Re: Open source archives hosting malicious software packages

[email protected] ("H.Merijn Brand") Thu, 21 Sep 2017 15:13:18 +0200
Newsgroups	perl.cpan.workers
Message-ID	<[email protected]>
On Fri, 22 Sep 2017 01:00:22 +1200, Kent Fredric
<[email protected]> wrote:

> On 22 September 2017 at 00:11, David Cantrell <[email protected]> wrote:
> 
> > But is anyone paying attention? I assume you're talking about
> > #cpantesters, which I'm on, but I hardly ever look at it, and when I do
> > look I certainly don't look at scrollback, let alone looking at
> > scrollback *carefully*.  
> 
> It gets duty on freenode #perl too, and its not uncommon for people
> like me to glance at https://metacpan.org/recent ( usually to see
> something and regret looking )

Module uploads also show on irc.perl.org #news

* rssbot CPAN: Net-IPAddress-Util-4.000 (PWBENNETT) - https://metacpan.org/release/PWBENNETT/Net-IPAddress-Util-4.000
* rssbot CPAN: Map-Tube-3.35 (MANWAR) - https://metacpan.org/release/MANWAR/Map-Tube-3.35
* rssbot CPAN: Syntax-Highlight-Engine-Simple-0.101 (AKHUETTEL) - https://metacpan.org/release/AKHUETTEL/Syntax-Highlight-Engine-Simple-0.101
* rssbot CPAN: Syntax-Highlight-Engine-Simple-Perl-0.04 (AKHUETTEL) - https://metacpan.org/release/AKHUETTEL/Syntax-Highlight-Engine-Simple-Perl-0.04
* rssbot CPAN: Syntax-Highlight-Engine-Simple-HTML-0.04 (AKHUETTEL) - https://metacpan.org/release/AKHUETTEL/Syntax-Highlight-Engine-Simple-HTML-0.04
* rssbot CPAN: Git-Hooks-2.1.4 (GNUSTAVO) - https://metacpan.org/release/GNUSTAVO/Git-Hooks-2.1.4
* rssbot CPAN: SPVM-0.0269 (KIMOTO) - https://metacpan.org/release/KIMOTO/SPVM-0.0269
* rssbot CPAN: Linux-DesktopFiles-0.21 (TRIZEN) - https://metacpan.org/release/TRIZEN/Linux-DesktopFiles-0.21

If rssbot can add lines with a warning about what this thread is about,
and with a tag tag any IRC client is able to highlight, spotting that
would be a relative easy job for humans

A (cron) job could also run periodically and mail those that subscribe
with a list of all suspicious uploads since the last run

-- 
H.Merijn Brand  http://tux.nl   Perl Monger  http://amsterdam.pm.org/
using perl5.00307 .. 5.27   porting perl5 on HP-UX, AIX, and openSUSE
http://mirrors.develooper.com/hpux/        http://www.test-smoke.org/
http://qa.perl.org   http://www.goldmark.org/jeff/stupid-disclaimers/
signature.asc (application/pgp-signature, 473 B)