3 ms·

This is a piece of software that we are supposed to trust with our passwords. It depends on a long list of crappy bloated software, including something from an

This is a piece of software that we are supposed to trust with our passwords. It depends on a long list of crappy bloated software, including something from an apparently-non-standard source, and including a package manager that is probably going to pull in yet more untold reams of crappy, unaudited, JavaScript code from the four corners of the internet at build time. It would not surprise me if this ended up clocking in at millions of lines of code by the time it built. Just say no.

dsp1234 10y ago
It depends on a long list of crappy bloated software If you don't actually want to test the software, and just want to create a production mobile/desktop application, then it depends on codova, cordova-icon, cordova-splash, semver and it's own source code. That's not a long list. If you want to test it, then it's probably not a shock that it pulls in testing frameworks for testing javascript UIs. including something from an apparently-non-standard source Here are the listed requirements from above: http://nodejs.org/ http://nodejs.org/ npm install -g cordova npm install -g grunt-cli http://phantomjs.org/ http://phantomjs.org/ npm install -g cordova-icon and npm install cordova-splash Can you point out which of these is 'apparently-non-standard'?
- pritambaral 10y ago
  > That's not a long list It's not the list of top-level pieces of software, it's the amount of code that could have contact with the plaintext or the encryption keys. > If you don't actually want to test And build! Don't forget the building itself. It's not so much harder to exploit an app even if all you have access to is its build stage. ---- This is security software we are talking about. The more lines of code that touch it, the more risky it is of being vulnerable. Not to mention the sheer astronomical difficulty of auditing it. From what I know of the industry, I wouldn't be surprised if a security auditor plain refused to touch this because of the sheer magnitude. And that's without even mentioning it uses npm.
  - Freak_NL 10y ago
    A valid concern for a password manager. This is why I like PasswordStore a lot better for managing passwords and other sensitive information. It is a Bash script that only depends on a very select list of binaries (gpg, git, and tree, if I recall correctly). It is also a script simple enough I can even audit it myself: https://www.passwordstore.org/ https://www.passwordstore.org/ For syncing, either use git, or something like syncthing. It doesn't really matter, because all synced files are encrypted by GnuPG before any syncing tools gets access to it.
    - jxy 10y ago
      Thanks for the link to passwordstore.org. Fantastic piece of software!
  - mmanfrin 10y ago
    You can build without grunt. Grunt just makes the flow a lot easier to manage.
    - pritambaral 10y ago
      Grunt is not the problem. It's using the npm ecosystem, the thousands of different codebases that I have little guarantee of constance over, that is the problem. Even using node.js alone (and no npm, no other libraries) would be extremely hard to audit, simply because of the huge code footprint of v8 alone. But at least I can download all the sources one time, audit it, and be certain every future build with the exact same versions would be safe. npm doesn't provide even that much guarantee.

dsp1234 10y ago

It depends on a long list of crappy bloated software If you don't actually want to test the software, and just want to create a production mobile/desktop application, then it depends on codova, cordova-icon, cordova-splash, semver and it's own source code. That's not a long list. If you want to test it, then it's probably not a shock that it pulls in testing frameworks for testing javascript UIs. including something from an apparently-non-standard source Here are the listed requirements from above: http://nodejs.org/ http://nodejs.org/ npm install -g cordova npm install -g grunt-cli http://phantomjs.org/ http://phantomjs.org/ npm install -g cordova-icon and npm install cordova-splash Can you point out which of these is 'apparently-non-standard'?

pritambaral 10y ago
> That's not a long list It's not the list of top-level pieces of software, it's the amount of code that could have contact with the plaintext or the encryption keys. > If you don't actually want to test And build! Don't forget the building itself. It's not so much harder to exploit an app even if all you have access to is its build stage. ---- This is security software we are talking about. The more lines of code that touch it, the more risky it is of being vulnerable. Not to mention the sheer astronomical difficulty of auditing it. From what I know of the industry, I wouldn't be surprised if a security auditor plain refused to touch this because of the sheer magnitude. And that's without even mentioning it uses npm.
- Freak_NL 10y ago
  A valid concern for a password manager. This is why I like PasswordStore a lot better for managing passwords and other sensitive information. It is a Bash script that only depends on a very select list of binaries (gpg, git, and tree, if I recall correctly). It is also a script simple enough I can even audit it myself: https://www.passwordstore.org/ https://www.passwordstore.org/ For syncing, either use git, or something like syncthing. It doesn't really matter, because all synced files are encrypted by GnuPG before any syncing tools gets access to it.
  - jxy 10y ago
    Thanks for the link to passwordstore.org. Fantastic piece of software!
- mmanfrin 10y ago
  You can build without grunt. Grunt just makes the flow a lot easier to manage.
  - pritambaral 10y ago
    Grunt is not the problem. It's using the npm ecosystem, the thousands of different codebases that I have little guarantee of constance over, that is the problem. Even using node.js alone (and no npm, no other libraries) would be extremely hard to audit, simply because of the huge code footprint of v8 alone. But at least I can download all the sources one time, audit it, and be certain every future build with the exact same versions would be safe. npm doesn't provide even that much guarantee.