3 ms·

It's sad to see people reject this suggestion based on such weak grounds. "It won't stop all attacks" is true, but if it raises the costs of attacks, and prote

It's sad to see people reject this suggestion based on such weak grounds. "It won't stop all attacks" is true, but if it raises the costs of attacks, and protects more people that it harms, then it is worthwhile. Similarly, "It's a backwards incompatible change" is not a sufficient argument, as changes like that are made all the time (of course requiring a major version bump). To address the resistance, I would propose a compromise, namely that install scripts won't be run by default unless the publishing account is secured by 2FA, or the previous version of the package also included an install script. That should greatly reduce the attack surface, and pave the way towards requiring 2FA for all packages with install scripts as a later step.

Arnavion 5y ago
>but if it raises the costs of attacks, and protects more people that it harms, then it is worthwhile. But how does it raise the cost of attacks? I don't see why it would be harder for someone uploading a malicious package to embed said malicious code in the index.js instead of in the install scripts.
- unilynx 5y ago
  If I was installing the module only for use in frontend, eg to be bundled by webpack, the code in your index.js won't execute on the machine but inside the browser sandbox. That makes it a lot harder to steal ssh keys.
  - Arnavion 5y ago
    Yes, that's valid, though it isn't about increasing the cost of attacking (what my comment was about).
ollien 5y ago
It raises the cost of attack, sure. That said, just about every developer I know is not going to think about it and is just going to hit "OK" at the first opportunity. The VSCode "this directory isn't trusted" warning comes to mind. I know of no one who actually takes that to heart. Perhaps we should, but few will actually take the time, sadly.
- dane-pgp 5y ago
  The default install process should stop and prompt you with something like: Package ua-parser-js wants to run a script before installing. The description of the package is: "Detect Browser, Engine, and Device type/model from User-Agent data." The reason for the pre-install script is: "Configuring the local user agent thing for reasons." This script has been unchanged since version 0.7.29 which was published: 14 hours ago The hash of the script is: 0123456789abcdef Press Y to examine the script, or N to cancel installation. After npm echoes out the script, the user should decide whether it looks obfuscated or does anything suspicious. If the user is still unsure, they can search the web for the hash of the script to see if other people have audited it. For automated installs, such as a CI server, there would need to be a command line argument or config file entry with something like: allow-preinstall-scripts: ["0123456789abcdef"]
deleted 5y ago
[deleted]

Arnavion 5y ago

>but if it raises the costs of attacks, and protects more people that it harms, then it is worthwhile. But how does it raise the cost of attacks? I don't see why it would be harder for someone uploading a malicious package to embed said malicious code in the index.js instead of in the install scripts.

unilynx 5y ago
If I was installing the module only for use in frontend, eg to be bundled by webpack, the code in your index.js won't execute on the machine but inside the browser sandbox. That makes it a lot harder to steal ssh keys.
- Arnavion 5y ago
  Yes, that's valid, though it isn't about increasing the cost of attacking (what my comment was about).

ollien 5y ago

It raises the cost of attack, sure. That said, just about every developer I know is not going to think about it and is just going to hit "OK" at the first opportunity. The VSCode "this directory isn't trusted" warning comes to mind. I know of no one who actually takes that to heart. Perhaps we should, but few will actually take the time, sadly.

dane-pgp 5y ago
The default install process should stop and prompt you with something like: Package ua-parser-js wants to run a script before installing. The description of the package is: "Detect Browser, Engine, and Device type/model from User-Agent data." The reason for the pre-install script is: "Configuring the local user agent thing for reasons." This script has been unchanged since version 0.7.29 which was published: 14 hours ago The hash of the script is: 0123456789abcdef Press Y to examine the script, or N to cancel installation. After npm echoes out the script, the user should decide whether it looks obfuscated or does anything suspicious. If the user is still unsure, they can search the web for the hash of the script to see if other people have audited it. For automated installs, such as a CI server, there would need to be a command line argument or config file entry with something like: allow-preinstall-scripts: ["0123456789abcdef"]

deleted 5y ago

[deleted]