4 ms·
At some point people need to stop pulling in random unsigned libraries from the internet and deploying them without any review or testing. This chaos seems lik
by bcrl 5y ago
At some point people need to stop pulling in random unsigned libraries from the internet and deploying them without any review or testing. This chaos seems like it would be entirely preventable with just a small sprinkling of best practices.
- Xylakant 5y agoSigning would not have helped at all here - the author decided to nuke their project (and likely their last reputation), they could have signed that commit/package.
- bcrl 5y agoRequiring multiple signatures from several trusted sources would have.
- bcrl 5y agoI'm seriously downvoted for this? We have just had an incident where a maintainer acted maliciously and has demonstrated that a single point of trust is insufficient. If we really care about avoiding issues with open source software, clearly it is necessary to get multiple maintainers to sign off on changes to widely used open source projects. We have had all the technology components needed to implement this for decades, we just need the will to implement a system that is better. If we don't use this incident to improve, then it's going to happen again, and maybe the consequences will be worse.
- dane-pgp 5y agoI'm saddened to see you getting downvoted too (and I've tried to compensate for that). You're right that more ecosystems need something like Crev: https://dpc.pw/cargo-crev-and-rust-2019-fearless-code-reuse https://dpc.pw/cargo-crev-and-rust-2019-fearless-code-reuse
- bcrl 5y agoCrev looks interesting. Most Linux distributions are using a single key for the signing of packages, and this might be an easier place to start changing over to a multiple signature model. In this particular case is was a single jilted developer, but determined actor could easily attack someone with access to the keys to sign compromised packages, as per the obligatory xkcd on the matter https://xkcd.com/538/ https://xkcd.com/538/ .
- dane-pgp 5y agoMultiple signatures would indeed be a good mitigation against coercion, especially if the signatories were in different jurisdictions. Ideally you'd want a system which separates reputation from meatspace identity, so that well-trusted reviewers couldn't be easily targeted offline. Unfortunately that would require a lot of good opsec, and go against the financial incentive for someone to disclose their online identity as part of a salary negotiation, for example.
- Yoofie 5y agoHow would that work?
- mid-kid 5y agoTime and time again I'll keep saying this: This problem is only solved with package repositories that require review by a maintainer to publish. Linux distributions solved this ages ago.
- bcrl 5y agoChange that to multiple maintainers. Best practices should mean that any single point of failure is mitigated. I'm shocked to say it, but the blockchain might actually be a useful model for trust here.
- toomanydoubts 5y agoThis raises an interesting business idea. How much would developers and companies be willing to pay for an npm alternative with human reviewers?
- arvinsim 5y agoI think some other comments are expressing interest in exactly just that.