3 ms·

> How is this an easy fix? Now developers need to develop and maintain O(N) instead of O(1) software projects. At some point, developers need to take responsib

> How is this an easy fix? Now developers need to develop and maintain O(N) instead of O(1) software projects. At some point, developers need to take responsibility for the security of their projects. If your project is larger, you will need to maintain more code, whether directly or indirectly. You can't simply import a dependency but never audit it. And if you're taking the trouble to audit a third-party dependency, at some point it becomes worth maintaining directly. > sensitive dependencies, like crypto or network / http libraries. I am not suggesting that developers reimplement TCP.

sterlind 7y ago
I've had to reinvent the wheel, over and over again, throughout my career. Sometimes it was because our environment was constrained (no cloud, needs to be up for major disasters), or because the architecture was unique (no primary, all protocols must be decentralized), or because what I needed didn't exist for my stack. It's pain and sorrow all the way down and I find more bugs in my reinvented wheels than in the actu code I set out to write. How about this: 0. Rebuild from latest stable dependencies, or latest updates to your LTSB, whenever you or your dependencies have a bug. 1. Prefer static linking or lib incorporation if feasible, or use a package manager that properly guarantees you the right versions. 2. Stick to popular repos with responsive maintainers, or 3. Fork the dependency yourself, audit the code and know how to debug it. 4. Watch upstream for security bugs.
- jorangreef 7y ago
  Sure, and 5 would be: Prefer dependencies with smaller flatter dependency trees.
perlgeek 7y ago
> At some point, developers need to take responsibility for the security of their projects. Agreed, but that could be through careful selection instead of rolling your own. And it would be great if there was better tooling for that. Imagine an ecosystem where every module author automatically gets not just a public repo and issue tracker, but also a way to deal with security issues, an indication if all contributors used 2FA for code contribution and package uploads. Then there could be a search for packages where you can say "only give me those with 2FA and a defined security disclosure process, including all transitive dependencies". That wouldn't be perfect, but much, much better than any ecosystem I've seen so far.

sterlind 7y ago

I've had to reinvent the wheel, over and over again, throughout my career. Sometimes it was because our environment was constrained (no cloud, needs to be up for major disasters), or because the architecture was unique (no primary, all protocols must be decentralized), or because what I needed didn't exist for my stack. It's pain and sorrow all the way down and I find more bugs in my reinvented wheels than in the actu code I set out to write. How about this: 0. Rebuild from latest stable dependencies, or latest updates to your LTSB, whenever you or your dependencies have a bug. 1. Prefer static linking or lib incorporation if feasible, or use a package manager that properly guarantees you the right versions. 2. Stick to popular repos with responsive maintainers, or 3. Fork the dependency yourself, audit the code and know how to debug it. 4. Watch upstream for security bugs.

jorangreef 7y ago
Sure, and 5 would be: Prefer dependencies with smaller flatter dependency trees.

perlgeek 7y ago

> At some point, developers need to take responsibility for the security of their projects. Agreed, but that could be through careful selection instead of rolling your own. And it would be great if there was better tooling for that. Imagine an ecosystem where every module author automatically gets not just a public repo and issue tracker, but also a way to deal with security issues, an indication if all contributors used 2FA for code contribution and package uploads. Then there could be a search for packages where you can say "only give me those with 2FA and a defined security disclosure process, including all transitive dependencies". That wouldn't be perfect, but much, much better than any ecosystem I've seen so far.