8 ms·

In my opinion, these changes are effectively supply-chain attacks in their execution. That would make them bad regardless of how correct their expressed positio

In my opinion, these changes are effectively supply-chain attacks in their execution. That would make them bad regardless of how correct their expressed positions are about the Ukraine war. The fact that there has not been a strong push back confirms my suspicion that by now, everyone has gotten used to Node and NPM being insecure and silently accepted it as a way of life. Similarly, those Terraform scripts are apparently esoteric enough to only be used by a tiny minority of software developers, or else we would have heard about it in a different way. Thank god nobody did similar shenanigans to open source projects that are actually in wide use :)

AeroNotix 5y ago
What rights are you inaliably afforded from open source?
- deleted 5y ago
  [deleted]
- commandlinefan 5y ago
  Hmmmm… ok, what if somebody is handing out free food, but it’s poisoned. Is he still liable for harming you?
  - 7steps2much 5y ago
    Did they inform you that the food was poisoned? Does it come with a bright red wrapper saying "warning poison? If they just hand you food without a word then (at least in quite a few jurisdictions, but maybe not all) they are liable.
    - commandlinefan 5y ago
      Did the packages in question have a bright red warning that said “your files will be deleted if you’re in Russia?”
      - 7steps2much 5y ago
        It did have this: > as of v11 this module uses the peacenotwar module. Over on its NPM site: https://www.npmjs.com/package/node-ipc https://www.npmjs.com/package/node-ipc And as far as i can tell they bumped up the major version by a digit. Whether or not that counts as a "Bright red warning" i don't know but personally i believe that a warning notice + a major version bump should be enough. Those who don't care about that would most likely not care about a bright red warning on the repo page either. It's clearly a questionable thing to do, but is it illegal?
        antifa 5y ago
        Deleting random people's files sounds more like the warnotpeace module. No normal person would see "peacenotwar" for the first time and assume it does something bad. This counts as "no warning whatsoever", and no competent lawyer would say it's a warning message.
  - pjmlp 5y ago
    Definitely, with prison for life in many places.
rosndo 5y ago
> In my opinion, these changes are effectively supply-chain attacks in their execution. That would make them bad regardless of how correct their expressed positions are about the Ukraine war. What’s the logic here? Why are supply-chain attacks inherently bad? So, are the sanctions which attack other kinds of supply chains in Russia also bad? Or is software an exception? Why?
amelius 5y ago
Thank god the supply chain attacks are happening in software, not at a molecular biology level.
jollybean 5y ago
[flagged]
- fxtentacle 5y ago
  Apparently I didn't make that part clear enough: This is a supply-chain attack against EVERYONE using their project. Those users will be 99% innocent civilians. I might one day have an IP that is accidentally mis-classified as Russia. I mean those Geo-IP services are only like 95% accurate and they go out of date pretty quickly and updates are expensive. Plus .RU VPN services used to rent subnets in the US all the time. But then all of my files get deleted because someone wanted to make a point. So then I'm collateral damage in someone's remote fight in a war that neither of us were actually involved in. Your argument is a bit like saying "It's OK to use chemical weapons because we're the good guys." They are not banned to protect soldiers, they are banned to protect civilians. And most likely, node-ipc's patch will hurt much more innocent civilians than it'll hurt Russian soldiers. It's the software equivalent of indiscriminate bombing.
  - diordiderot 5y ago
    - thfuran 5y ago
      And are you really going to cheer as corporations take upon themselves the right to prosecute a war, let alone one waged largely against civilians?
      - diordiderot 5y ago
        So much missing information. Who's interests do corporations represent? What are the costs of their actions? What are the costs of their inactions?
  - jollybean 5y ago
    Oh sure, obviously a kind sort of malware in the wild has all sorts of consequences.
ajross 5y ago
> In my opinion, these changes are effectively supply-chain attacks in their execution. That would make them bad regardless of how correct their expressed positions are about the Ukraine war. Well, yeah. War is bad. On the spectrum of war badness, obviously, these pranks are pretty mild. But they're bad. It's a bad situation. When at war, people are forced to do bad things to prevent worse things. That's why starting wars is very bad. Now, sure, you can argue about the semantics about "who" is at war, or whether these npm authors are "really" at war, or why they "think" they're at war, or whether they "should" be at war. You could also get into a discussion about whether or not this tactic is effective (and I'd agree it's hurting more than helping, btw). Go nuts. But that doesn't change the fact that this is an action in support of a war effort. In wars, principled stands don't win. If you want a particular outcome, you have to pick a side.
- jollybean 5y ago
  "principled stands don't win." Fighting against bad actors is definitely a 'principled decision'. Ignoring the situation and not taking action is an 'unprincipled decision'. Though it might disguised as principled action, on the basis of supporting some other principle, such 'open source', but ignoring one at the expense of another implies serious lack of self awareness. This war, plus COVID, and the recently released documents indicating a planned invasion of Taiwan (though we don't know for sure) - represent major geopolitical shift of the order of WW1/WW2/End of Cold War, the stakes and consequences are enormous.
  - ajross 5y ago
    That's sort of a semantic argument. To be clear: I was contrasting "choosing a side" (in this case by senselessly pranking your npm customers) as being a "practical" choice, vs. the "principled" stand taken to avoid the conflict out of a general sense of open source decorum. Obviously in some sense all decisions are based on "principle". And the point is that it's a war. We've crossed the "bad things are going to happen" Rubicon already. You can't make principled arguments like that against people who have chosen to engage in a war out of the hope or desire for one side to win. They already did that moral calculus. It's like telling someone they shouldn't defend their home because pacifism is more important. You might be right, but you won't change anyone's mind.
