4 ms·

A review system unfortunately isn't likely to be practicable with current development models. npm alone has over 500,000 packages (http://www.modulecounts.com/

A review system unfortunately isn't likely to be practicable with current development models. npm alone has over 500,000 packages (http://www.modulecounts.com/ http://www.modulecounts.com/) so even a one time review isn't going to happen. If people want a more trusted solution the likely outcome is that they'll need to use a smaller more static set of libraries and then either do the audits themselves, or outsource that to a 3rd party. Ofc with current speeds of change and deployments, it doesn't seem likely that many companies will adopt that model.

mschuster91 9y ago
> npm alone has over 500,000 packages (http://www.modulecounts.com/ http://www.modulecounts.com/) so even a one time review isn't going to happen. But at least the modules with the most downloads (webpack, react, or stuff like left-pad) could be vetted, and especially npm could implement a 2-or-more person model - basically, everyone with publish access can upload a new artifact, but to actually have it distributed to endusers, a second person would be required to sign off.
- raesene6 9y ago
  Indeed it's not impossible to do (although full code review would be expensive/tricky/slow). The fact it hasn't been done despite the obvious risks indicates how much demand there is for this feature...
  - lanstin 9y ago
    Full code review while not bad is probably not going to stop attackers. Often I can barely understand what the dev intended with non hostile code. Something more along the lines of strace on the install and run down any connects or execs. Runtime is different.
- IgorPartola 9y ago
  That's the thing. I worry less about popular packages. I can check that Django's GitHub repo links to PyPI and vice versa. But a random package to parse DSN's? I don't know it from Adam. I want to use it, and lots of others do too, but not everyone is going to review it. Maybe just a button on the package that says "I found insecure code!" Would be good.
  - mschuster91 9y ago
    > That's the thing. I worry less about popular packages. I can check that Django's GitHub repo links to PyPI and vice versa. I worry about the most popular, and there the small and next-to-unmaintained. Just think back to the left-pad desaster that broke builds all over the world and imagine it was not a deleted package but an update containing malware. I assume there are lots of such "hidden gems" where the maintainer has gone away... the consequences of hacking just one improperly secured account are severe.
eeZah7Ux 9y ago
> they'll need to use a smaller more static set of libraries That's what stable Linux distributions do.
- raesene6 9y ago
  Indeed they do, and you can get some libs for Node/ruby etc there, however most companies, from what I've seen choose the option of using direct access to npm/rubygems etc.

mschuster91 9y ago

> npm alone has over 500,000 packages (http://www.modulecounts.com/ http://www.modulecounts.com/) so even a one time review isn't going to happen. But at least the modules with the most downloads (webpack, react, or stuff like left-pad) could be vetted, and especially npm could implement a 2-or-more person model - basically, everyone with publish access can upload a new artifact, but to actually have it distributed to endusers, a second person would be required to sign off.

raesene6 9y ago
Indeed it's not impossible to do (although full code review would be expensive/tricky/slow). The fact it hasn't been done despite the obvious risks indicates how much demand there is for this feature...
- lanstin 9y ago
  Full code review while not bad is probably not going to stop attackers. Often I can barely understand what the dev intended with non hostile code. Something more along the lines of strace on the install and run down any connects or execs. Runtime is different.
IgorPartola 9y ago
That's the thing. I worry less about popular packages. I can check that Django's GitHub repo links to PyPI and vice versa. But a random package to parse DSN's? I don't know it from Adam. I want to use it, and lots of others do too, but not everyone is going to review it. Maybe just a button on the package that says "I found insecure code!" Would be good.
- mschuster91 9y ago
  > That's the thing. I worry less about popular packages. I can check that Django's GitHub repo links to PyPI and vice versa. I worry about the most popular, and there the small and next-to-unmaintained. Just think back to the left-pad desaster that broke builds all over the world and imagine it was not a deleted package but an update containing malware. I assume there are lots of such "hidden gems" where the maintainer has gone away... the consequences of hacking just one improperly secured account are severe.

eeZah7Ux 9y ago

> they'll need to use a smaller more static set of libraries That's what stable Linux distributions do.

raesene6 9y ago
Indeed they do, and you can get some libs for Node/ruby etc there, however most companies, from what I've seen choose the option of using direct access to npm/rubygems etc.