7 ms·

> I really like how the NPM simultaneously insults two legends in crypto and does _nothing_ to protect the node ecosystem, deferring to "better solutions" that

> I really like how the NPM simultaneously insults two legends in crypto and does _nothing_ to protect the node ecosystem, deferring to "better solutions" that don't exist and will never exist. But they're right. What exactly would PKI do here? Someone is generating confusion. You could argue that maybe a PKI solution could be used to inform the UI such that users are less likely to make mistakes, but browbeating NPM over this is silly. Maven has this problem (people really concerned built their own tools: https://github.com/whispersystems/gradle-witness https://github.com/whispersystems/gradle-witness), choclatey has this problem, pip has this problem, everyone has this problem. The big difference is that the NPM ecosystem is just an order of magnitude bigger than most others, and its model of many small packages can hide many more key packages in the noise.

danjoc 9y ago
>Maven has this problem What malicious packages have been found on Maven central?
- KirinDave 9y ago
  Why don't you google or follow the link I already gave?
  - danjoc 9y ago
    Exactly what I thought. You can't name one. Coincidentally, Maven central requires GPG signatures.
    - KirinDave 9y ago
      As we all know you can only sign a piece of code if it is free of malicious software. Heck, I read that you can't even make a GPG key without proving your virtue to Richard Stallman in festivus-style competition.
slackingoff2017 9y ago
Maven does not have this problem. That package was just something you googled that hasn't been updated in two years because maven has required signed packages forever. My packages are all cryptographically signed with my private key. Maven doesn't just offer code signing, it's mandatory to deploy projects to the central repo. The automated package verifier will reject you if you don't have it. If someone gains access to my account and tries to modify my package without my private key it will not be accepted into the repo. And actually, I'm pretty sure maven signs not just the code but also the documentation and everything else within your package. Light-years ahead of NPM, even after their publicized issues.
- detaro 9y ago
  How does "You need my private key to sign the cross-env package" stop someone from creating a "crossenv" package? What does the specific workflow look like that makes sure I don't add the wrong thing to my project?
  - chii 9y ago
    It doesn't. They's not the problem being solved by signing. In all likelihood, if an end user got socially engineered to download the wrong package, there's very little to be done. Perhaps the install process can do a search and display similarly named packages, and the users could be more alert to irregularly named ones?
    - KirinDave 9y ago
      What's to be done is remove the package and try and dox the perpetrator to kingdom come, in hopes that law enforcement and social reputation can make an example of of them.
      - _jal 9y ago
        That method does not scale. Additionally, it assumes that members of law enforcement are not publishing malware.
deleted 9y ago
[deleted]
vacri 9y ago
> everyone has this problem. No, they don't. Some people actually implemented the "web of trust (sigh)". Security is hard; the answer is not to just go "too hard, kick the can down the road" and then make excuses when the time comes for damage control. NPM being an order of magnitude larger means that more focus should be given to security, not less, since it has that extra noise acting as another way to hide malicious activity.
- KirinDave 9y ago
  That's fine, but gpg signatures would do nothing to prevent this and widy scaled webs of trust don't exist.
  - throwaway91111 9y ago
    Easy to say. Care explaining? These signatures seem like exactly the thing to prevent mitm attacks. I trust signature A; i won't load the package unless it's signed by signature A. Most people won't be that strict in informal development, but that's not really what this is about.
  - danieldk 9y ago
    Just signatures would indeed not help much in this particular case. Signatures plus other ways to establish trust will help. To give two examples: - macOS apps need to be signed (to run without extra work). The keypair is associated with a developer ID account that has a credit card on file. Abuse is still possible (stolen credit card, stolen certificate), but a lot harder. - Some open source project have their own WoT. For example, IIRC NetBSD required new developers to meet with one or two existing developers in person to verify their identity. (Pretty much like a regular PGP WoT.) These are more work, but they also make the world safer for users.
    - DorothySim 9y ago
      > For example, IIRC NetBSD required new developers to meet with one or two existing developers in person to verify their identity. (Pretty much like a regular PGP WoT.) Debian also requires OpenPGP keys and WoT for all developers.

danjoc 9y ago

>Maven has this problem What malicious packages have been found on Maven central?

KirinDave 9y ago
Why don't you google or follow the link I already gave?
- danjoc 9y ago
  Exactly what I thought. You can't name one. Coincidentally, Maven central requires GPG signatures.
  - KirinDave 9y ago
    As we all know you can only sign a piece of code if it is free of malicious software. Heck, I read that you can't even make a GPG key without proving your virtue to Richard Stallman in festivus-style competition.

slackingoff2017 9y ago

Maven does not have this problem. That package was just something you googled that hasn't been updated in two years because maven has required signed packages forever. My packages are all cryptographically signed with my private key. Maven doesn't just offer code signing, it's mandatory to deploy projects to the central repo. The automated package verifier will reject you if you don't have it. If someone gains access to my account and tries to modify my package without my private key it will not be accepted into the repo. And actually, I'm pretty sure maven signs not just the code but also the documentation and everything else within your package. Light-years ahead of NPM, even after their publicized issues.

detaro 9y ago
How does "You need my private key to sign the cross-env package" stop someone from creating a "crossenv" package? What does the specific workflow look like that makes sure I don't add the wrong thing to my project?
- chii 9y ago
  It doesn't. They's not the problem being solved by signing. In all likelihood, if an end user got socially engineered to download the wrong package, there's very little to be done. Perhaps the install process can do a search and display similarly named packages, and the users could be more alert to irregularly named ones?
  - KirinDave 9y ago
    What's to be done is remove the package and try and dox the perpetrator to kingdom come, in hopes that law enforcement and social reputation can make an example of of them.
    - _jal 9y ago
      That method does not scale. Additionally, it assumes that members of law enforcement are not publishing malware.

deleted 9y ago

[deleted]

vacri 9y ago

> everyone has this problem. No, they don't. Some people actually implemented the "web of trust (sigh)". Security is hard; the answer is not to just go "too hard, kick the can down the road" and then make excuses when the time comes for damage control. NPM being an order of magnitude larger means that more focus should be given to security, not less, since it has that extra noise acting as another way to hide malicious activity.

KirinDave 9y ago
That's fine, but gpg signatures would do nothing to prevent this and widy scaled webs of trust don't exist.
- throwaway91111 9y ago
  Easy to say. Care explaining? These signatures seem like exactly the thing to prevent mitm attacks. I trust signature A; i won't load the package unless it's signed by signature A. Most people won't be that strict in informal development, but that's not really what this is about.
- danieldk 9y ago
  Just signatures would indeed not help much in this particular case. Signatures plus other ways to establish trust will help. To give two examples: - macOS apps need to be signed (to run without extra work). The keypair is associated with a developer ID account that has a credit card on file. Abuse is still possible (stolen credit card, stolen certificate), but a lot harder. - Some open source project have their own WoT. For example, IIRC NetBSD required new developers to meet with one or two existing developers in person to verify their identity. (Pretty much like a regular PGP WoT.) These are more work, but they also make the world safer for users.
  - DorothySim 9y ago
    > For example, IIRC NetBSD required new developers to meet with one or two existing developers in person to verify their identity. (Pretty much like a regular PGP WoT.) Debian also requires OpenPGP keys and WoT for all developers.