5 ms·

Code review can't catch determined malicious actors. It just isn't a viable protection against that kind of attack. Take a look at the underhanded c contest fo

Code review can't catch determined malicious actors. It just isn't a viable protection against that kind of attack. Take a look at the underhanded c contest for plenty of proof where even very senior developers told up front that there is a backdoor in the code often can't find it! And they can't all be blamed on C being C, many of them would work the same in any language. I don't know the solution, but shaming users and developers for not reviewing code enough sure as hell isn't it. All that being said, reviewing changes in dependencies is still a good idea, as it can catch many other things.

kurtisc 8y ago
Most malicious actors aren't determined, they're lazy and will take the path of least resistance. Code review will catch out those.
floatingatoll 8y ago
There’s no shame in refusing to study dependency diffs. If you consciously evaluate the risk and deem it acceptable, I agree with your judgement call. What I find shameful is the lack of advisory warnings about this risk — by the repository, by the language’s community, by the teaching material. This should have been a clearly-known risk. Instead, it was a surprise. The shame here falls on the NPM community as a whole failing to educate its users on the risks inherent in NPM, not the individual authors and users of NPM modules.