<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p><br>
</p>
<div class="moz-cite-prefix">On 11/4/18 5:38 PM, Steven D'Aprano
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:20181104223836.GY3817@ando.pearwood.info">
<pre class="moz-quote-pre" wrap="">On Sun, Nov 04, 2018 at 12:16:14PM -0500, Ned Deily wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">On Nov 4, 2018, at 12:04, Paul Ganssle <a class="moz-txt-link-rfc2396E" href="mailto:paul@ganssle.io"><paul@ganssle.io></a> wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">Some of the concerns about increasing the surface area I think are a
bit overblown. I haven't seen any problems yet in the projects that
do this,
</pre>
</blockquote>
</blockquote>
<pre class="moz-quote-pre" wrap="">
You may or may not be right, but have you looked for problems or just
assumed that because nobody has brought any to your attention, they
don't exist?
"I have seen nothing" != "there is nothing to see".
</pre>
</blockquote>
<p>I can only speak from my experience with setuptools, but I do
look at every setuptools PR and I've never seen anything even
close to this. That said, I have also never seen anyone using my
Travis or Appveyor instances to mine cryptocurrency, but I've been
told that that happens.</p>
<p>In any case, I think the standard should not be "this never
happens" (otherwise you also can't run CI), but that it happens
rarely enough that it's not a major problem and that you can deal
with it when it does come up. Frankly, I think the much more
likely target for these sorts of attacks is small, mostly
abandoned projects with very few followers. If you post a spam
site on some ephemeral domain via the CPython CI, it's likely that
hundreds of people will notice it just because it's a very active
project. You will be banned from the project for life and probably
reported to github nearly instantly. Likely you have much more
value for your time if you target some 1-star repo that set this
up 2 years ago and is maintained by someone who hasn't committed
to github in over a year.</p>
<p>That said, big projects like CPython are probably more likely to
attract the troll version of this, where the point isn't to get
away with hosting some content or using the CI, but to annoy and
disrupt the project itself by wasting our resources chasing down
spam or whatever. I think if that isn't already happening with
comment floods on the issue tracker, GH threads and mailing lists,
it's not especially <i>more</i> likely to happen because people
can spin up a website with a PR. </p>
<blockquote type="cite"
cite="mid:20181104223836.GY3817@ando.pearwood.info">
<blockquote type="cite">
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">and I don't think it lends itself to abuse particularly
well. Considering that the rest of the CI suite lets you run
arbitrary code on many platforms, I don't think it's particularly
more dangerous to allow people to generate ephemeral static hosted
web sites as well.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
The rest of the CI suite does not let you publish things on the
python.org domain, unless I'm forgetting something; they're clearly
under a CI environment like Travis or AppVeyor or Azure. That's
really my main concern.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
Sorry Ned, I don't follow you here. It sounds like you're saying that
you're fine with spam or abusive content being hosted in our name, so
long as its hosted by somebody else, rather than by us (python.org)
ourselves.
I trust I'm missing something, but I don't know what it is.
</pre>
</blockquote>
<p>I think there are two concerns - one is that the python.org
domain is generally (currently) used for official content. If
people can put arbitrary websites on there, presumably they can
exploit whatever trust people have put into this fact.</p>
<p>Another is that - and I am not a web expert here - I think that
the domain where content is hosted is used as a marker of trust
between different pages, and many applications will consider
anything on *.python.org to be first-party content from other
*.python.org domains. I believe this is the reason why
readthedocs moved all hosted documentation from *.readthedocs.org
to *.readthedocs.io. Similarly user-submitted content on PyPI is
usually hosted under the pythonhosted.org domain, not pypi.org or
pypi.python.org. You'll notice that GH also hosts user content
under a githubusercontent.org domain.</p>
</body>
</html>