5 ms·
> everyone has this problem. No, they don't. Some people actually implemented the "web of trust (sigh)". Security is hard; the answer is not to just go "too h
by vacri 9y ago
> everyone has this problem.
No, they don't. Some people actually implemented the "web of trust (sigh)".
Security is hard; the answer is not to just go "too hard, kick the can down the road" and then make excuses when the time comes for damage control. NPM being an order of magnitude larger means that more focus should be given to security, not less, since it has that extra noise acting as another way to hide malicious activity.
- KirinDave 9y agoThat's fine, but gpg signatures would do nothing to prevent this and widy scaled webs of trust don't exist.
- throwaway91111 9y agoEasy to say. Care explaining? These signatures seem like exactly the thing to prevent mitm attacks. I trust signature A; i won't load the package unless it's signed by signature A. Most people won't be that strict in informal development, but that's not really what this is about.
- danieldk 9y agoJust signatures would indeed not help much in this particular case. Signatures plus other ways to establish trust will help. To give two examples: - macOS apps need to be signed (to run without extra work). The keypair is associated with a developer ID account that has a credit card on file. Abuse is still possible (stolen credit card, stolen certificate), but a lot harder. - Some open source project have their own WoT. For example, IIRC NetBSD required new developers to meet with one or two existing developers in person to verify their identity. (Pretty much like a regular PGP WoT.) These are more work, but they also make the world safer for users.
- DorothySim 9y ago> For example, IIRC NetBSD required new developers to meet with one or two existing developers in person to verify their identity. (Pretty much like a regular PGP WoT.) Debian also requires OpenPGP keys and WoT for all developers.
- KirinDave 9y agoWhat is WOT in this context? I thought Debian required that you register with them, not that there was some other trust threshold.
- KirinDave 9y agoApple doesn't have a web of trust. Microsoft and Google do not either. They bless your code for their marketplaces. Crypto is just coincidentally how they do it. A web of trust implies transitive trust. I'm pretty sure the same is true of Debian, but I don't know about the others. But these are NOT webs of trust. What's more, other open source projects simply do not deal with the scale of NPM. The amount of data they move and offer is pretty brutal. Lots of dismissive engineers sneer at the javascript numeric tower and simply do not understand how difficult and perhaps even surprising the implementation of NPM as a platform is, given its scale.