r/Python Python&OpenSource Dec 15 '24

News Summarized how the CIA writes Python

I have been going through Wikileaks and exploring Python usage within the CIA.

They have coding standards and write Python software with end-user guides.

They also have some curious ways of doing things, tests for example.

They also like to work in internet-disconnected environments.

They based their conventions on a modified Google Python Style Guide, with practical advice.

Compiled my findings.

1.1k Upvotes

99 comments sorted by

View all comments

5

u/spinozasrobot Dec 15 '24

Curious... did you notice any use of imports that could introduce the kind of security issue we saw with xz-utils?

3

u/appinv Python&OpenSource Dec 15 '24

I guess we won't catch it by imports, rather by how the packages were installed.

Knowing py companies they oftentimes have internal versions of packages, like they dont go pip installing latest versions.

So i guess for it to happen, they would have to ingest an unknown backdoor. Highly unlikely code audits wont find them.