Christopher Lemmer Webber
https://octodon.social/@cwebber
•
Dec 4
Typosquatted Python libraries exfiltrating PGP and SSH keys https://www.zdnet.com/article/two-malicious-python-libraries-removed-from-pypi/
Same stuff as the event-stream incident, effectively. This is only going to get worse; object capability security is no longer an optional thing; we need it to survive as a society.
@aaronpk I'm discussing Ocap-level module safety. SES in Javascript is doing this to a large degree (Jessie moreso). Not talking about tokens here but references. The idea is that reference passing *is* language-level ocaps; normal argument passing to functions is ocap security, see: http://mumble.net/~jar/pubs/secureos/secureos.html
Extending that to the module layer, a module only gets the authority you pass into it.