4 ms·

An additional element adding to this chaos is the security vulnerability of npm packages. How often do we actually examine the package's code in detail before i

An additional element adding to this chaos is the security vulnerability of npm packages. How often do we actually examine the package's code in detail before including it in a project? Relevant article: https://hackernoon.com/im-harvesting-credit-card-numbers-and-passwords-from-your-site-here-s-how-9a8cb347c5b5 https://hackernoon.com/im-harvesting-credit-card-numbers-and...

calibas 9y ago
I don't know if it's still the case, but one of the first things I learned about JavaScript was how it was inherently secure. Then I actually started using the language, and learned what utter bullshit that is.
- gramstrong 9y ago
  > inherently secure Who told you that? I don't think "inherently secure" is a thing in the tech industry.
  - calibas 9y ago
    I was taught that Javascript is safe because it has no input/output on its own, which is essentially true, but it's dangerous to work from that assumption since in the real world a program needs to have input/output to be useful.
    - marshray 9y ago
      Node.js adds that input/output.
- TheAceOfHearts 9y ago
  The ECMAScript spec doesn't include details about its environment. You can run it in varying environments, each of which has different security criteria. For example, you can run a fully isolated JS VM that has no interactions with the real world, which is certainly quite safe. Node has full access to pretty much all the user's system resources, while the browser is a bit more sandboxed and restricted in what it can access.
  - calibas 9y ago
    Except in the case of Spectre/Meltdown...
deusex_ 9y ago
How is it different from maven deps?
- kkapelon 9y ago
  Usually you don't use maven deps directly. You have a registry in your company that caches maven packages for you and runs vulnerability scans on the binary. So the binaries you end up using are "tested" internally. Is that how people use NPM? Also maven central does NOT support unpublishing of binaries. So if you have version 1.2 of something and you have scanned it once for vulnerabilities, it should always be the correct one. Nobody can publish again 1.2 in the central repo
  - kabes 9y ago
    In every somewhat serious company I've worked they used a local npm cache like jfrog (usually same one that's used for maven) that can get scanned for security. So yeah, that's how people use npm. Unpublishing within those companies is usually not allowed, in the official npm registry you can only unpublish within the first 24 hours of publishing, after that you need to request it by email.
    - kkapelon 9y ago
      >In every somewhat serious company I've worked they used a local npm If that was the case for everybody, then left-pad would not have caused a problem for anybody. People would not notice anything wrong with their builds. The amount of github comments where people say that their production build just broke because of a missing package implies that people are NOT using NPM with a local registry >in the official npm registry you can only unpublish within the first 24 hours of publishing I don't believe this to be the case https://news.ycombinator.com/item?id=16087024 https://news.ycombinator.com/item?id=16087024
      - twelve40 9y ago
        Just because it's a shitty common practice doesn't mean there isn't a proper way to do it (local repo). For example, there are tons of people who check in their secrets into public and private Github repos (including Uber eng), then they get jacked and complain. If they were smarter than that, "it would not have caused a problem for anybody". Doesn't really prove that what a lot of people do must be automatically good.

calibas 9y ago

I don't know if it's still the case, but one of the first things I learned about JavaScript was how it was inherently secure. Then I actually started using the language, and learned what utter bullshit that is.

gramstrong 9y ago
> inherently secure Who told you that? I don't think "inherently secure" is a thing in the tech industry.
- calibas 9y ago
  I was taught that Javascript is safe because it has no input/output on its own, which is essentially true, but it's dangerous to work from that assumption since in the real world a program needs to have input/output to be useful.
  - marshray 9y ago
    Node.js adds that input/output.
TheAceOfHearts 9y ago
The ECMAScript spec doesn't include details about its environment. You can run it in varying environments, each of which has different security criteria. For example, you can run a fully isolated JS VM that has no interactions with the real world, which is certainly quite safe. Node has full access to pretty much all the user's system resources, while the browser is a bit more sandboxed and restricted in what it can access.
- calibas 9y ago
  Except in the case of Spectre/Meltdown...

deusex_ 9y ago

How is it different from maven deps?

kkapelon 9y ago
Usually you don't use maven deps directly. You have a registry in your company that caches maven packages for you and runs vulnerability scans on the binary. So the binaries you end up using are "tested" internally. Is that how people use NPM? Also maven central does NOT support unpublishing of binaries. So if you have version 1.2 of something and you have scanned it once for vulnerabilities, it should always be the correct one. Nobody can publish again 1.2 in the central repo
- kabes 9y ago
  In every somewhat serious company I've worked they used a local npm cache like jfrog (usually same one that's used for maven) that can get scanned for security. So yeah, that's how people use npm. Unpublishing within those companies is usually not allowed, in the official npm registry you can only unpublish within the first 24 hours of publishing, after that you need to request it by email.
  - kkapelon 9y ago
    >In every somewhat serious company I've worked they used a local npm If that was the case for everybody, then left-pad would not have caused a problem for anybody. People would not notice anything wrong with their builds. The amount of github comments where people say that their production build just broke because of a missing package implies that people are NOT using NPM with a local registry >in the official npm registry you can only unpublish within the first 24 hours of publishing I don't believe this to be the case https://news.ycombinator.com/item?id=16087024 https://news.ycombinator.com/item?id=16087024
    - twelve40 9y ago
      Just because it's a shitty common practice doesn't mean there isn't a proper way to do it (local repo). For example, there are tons of people who check in their secrets into public and private Github repos (including Uber eng), then they get jacked and complain. If they were smarter than that, "it would not have caused a problem for anybody". Doesn't really prove that what a lot of people do must be automatically good.