roenxi 5y ago
There is so much wrong with this situation. Are developers who do something like delete-based-on-IP liable for some sort of civil or criminal penalty? Attempting to do active harm to a computer surely can't be legal.
- sieabahlpark 5y ago
- sneak 5y ago
  They shouldn't be; they didn't install it on your machine. Publishing malware is, and should remain, protected expression.
  - javajosh 5y ago
    I agree, but I also believe communication should be consensual. That is, the recipient must give consent to install the malware. Otherwise the transmission is a commission of fraud against the recipient. That said, such a law is difficult to enforce, in a justice system as moribund as ours, so instead we rely on (probably wrong) heuristics about what specific behavior makes us safe, and indeed, whether or not our resources have already been breached. Such behavior is what drives the overwhelming dominance of GMail, which is itself a remarkable tool with which to learn about any person group corporation government on the planet. So in terms of utility its hard to argue that malware is a good to society. Write a malware that installs a patch to prevent a 0-day in known use by a state actor, then I will be a malware fanboy. Not until then.
  - librexpr 5y ago
    There's a big difference between publishing the source code of malware while clearly stating that it's malware, vs publishing trojan malware on NPM while knowing that it will be automatically installed by a bunch of package managers and cause damage. The former is fine; the latter is clearly malicious and is or should be a crime.
    - jlkuester7 5y ago
armchairhacker 5y ago
iirc npm has support for pinning dependencies, you just have to remove the “^” at the start of the dependency version. Is there a global option in npm or yarn or pnpm? Why don’t they make this the default?
- zkldi 5y ago
  https://github.com/npm/rfcs/issues/509 https://github.com/npm/rfcs/issues/509 it more or less just makes it difficult for updates to propogate, which is arguably a good thing.
feross 5y ago
We're building Socket to stop this exact type of attack. See https://socket.dev https://socket.dev Socket turns the whole npm security problem on its head and asks: what if we assume all open source may be malicious? Can we proactively detect indicators of compromised packages? What's the simplest way to mitigate this risk without hurting usability?
- vhanda 5y ago
  Socket seems interesting. I just installed it on some of my repos. In your FAQ, it says "We're working to make Socket the best open source security tool.", this was confusing for me, as I got the impression that Socket's codebase is Open Source, and I went looking for it. Maybe "We're working to make Socket the best security tool for open source packages" would be less confusing.
  - feross 5y ago
    You are right. Thanks for the suggestion.
  - hackernewds 5y ago
    Great feedback. I initially understood socket was open source as well, which would have prevented me from using it to secure open source projects? circular argument :)
- pabs3 5y ago
  How do you detect compromised packages? What indicators of compromise do you use? Is Socket itself open source? Can I run it locally on the command-line?
  - feross 5y ago
    We look at the behavior of packages, what APIs they use, and how that changes over time. The list of issues we currently look for is here: https://socket.dev/npm/issue https://socket.dev/npm/issue Socket’s not open source at this time, but we’re releasing a CLI in the coming week if the GitHub App doesn’t suit your purposes.
Aeolun 5y ago
Working with NPM every day, that’s kind of how I look at it. Maybe my computer will be randomly wiped one day, but it’s not something you can worry about if you want to retain your sanity.
- geocar 5y ago
  > it's not something you can worry about if you want to retain your sanity. I build my nodejs/npm stuff in containers. Actually I build almost everything that way. There are a lot of advantages in addition to the security gains, such as that I don't need to rely on every javascript programmer in the world understanding semver (they don't, and I have wasted more of my "sanity" on tracking down API changes and sloppy type contracts than I ever have spent cleaning up after malice.
  - Drdrdrq 5y ago
    That's a nice idea, thank you! No more worrying about node versions either.
squiffsquiff 5y ago
I hate to burst your bubble, but Anton Babenko's terraform modules are extremely popular. The difference here is that he added a input with a default value to a specific release version. Generally, if you're using terraform professionally you'd either fork or mirror the module and pin to a specific version. In such case this change would not affect you. If you had e.g. something in development calling 'latest' version of an impacted module you again would not see this. It's an optional argument that defaults to a value causing no outward change in behaviour.
- fxtentacle 5y ago
  I'd bet you that 95% of all programmers can't even explain from memory what exactly Terraform is. Case in point, I have no idea. I know it's something related to the cloud but none of my clients are using it. And their Wikipedia article is filled with buzzwords and no explanation of what it does, which doesn't exactly give me confidence that it'll be useful for regular companies. "Infrastructure as code"... so Ansible or docker compose? In any case, you don't need it if 2 HA bare metal servers do the job.
  - paulgb 5y ago
    I’ll try: Terraform replaces all the actions you’d do in the AWS (or other cloud provider) console or API with declarative configuration code. This means you can parametrize it, version control it, compose it, etc. and generally treat it like code. It would be overkill for many things that have a single, fairly static configuration, but for things like ensuring that a dev and prod cluster have the same configuration, it’s a lifesaver.
    - fxtentacle 5y ago
      That is a great summary :) and it highlights the value proposition that I was missing: Version Control for Cloud Configurations
      - Drdrdrq 5y ago

