Insecure downloading of data

Open

#78 opened on Jul 29, 2014 8 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

fixed in v5

Dominant language: Haskell
Stars: 803
Forks: 152
PR merge metrics: No merged PRs in 30d

Description

Hoogle downloads data from the Internet to build its databases. Currently, it does so in such a way that an attacker capable of performing a MITM attack can use it to access sensitive data, elevate privileges or cause denial of service.

See here, here and here for details about the attacks.

Contributor guide

No contributing guide indexed for this repository

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Research direction

No files or tests are named. Start by reviewing Hoogle's Internet data-download path, then read the linked Debian report and the referenced comments on issue 76; done would require addressing the listed MITM attacks, though the issue does not define a specific implementation or acceptance test.

Written by the indexing model from the issue text.

Assessment

Tech stack: haskell
Domain: security
Issue type: Bug
Difficulty: 4/5
Estimated time: 3-5 days
Activity status: Stale
Clarity: Needs clarification
Newbie friendliness: 25/100

A short digest of beginner-friendly GitHub issues.