3 ms·

> exfiltration of all your passwords is only one of those being compromised away at any given point No, that's absolutely not true. Those dependencies will no

> exfiltration of all your passwords is only one of those being compromised away at any given point No, that's absolutely not true. Those dependencies will not automatically update in your local app. The 1password developers should be auditing all updates to those dependencies too, and if you trust the 1Password developers to be competent, then you don't have to trust 25 random developers. Furthermore, this isn't unique to electron apps. If they wrote this in c++, you'd still have to trust 1password devs to audit a dozen libraries they'd vendor in.

drdaeman 6y ago
Trust is non-binary. It is a perfectly legitimate concern that npm dependencies are a threat vector. Obviously, at build time - but we've all heard stories how less security conscious developers let malicious code slip through with just `npm update`. And compared to, e.g., C++ tooling (npm) makes it somewhat easier to slip a malicious update through. So it's not like that's strictly incorrect. The concern is that is not exactly clear what processes AgileBits have in place and how they manage those dependencies. They could - and probably do - things the proper way (private registry for all dependencies, etc), but the concern is that they're accidentally missing something is perfectly valid - albeit voiced incorrectly (as a statement that it is insecure, not a question whenever they do things in a secure manner). Brain farts just happen, even to the very best developers and teams.
- self_awareness 6y ago
  > Trust is non-binary. What do you mean by that? You either trust, or you don't trust. How can you half-trust?
sroussey 6y ago
It’s worse in C++ as you probably don’t get a list of those dependencies.
mekster 6y ago
> The 1password developers should be auditing all updates to those dependencies too This is just wishful thinking unless there's a public security audit against a specific version. Funny you bring about blind trust when talking about a security sensitive app.

drdaeman 6y ago

Trust is non-binary. It is a perfectly legitimate concern that npm dependencies are a threat vector. Obviously, at build time - but we've all heard stories how less security conscious developers let malicious code slip through with just `npm update`. And compared to, e.g., C++ tooling (npm) makes it somewhat easier to slip a malicious update through. So it's not like that's strictly incorrect. The concern is that is not exactly clear what processes AgileBits have in place and how they manage those dependencies. They could - and probably do - things the proper way (private registry for all dependencies, etc), but the concern is that they're accidentally missing something is perfectly valid - albeit voiced incorrectly (as a statement that it is insecure, not a question whenever they do things in a secure manner). Brain farts just happen, even to the very best developers and teams.

self_awareness 6y ago
> Trust is non-binary. What do you mean by that? You either trust, or you don't trust. How can you half-trust?

sroussey 6y ago

It’s worse in C++ as you probably don’t get a list of those dependencies.

mekster 6y ago

> The 1password developers should be auditing all updates to those dependencies too This is just wishful thinking unless there's a public security audit against a specific version. Funny you bring about blind trust when talking about a security sensitive app.