4 ms·

Lockfiles should be used for production code, as per https://deno.land/manual/linking_to_external_code/integrity_checking https://deno.land/manual/linking_to_ex

• ecares 6y ago
  That is not enough at all and there are other attacks! I can't belive in 2020 some people still need to be explained why not enforcing https is a terrible thing! For instance, will a lockfile prevent someone from eavesdropping on the download of a modules through http? If so, please kindly tell me how!
  • 1_player 6y ago
    https prevents MITM but doesn't prevent the modules being backdoored or otherwise altered at the source. I would prefer https-only, sure, but it doesn't buy you very much security.
    • ecares 6y ago
      Well, diasabling http by default is basically "Internet 101" here. I don't want to write an full lecture on how many attacks are possible when people don't use https. It has been commmon knowledge for way more than a decade
• realharo 6y ago
  Can checksums/hashes be specified directly in the source file? EDIT: I mean hashes of dependencies. That is important for single-file scripts, if this is meant to be useful as a bash replacement for scripting. Having to download two separate files for a script and execute it with special arguments already adds too much friction to that scenario.
  • ecares 6y ago
    >Can checksums/hashes be specified directly in the source file? That would defeat their point actually :D malicious attacker could inject any script by hacking on the network and replace modules that are downloaded through http
    • realharo 6y ago
      How? Say I have `script.ts`. That file exists locally on my computer and the code inside it is trusted (say it was downloaded from a trusted github project via https). It contains import { dependency } from 'http://whatever.url/@1.0.3' with hash '6f09aa686a6263f9e992' or something like that. If an attacker replaces stuff during transfer of the dependency, then the hash won't match (assuming a collision resistant hash function). This can be transitive if the dependency also has hashes of its dependencies directly inside it (and a "only allow that" mode could enforce it). The additional benefit is that you also don't need to trust the server to not replace code for a URL under your nose from one you have previously verified. So like a lockfile, but without needing to download a separate file (because you also want verification on the first run) and a command-line argument on launch - which makes it a much more viable replacement for bash scripts (in fact, that's why I care about the ability, I wouldn't mind https-only). Am I missing something here?
      • ecares 6y ago
        Oh, I did not get what you meant ^^ well, there are still other issues than integrity with not using https.
        • realharo 6y ago
          Yeah, I'll edit the original comment to clarify that I mean hashes of dependencies.
      • ecares 6y ago
        there are a lot of issues with using a non secure protocol to do anything over the internet, actually someone summarized the issue on the Deno issue tracker. According to them, confidentiality is also a risk. also someone could also send you garbage that would polute the memory of deno until it explode.