https://blog.pypi.org/posts/2023-09-18-inbound-malware-reporting/

  • shared inbox system Help Scout to receive inbound emails
  • tag, assign, and close reports
  • no change to end users

Inbound Malware Volume Report Improvement

https://blog.pypi.org/posts/2023-09-18-inbound-malware-reporting/

After: most within 60 mins

Security Audit on PyPI

  • funded in partnership with the Open Technology Fund (OTF)
  • perform the audit: Trail of Bits
  • "Warehouse" - open-source codebase that powers https://pypi.org
  • "cabotage" - custom open-source container orchestration framework for deployment

But that's not it!

We have our community to help

Do you know we have a Python Security
Response Team (PSRT)?

https://www.python.org/dev/security/

The PSRT accepts security reports for

  • CPython
    (supported and end-of-life)
  • pip

Vulnerability handled by PSRT

  • The reporter reports the vulnerability privately 
  • If the report constitutes a vulnerability, the PSRT will work privately with the reporter
  • The project creates a new release
  • The project publicly announces the vulnerability and describes how to apply the fix via an advisory (public)

PyPA Advisory Database

  • for CPython from CVEs
  • can use pip-audit for packages on PyPI
  • now published to the OSV Vulnerability Database
  • compatible with the OSV API to scan vulnerabilities
  • more visibility

Securing our community

Maintainers of Python projects:

Users of Python projects:

  • Keep your dependencies locked and up-to-date
  • Subscribe for advisories:
    security-announce@python.org
  • Use pip-audit to audit your dependencies for known vulnerabilities
  • Alternatively you can use OSV API

Companies using Python (or any OSS) projects:

Thank you

Alpha-Omega and AWS

For supporting PSF to have Seth and Mike to help us

 

It would be great to have more support!

Security Open Sapce

  • Room 320 on Saturday at 2PM
  • help with vulnerabilities
  • how to handle them as project maintainers
  • talk with GitHub Security Champion Madison Oliver
  • stickers!!!!

Thank you ❤️

Grab the slides:
slides.com/cheukting_ho/python-safer