4 ms·

The hack was apparently exploiting a vulnerability in a third-party dependency in the wallet app, which is built on node.js. All these dependencies that is used

by messo 7y ago

The hack was apparently exploiting a vulnerability in a third-party dependency in the wallet app, which is built on node.js. All these dependencies that is used in the majority of modern apps seems like a huge security risk to me. They make rapid cross-platform development possible, but at what cost? Anyway; the network itself was not hacked, which is good I guess. And the coordinator (centralized node) is said to be the training wheels which will be removed at some point, but it still seems to be quite far of into the future.

jsploit 7y ago
One of the reasons I've stayed away from Node is the ridiculous attack surface brought by the npm ecosystem. It seems that even the simplest of projects end up with hundreds of dependencies - most having different maintainers and security practices.
- johnisgood 7y ago
  How does it compare to Rust's cargo and its crates? The above mentioned "small package that do a single thing" philosophy is rampant there as well.
mrtksn 7y ago
I am somewhat pleased to see JS dependencies causing real-world problems and losses. I was so fed-up with the dependency hell, I switched to native programming. Especially programming for iOS using Swift is such a pleasure, we still have the concept of dependencies and external libraries but the Apple provided libraries are very rich so you would seldom need to import anything from the wild. After seeing the other side of the fence, I am quite surprised that anyone would make native apps with Node.JS. In the time you set up your dependencies for your Electron, ReactNative or whatever you can have your native macOS or iOS app UI running. Also, wouldn't spin the fan when running.
- arsome 7y ago
  The biggest problem as a desktop app developer is that all the good UI libraries are barely maintained, obscure, questionably licensed or have limited 3rd party compatibility meaning you have to build too much from scratch yourself. This is why Electron has taken off so much lately for desktop development.
  - divan 7y ago
    > all the good UI libraries Can you name a few?
  - ClumsyPilot 7y ago
    Oh jesus this actually hits the mail on the head, I had a brief foray into development of UWP (modern windows store) apps, and damn the performance and language are good, but I was so jealous of all the visualizations, ui elements and libraries web devs have access to, while I had to dick about with basic gauges.
  - api 7y ago
    > questionably licensed People don't want to pay for anything, therefore we get... > barely maintained, obscure, ... have limited 3rd party compatibility Building anything really polished that isn't those things is a huge undertaking that someone would have to pay for. Electron piggybacks on the massive web ecosystem which is funded by SaaS, advertising, and surveillance so it lacks the abandonware problem. Unfortunately it's also not really built for the role of desktop or mobile UI layer and so you get a bloated, insecure, slow mess when you try to shoehorn it in there. We don't get what we won't pay for.
- SlowRobotAhead 7y ago
  > I was so fed-up with the dependency hell, I switched to native programming. Same, but I switched to Flutter. Native performance, declarative UI, and while I do still have dependencies, they’re much easier to manage and the scope of individual packages/widgets are much smaller/tighter/focused imo.
  - mrtksn 7y ago
    Don't you still need to learn the native API when you do anything beyond a simple UI?
- throw_m239339 7y ago
  > I switched to native programming. I mean it has more to do with NPM than Javascript or Node itself, NPM and its "small package that do a single thing" bull philosophy, and the fact that multiple versions of the same package are installed in the dependency tree, because NPM allows it, instead of rejecting package conflicts, like Composer or any sane package manager. Conflicts should be resolved by the developers, upstream, and package managers shouldn't install trees of dependencies, dependencies should be flat. It has become almost impossible to audit anything with NPM, when you have the same package installed 50 times with 50 different versions locally.
  - Latty 7y ago
    I mean, one could argue that NPM ended up like that because of JS's terrible standard library that includes none of the basics people need all the time. I really like working with TypeScript, but that is the pain point that always comes up.
  - timdorr 7y ago
    This wasn't an npm vulnerability. It's a direct link to a CDN file that was compromised: https://github.com/iotaledger/trinity-wallet/pull/2565/files#diff-bafa027c31caffa28093844213af12a7L38 https://github.com/iotaledger/trinity-wallet/pull/2565/files...
- deleted 7y ago
  [deleted]
- thefounder 7y ago
  Electron is not only about JavaScript. Fortunately now you can compile many "native" languages to wasm (i.e Go)
xref 7y ago
There any further details on this, like which specific lib so we can view commit history?