AeroNotix 5y ago

What rights are you inaliably afforded from open source?

deleted 5y ago
[deleted]
commandlinefan 5y ago
Hmmmm… ok, what if somebody is handing out free food, but it’s poisoned. Is he still liable for harming you?
- 7steps2much 5y ago
  Did they inform you that the food was poisoned? Does it come with a bright red wrapper saying "warning poison? If they just hand you food without a word then (at least in quite a few jurisdictions, but maybe not all) they are liable.
  - commandlinefan 5y ago
    Did the packages in question have a bright red warning that said “your files will be deleted if you’re in Russia?”
    - 7steps2much 5y ago
      It did have this: > as of v11 this module uses the peacenotwar module. Over on its NPM site: https://www.npmjs.com/package/node-ipc https://www.npmjs.com/package/node-ipc And as far as i can tell they bumped up the major version by a digit. Whether or not that counts as a "Bright red warning" i don't know but personally i believe that a warning notice + a major version bump should be enough. Those who don't care about that would most likely not care about a bright red warning on the repo page either. It's clearly a questionable thing to do, but is it illegal?
      - antifa 5y ago
        Deleting random people's files sounds more like the warnotpeace module. No normal person would see "peacenotwar" for the first time and assume it does something bad. This counts as "no warning whatsoever", and no competent lawyer would say it's a warning message.
- pjmlp 5y ago
  Definitely, with prison for life in many places.

rosndo 5y ago

> In my opinion, these changes are effectively supply-chain attacks in their execution. That would make them bad regardless of how correct their expressed positions are about the Ukraine war. What’s the logic here? Why are supply-chain attacks inherently bad? So, are the sanctions which attack other kinds of supply chains in Russia also bad? Or is software an exception? Why?

amelius 5y ago

Thank god the supply chain attacks are happening in software, not at a molecular biology level.

