Avoiding the "left-pad" problem: How to secure your pip install process

Video: https://www.youtube.com/watch?v=qt7TboNJGJg

When Azer Koçulu pulled 11 lines of code from npm he not only broke thousands of dependent packages but also prevented developers all over the world from deploying their code. This talk will show how you can harden your pip install process, ensure that packages have not been tampered with, protect against MITM attacks and even how to keep deploying if a package is deleted or if PyPI goes offline.

Transcript

1. AVOIDING THE "LEFT-PAD" PROBLEM: HOW TO SECURE YOUR PIP INSTALL PROCESS @aaronbassett getadministrate.com
2. @AARONBASSETT
3. getadministrate.com
4. What are packages?
6. “Most software today is very much like an Egyptian pyramid with millions of bricks piled on top of each other, with no structural integrity, but just done by brute force and thousands of slaves.” Alan Kay
19. PRODUCTION
20. QUALITY ASSURANCE
21. LOCAL DEVELOPMENT
23. • 40,000 pages of specifications • 420,000 lines of code • 17 errors in last 11 versions
24. THE ONLY BUG FREE CODE IS NO CODE
28. ORPHAN PACKAGES
29. PIP TOOLS TO THE RESUCE
35. pip-sync
36. "LEFT-PAD" PROBLEM
37. KEEP IT LOCAL
46. PIP HASH
49. hashin 0.6.0
50. • Inspect code before installing • Be your own Pypi • Use pip-compile and pip-sync • Hash all the things
51. THANK YOU @aaronbassett getadministrate.com