4 ms·

Ahh but that's one of the hardest pieces of the trust puzzle. On the internet, how do you know who's who. you download a package from npm. Who wrote it, what

Ahh but that's one of the hardest pieces of the trust puzzle. On the internet, how do you know who's who. you download a package from npm. Who wrote it, what's their background, where do they work? What are their security practices like, what are the security practices of the hosting company? so we say Redhat/Apache are more trusted sure, that's one of the reasons that I dislike curl|bash from random sites, there's no way of assessing trust in that software or its origin...

coldtea 11y ago
>On the internet, how do you know who's who. you download a package from npm. Who wrote it, what's their background, where do they work? What are their security practices like, what are the security practices of the hosting company? Check the npm package's ratings, and the github repository watchers and stars. Try to find and read a few posts (and their comments) on the package. The more respected the source (e.g. HN comments vs comments on Digg), the better.
- raesene6 11y ago
  that's not a bad mechanism (if a bit time consuming) for personal usage, but wouldn't likely work for corp. use.. Even there though all it does is move the problem one step away. Most npm packages have dependencies (and quite a few of them), you have no way of knowing whether the author of the main package did the checks you describe for their dependencies...
  - coldtea 11y ago
    >Even there though all it does is move the problem one step away. Most npm packages have dependencies (and quite a few of them), you have no way of knowing whether the author of the main package did the checks you describe for their dependencies... That's the nice thing: you don't need to. You just need to trust that the main package works well enough -- and you get that from the fact that it is in widespread use (many downloads, watchers, stars, posts, etc).
    - raesene6 11y ago
      errrm and if a dependency is untrustworthy it can execute code on your system at install time... the fact that no-one else is checking and you are therefore in the same boat as other compromised people might not be that much of a consolation
      - coldtea 11y ago
        The thing is, if thousands use it, then you'd know if it's unsafe... Beyond that, yeah, nothing is absolutely certain in life except death and taxes...
        tamana 11y ago
        This assumption fails in the network connected world where a program can download custom instructions after installation.
        coldtea 11y ago
        It doesn't fail, it's still as usable as ever -- just not infallible, which nothing is anyway. The dynamics of something with a larger user base being more trustworthy don't change because we're on the internet. It's a simple network (no pun intended) effect. If the program "can download custom instructions after installation" then a large user base still means that users will be bound to find it sooner or later (and make it public/fix it) and it makes it less likely to be you (because you're 1 from 200,000 downloading it, not 1 of 20 or 200).
        raesene6 11y ago
        in security where breaches can cost a lot of money, relying on heavy use as an indication of trustworthiness may not be a great idea. For example OpenSSL was and is used by lots of people, this has not stopped it having a lot of security problems... And true once the vulnerabilities get published you get to know about the problems more quickly but then in a world of targeted attacks and professional exploitation that might not be great comfort..

coldtea 11y ago

>On the internet, how do you know who's who. you download a package from npm. Who wrote it, what's their background, where do they work? What are their security practices like, what are the security practices of the hosting company? Check the npm package's ratings, and the github repository watchers and stars. Try to find and read a few posts (and their comments) on the package. The more respected the source (e.g. HN comments vs comments on Digg), the better.

raesene6 11y ago
that's not a bad mechanism (if a bit time consuming) for personal usage, but wouldn't likely work for corp. use.. Even there though all it does is move the problem one step away. Most npm packages have dependencies (and quite a few of them), you have no way of knowing whether the author of the main package did the checks you describe for their dependencies...
- coldtea 11y ago
  >Even there though all it does is move the problem one step away. Most npm packages have dependencies (and quite a few of them), you have no way of knowing whether the author of the main package did the checks you describe for their dependencies... That's the nice thing: you don't need to. You just need to trust that the main package works well enough -- and you get that from the fact that it is in widespread use (many downloads, watchers, stars, posts, etc).
  - raesene6 11y ago
    errrm and if a dependency is untrustworthy it can execute code on your system at install time... the fact that no-one else is checking and you are therefore in the same boat as other compromised people might not be that much of a consolation
    - coldtea 11y ago
      The thing is, if thousands use it, then you'd know if it's unsafe... Beyond that, yeah, nothing is absolutely certain in life except death and taxes...
      - tamana 11y ago
        This assumption fails in the network connected world where a program can download custom instructions after installation.
        coldtea 11y ago
        It doesn't fail, it's still as usable as ever -- just not infallible, which nothing is anyway. The dynamics of something with a larger user base being more trustworthy don't change because we're on the internet. It's a simple network (no pun intended) effect. If the program "can download custom instructions after installation" then a large user base still means that users will be bound to find it sooner or later (and make it public/fix it) and it makes it less likely to be you (because you're 1 from 200,000 downloading it, not 1 of 20 or 200).
      - raesene6 11y ago
        in security where breaches can cost a lot of money, relying on heavy use as an indication of trustworthiness may not be a great idea. For example OpenSSL was and is used by lots of people, this has not stopped it having a lot of security problems... And true once the vulnerabilities get published you get to know about the problems more quickly but then in a world of targeted attacks and professional exploitation that might not be great comfort..