4 ms·

This makes no sense at all.

Nasrudith 7y ago
I am assuming a more traditional terminal set up where it could be used for injection attacks and escape sequences to execute arbitrary code - combined with the dubious tradition of unchecked ads as a vector. It is possible they had learned from mistakes of the past and have proper output and input segregation to prevent such shenanigans entirely. In which case that would still leave social engineering as an attack surface. "Use X for your product - except X is ransomware or harvests sensitive data."
- ryanlol 7y ago
  I really don’t get it. You’re running their code, whether it prints an ad or not. There’s no need for “injection attacks and escape sequences” at that point.
  - ben509 7y ago
    If someone, for instance, takes control of their repo, then they can upload whatever they like. But that auth can be fairly securely guarded, and it's probably a very hard to do it quietly as packages are signed. But now they're hosting the ads and potentially allowing remote code execution. Now the attacker only needs to get on to a webserver to deploy a payload. That's why it opens a new vector of attack. Moreover, if they're able to own the server quietly, they can be deploying whatever they like to a ton of people over time.
    - ryanlol 7y ago
      All of the terminal ads I’ve seen have been nothing like you suggest. They’ve looked like echo “Hi please send me money”
reallydude 7y ago
If the ad makes a remote call during execution (for an dynamic ad serve), it's an attack vector. There is always custom ad code for analytics that adserves use to fill (the ad placement space) and report back, called an admanager. As an advertiser, you can upload your own admanager (that that has your own custom code. Reading the code of the NPM package will not typically help with understanding what it's going to do, because of the ad ecosystem, which guarantees running code you have never seen. I could understand banning dynamic ad injection and telemetry. My ethical line would be if a package manager were to ban static links/symbols displayed in a README and that's not what NPM aims for, so it's fine by me.
- ryanlol 7y ago
  >If the ad makes a remote call during execution (for an dynamic ad serve), it's an attack vector. There is always custom ad code for analytics that adserves use to fill (the ad placement space) and report back, called an admanager. As an advertiser, you can upload your own admanager (that that has your own custom code Can you point out a real example of terminal advertising like this?
  - reallydude 7y ago
    No. I haven't looked through many js packages. I could make it without any effort via: > https://github.com/feross/funding/blob/master/messages.json https://github.com/feross/funding/blob/master/messages.json Currently it's "manually curated" which is a fancy way of saying, it's my own custom ad-tag that doesn't call an adserver. Replacing one field with a function that is immediately called and getting your value out, is how most people would integrate an ad-tag. Using DFP or whatever, you can plug in an adtag call and parse values and you're in business. Ad platforms don't usually support plaintext tags, but I have seen them still supported by some of the older "native ad" platforms who started as platforms that served HTML strings (Taboola, etc). The takeaway is that NPM nipped it in the bud because it's trivial to abuse.
    - ryanlol 7y ago
      So you’re talking about software which doesn’t exist, right? This seems like a silly slippery slope argument.

I am assuming a more traditional terminal set up where it could be used for injection attacks and escape sequences to execute arbitrary code - combined with the dubious tradition of unchecked ads as a vector. It is possible they had learned from mistakes of the past and have proper output and input segregation to prevent such shenanigans entirely. In which case that would still leave social engineering as an attack surface. "Use X for your product - except X is ransomware or harvests sensitive data."

ryanlol 7y ago
I really don’t get it. You’re running their code, whether it prints an ad or not. There’s no need for “injection attacks and escape sequences” at that point.
- ben509 7y ago
  If someone, for instance, takes control of their repo, then they can upload whatever they like. But that auth can be fairly securely guarded, and it's probably a very hard to do it quietly as packages are signed. But now they're hosting the ads and potentially allowing remote code execution. Now the attacker only needs to get on to a webserver to deploy a payload. That's why it opens a new vector of attack. Moreover, if they're able to own the server quietly, they can be deploying whatever they like to a ton of people over time.
  - ryanlol 7y ago
    All of the terminal ads I’ve seen have been nothing like you suggest. They’ve looked like echo “Hi please send me money”

reallydude 7y ago

If the ad makes a remote call during execution (for an dynamic ad serve), it's an attack vector. There is always custom ad code for analytics that adserves use to fill (the ad placement space) and report back, called an admanager. As an advertiser, you can upload your own admanager (that that has your own custom code. Reading the code of the NPM package will not typically help with understanding what it's going to do, because of the ad ecosystem, which guarantees running code you have never seen. I could understand banning dynamic ad injection and telemetry. My ethical line would be if a package manager were to ban static links/symbols displayed in a README and that's not what NPM aims for, so it's fine by me.

ryanlol 7y ago
>If the ad makes a remote call during execution (for an dynamic ad serve), it's an attack vector. There is always custom ad code for analytics that adserves use to fill (the ad placement space) and report back, called an admanager. As an advertiser, you can upload your own admanager (that that has your own custom code Can you point out a real example of terminal advertising like this?
- reallydude 7y ago
  No. I haven't looked through many js packages. I could make it without any effort via: > https://github.com/feross/funding/blob/master/messages.json https://github.com/feross/funding/blob/master/messages.json Currently it's "manually curated" which is a fancy way of saying, it's my own custom ad-tag that doesn't call an adserver. Replacing one field with a function that is immediately called and getting your value out, is how most people would integrate an ad-tag. Using DFP or whatever, you can plug in an adtag call and parse values and you're in business. Ad platforms don't usually support plaintext tags, but I have seen them still supported by some of the older "native ad" platforms who started as platforms that served HTML strings (Taboola, etc). The takeaway is that NPM nipped it in the bud because it's trivial to abuse.
  - ryanlol 7y ago
    So you’re talking about software which doesn’t exist, right? This seems like a silly slippery slope argument.