13 ms·

> I’m increasingly fatalistic about computer security. It seems like your options are carefully auditing all dependencies (difficult and maybe impossible if the

by remus 5y ago

> I’m increasingly fatalistic about computer security. It seems like your options are carefully auditing all dependencies (difficult and maybe impossible if the dependencies are highly technical or the malicious code is sufficiently subtle or obfuscated) every time you update, not updating at all (which leaves you vulnerable to all the bugs and other security issues in the version you choose to pin), or not using dependencies at all (by spending months or years totally rewriting the libraries and tools you need, and of course your own code will have bugs too). There is also the option of having trusted third parties review code. This is by no means an easy option but it does seem more feasible than everyone auditing every line of code they ever depend on. You do end up with spicy questions like who do we trust to audit code? Why do we trust them? How are they actually auditing this code?

worik 5y ago
But that costs money. Money that if not spent, goes straight to the profit line
rectang 5y ago
The big problem is not bugs, not vulnerabilities, but malicious code inserted deliberately into packages published by attackers. One way to detect malicious code is line-by-line code review of published packages, but that's extremely laborious, even when done by third parties. What we really want to do is confirm that the package was the end product of an open source commit history, where commits were reviewed by a set of trusted authors (hey look third parties!) over time. That involves strong validation of publisher identities and cryptographic validation of the package contents to connect it to a commit history in a trusted public repository.
_tom_ 5y ago
Another option is reducing number of dependencies. Doesn't cure the problem but can cut the vulnerability surface by orders of magnitude. Transitive dependencies can, and frequently do result in The majority of the code in an application being unneeded. Using one function from a dependency can result in whole sets of libraries or even whole languages being included in the project.

by remus 5y ago

worik 5y ago

But that costs money. Money that if not spent, goes straight to the profit line

rectang 5y ago

The big problem is not bugs, not vulnerabilities, but malicious code inserted deliberately into packages published by attackers. One way to detect malicious code is line-by-line code review of published packages, but that's extremely laborious, even when done by third parties. What we really want to do is confirm that the package was the end product of an open source commit history, where commits were reviewed by a set of trusted authors (hey look third parties!) over time. That involves strong validation of publisher identities and cryptographic validation of the package contents to connect it to a commit history in a trusted public repository.

_tom_ 5y ago

Another option is reducing number of dependencies. Doesn't cure the problem but can cut the vulnerability surface by orders of magnitude. Transitive dependencies can, and frequently do result in The majority of the code in an application being unneeded. Using one function from a dependency can result in whole sets of libraries or even whole languages being included in the project.