by messo 7y ago

jsploit 7y ago

One of the reasons I've stayed away from Node is the ridiculous attack surface brought by the npm ecosystem. It seems that even the simplest of projects end up with hundreds of dependencies - most having different maintainers and security practices.

johnisgood 7y ago
How does it compare to Rust's cargo and its crates? The above mentioned "small package that do a single thing" philosophy is rampant there as well.

mrtksn 7y ago

I am somewhat pleased to see JS dependencies causing real-world problems and losses. I was so fed-up with the dependency hell, I switched to native programming. Especially programming for iOS using Swift is such a pleasure, we still have the concept of dependencies and external libraries but the Apple provided libraries are very rich so you would seldom need to import anything from the wild. After seeing the other side of the fence, I am quite surprised that anyone would make native apps with Node.JS. In the time you set up your dependencies for your Electron, ReactNative or whatever you can have your native macOS or iOS app UI running. Also, wouldn't spin the fan when running.

arsome 7y ago
The biggest problem as a desktop app developer is that all the good UI libraries are barely maintained, obscure, questionably licensed or have limited 3rd party compatibility meaning you have to build too much from scratch yourself. This is why Electron has taken off so much lately for desktop development.
- divan 7y ago
  > all the good UI libraries Can you name a few?
- ClumsyPilot 7y ago
  Oh jesus this actually hits the mail on the head, I had a brief foray into development of UWP (modern windows store) apps, and damn the performance and language are good, but I was so jealous of all the visualizations, ui elements and libraries web devs have access to, while I had to dick about with basic gauges.
- api 7y ago
  > questionably licensed People don't want to pay for anything, therefore we get... > barely maintained, obscure, ... have limited 3rd party compatibility Building anything really polished that isn't those things is a huge undertaking that someone would have to pay for. Electron piggybacks on the massive web ecosystem which is funded by SaaS, advertising, and surveillance so it lacks the abandonware problem. Unfortunately it's also not really built for the role of desktop or mobile UI layer and so you get a bloated, insecure, slow mess when you try to shoehorn it in there. We don't get what we won't pay for.
SlowRobotAhead 7y ago
> I was so fed-up with the dependency hell, I switched to native programming. Same, but I switched to Flutter. Native performance, declarative UI, and while I do still have dependencies, they’re much easier to manage and the scope of individual packages/widgets are much smaller/tighter/focused imo.
- mrtksn 7y ago
  Don't you still need to learn the native API when you do anything beyond a simple UI?
throw_m239339 7y ago
> I switched to native programming. I mean it has more to do with NPM than Javascript or Node itself, NPM and its "small package that do a single thing" bull philosophy, and the fact that multiple versions of the same package are installed in the dependency tree, because NPM allows it, instead of rejecting package conflicts, like Composer or any sane package manager. Conflicts should be resolved by the developers, upstream, and package managers shouldn't install trees of dependencies, dependencies should be flat. It has become almost impossible to audit anything with NPM, when you have the same package installed 50 times with 50 different versions locally.
- Latty 7y ago
  I mean, one could argue that NPM ended up like that because of JS's terrible standard library that includes none of the basics people need all the time. I really like working with TypeScript, but that is the pain point that always comes up.
- timdorr 7y ago
  This wasn't an npm vulnerability. It's a direct link to a CDN file that was compromised: https://github.com/iotaledger/trinity-wallet/pull/2565/files#diff-bafa027c31caffa28093844213af12a7L38 https://github.com/iotaledger/trinity-wallet/pull/2565/files...
deleted 7y ago
[deleted]
thefounder 7y ago
Electron is not only about JavaScript. Fortunately now you can compile many "native" languages to wasm (i.e Go)

xref 7y ago

There any further details on this, like which specific lib so we can view commit history?