Let’s talk about safety for the Python community

Cheuk Ting Ho

@cheukting_ho@fosstodon

Cheukting

https://cheuk.dev

@cheuktingho

Grab the slides:
slides.com/cheukting_ho/safety-for-python-community

Hello
I am Cheuk

  • Open-Source contributor


     
  • Organisers of community events


     
  • PSF director and fellow
     
  • Community manager at OpenSSF

PyCon India ❤️

What questions would you ask when go to a new country?

Do I need a visa?
😰

Is it safe to go?

as a woman 💃

Safety is important

Even when using software at home

Security in Python

If you ask me, it is extra important

Who is using Python?

  • Researchers
  • Data Scientist
  • Bank - financial industry
  • Government
  • Teachers
  • Anyone - you and me

What makes Python vulnerable?

  • Board adaptation
  • Diverse user profile
  • First programming language
  • Users not nesscery having engineering background

We need to protect Python users

Do you know what are the most commmon issues in OSS?

Top 10 risks with OSS

drum rolls.....

source: https://www.endorlabs.com/blog/top-10-oss-risks-press-release

Top 10 risks with OSS

  1. Known Vulnerabilities
  2. Compromise of Legitimate Package
  3. Name Confusion Attacks
  4. Unmaintained Software
  5. Outdated Software
  6. Untracked Dependencies
  7. License Risk
  8. Immature Software
  9. Unapproved Changes (mutable)
  10. Under/over-sized Dependency

PSF has hired 2 full-time engineers to help us

Seth Michael Larson

Security Developer-in-Residence
(funded by Alpha-Omega)

Mike Fiedler

PyPI Safety & Security Engineer
(funded by AWS)

This is what we do

How do you know if a
    Python release artifact is legitimate?

Signed Releases
with Sigstore

https://www.python.org/download/sigstore/

Sigstore

  • Sign and verify software
  • identity-based, “keyless” signing
  • Signing events are logged in Rekor
  • transparency log providing an auditable record

https://docs.sigstore.dev/signing/overview/

Starting with the Python 3.11.0, Python 3.10.7, Python 3.9.14, Python 3.8.14, and Python 3.7.14 releases

 

 CPython release artifacts are additionally signed with Sigstore

https://www.python.org/download/sigstore/

Use Sigstore to varify

https://pypi.org/project/sigstore/

jobs:
  sigstore-python:
    steps:
      - uses: sigstore/gh-action-sigstore-python@v0.2.0
        with:
          inputs: foo.txt

Do you know we have a Python Security
Response Team (PSRT)?

https://www.python.org/dev/security/

The PSRT accepts security reports for

  • CPython
    (supported and end-of-life)
  • pip

Vulnerability handled by PSRT

  • The reporter reports the vulnerability privately 
  • If the report constitutes a vulnerability, the PSRT will work privately with the reporter
  • The project creates a new release
  • The project publicly announces the vulnerability and describes how to apply the fix via an advisory (public)

PSF has become a CVE Numbering Authority (CNA)

https://www.cve.org/Media/News/item/news/2023/08/29/Python-Software-Foundation-Added-as-CNA

CVEs are numbers for documenting vulnerabilities

  • A unique, alphanumeric identifier
    e.g. CVE-2022-48564
  • Enhance communication to discuss, share, and correlate information about a specific vulnerability

By becoming a CNA we can assign CVE IDs to vulnerabilities in CPython and Pip

Open Source Vulnerability DBs

PyPA Advisory Database

  • for CPython from CVEs
  • can use pip-audit for packages on PyPI
  • now published to the OSV Vulnerability Database
  • compatible with the OSV API to scan vulnerabilities
  • more visibility

But that's not it!

We have action items for you

Maintainers of Python projects:

Users of Python projects:

  • Keep your dependencies locked and up-to-date
  • Subscribe for advisories:
    security-announce@python.org
  • Use pip-audit to audit your dependencies for known vulnerabilities
  • Alternatively you can use OSV API

Companies using Python (or any OSS) projects:

  • Support OpenSSF's work by becoming a member
  • Educate their employees - free courses on LF catalogue
  • Encourage engineering and data science teams to follow best practices

Securing our community

How can we make our community safe for everyone?

Local laws, traditions and cultures are different

Girls and women were not encouraged in STEM

In our culture

The women scientists who took India into space

https://www.bbc.com/news/world-asia-india-38253471

India’s lower house votes to reserve a third of seats for women

https://www.aljazeera.com/news/2023/9/20/indias-lower-house-votes-to-reserve-a-third-of-seats-for-women

We can do the best we can for our community

Cultures can change

Code Of Conduct

https://in.pycon.org/2023/code-of-conduct/

These are our heroes 👏👏👏

  • Nivesh Krishna (CoC Chair)
  • Vandana PV (Diversity & Inclusion Chair)
  • Amritha Madam
  • Bhanu K
  • Kalyan Prasad
  • Snehith Allamraju
  • Sanchit Balchandani

https://in.pycon.org/2023/code-of-conduct/

Thank you very much for having me

I feel very welcomed and safe 🧸