jollybean 5y ago

[flagged]

fxtentacle 5y ago
Apparently I didn't make that part clear enough: This is a supply-chain attack against EVERYONE using their project. Those users will be 99% innocent civilians. I might one day have an IP that is accidentally mis-classified as Russia. I mean those Geo-IP services are only like 95% accurate and they go out of date pretty quickly and updates are expensive. Plus .RU VPN services used to rent subnets in the US all the time. But then all of my files get deleted because someone wanted to make a point. So then I'm collateral damage in someone's remote fight in a war that neither of us were actually involved in. Your argument is a bit like saying "It's OK to use chemical weapons because we're the good guys." They are not banned to protect soldiers, they are banned to protect civilians. And most likely, node-ipc's patch will hurt much more innocent civilians than it'll hurt Russian soldiers. It's the software equivalent of indiscriminate bombing.
- diordiderot 5y ago
  - thfuran 5y ago
    And are you really going to cheer as corporations take upon themselves the right to prosecute a war, let alone one waged largely against civilians?
    - diordiderot 5y ago
      So much missing information. Who's interests do corporations represent? What are the costs of their actions? What are the costs of their inactions?
- jollybean 5y ago
  Oh sure, obviously a kind sort of malware in the wild has all sorts of consequences.

ajross 5y ago

> In my opinion, these changes are effectively supply-chain attacks in their execution. That would make them bad regardless of how correct their expressed positions are about the Ukraine war. Well, yeah. War is bad. On the spectrum of war badness, obviously, these pranks are pretty mild. But they're bad. It's a bad situation. When at war, people are forced to do bad things to prevent worse things. That's why starting wars is very bad. Now, sure, you can argue about the semantics about "who" is at war, or whether these npm authors are "really" at war, or why they "think" they're at war, or whether they "should" be at war. You could also get into a discussion about whether or not this tactic is effective (and I'd agree it's hurting more than helping, btw). Go nuts. But that doesn't change the fact that this is an action in support of a war effort. In wars, principled stands don't win. If you want a particular outcome, you have to pick a side.

jollybean 5y ago
"principled stands don't win." Fighting against bad actors is definitely a 'principled decision'. Ignoring the situation and not taking action is an 'unprincipled decision'. Though it might disguised as principled action, on the basis of supporting some other principle, such 'open source', but ignoring one at the expense of another implies serious lack of self awareness. This war, plus COVID, and the recently released documents indicating a planned invasion of Taiwan (though we don't know for sure) - represent major geopolitical shift of the order of WW1/WW2/End of Cold War, the stakes and consequences are enormous.
- ajross 5y ago
  That's sort of a semantic argument. To be clear: I was contrasting "choosing a side" (in this case by senselessly pranking your npm customers) as being a "practical" choice, vs. the "principled" stand taken to avoid the conflict out of a general sense of open source decorum. Obviously in some sense all decisions are based on "principle". And the point is that it's a war. We've crossed the "bad things are going to happen" Rubicon already. You can't make principled arguments like that against people who have chosen to engage in a war out of the hope or desire for one side to win. They already did that moral calculus. It's like telling someone they shouldn't defend their home because pacifism is more important. You might be right, but you won't change anyone's mind.

roenxi 5y ago

There is so much wrong with this situation. Are developers who do something like delete-based-on-IP liable for some sort of civil or criminal penalty? Attempting to do active harm to a computer surely can't be legal.

sieabahlpark 5y ago
sneak 5y ago
They shouldn't be; they didn't install it on your machine. Publishing malware is, and should remain, protected expression.
- javajosh 5y ago
  I agree, but I also believe communication should be consensual. That is, the recipient must give consent to install the malware. Otherwise the transmission is a commission of fraud against the recipient. That said, such a law is difficult to enforce, in a justice system as moribund as ours, so instead we rely on (probably wrong) heuristics about what specific behavior makes us safe, and indeed, whether or not our resources have already been breached. Such behavior is what drives the overwhelming dominance of GMail, which is itself a remarkable tool with which to learn about any person group corporation government on the planet. So in terms of utility its hard to argue that malware is a good to society. Write a malware that installs a patch to prevent a 0-day in known use by a state actor, then I will be a malware fanboy. Not until then.
- librexpr 5y ago
  There's a big difference between publishing the source code of malware while clearly stating that it's malware, vs publishing trojan malware on NPM while knowing that it will be automatically installed by a bunch of package managers and cause damage. The former is fine; the latter is clearly malicious and is or should be a crime.
  - jlkuester7 5y ago

armchairhacker 5y ago

iirc npm has support for pinning dependencies, you just have to remove the “^” at the start of the dependency version. Is there a global option in npm or yarn or pnpm? Why don’t they make this the default?

zkldi 5y ago
https://github.com/npm/rfcs/issues/509 https://github.com/npm/rfcs/issues/509 it more or less just makes it difficult for updates to propogate, which is arguably a good thing.

feross 5y ago

We're building Socket to stop this exact type of attack. See https://socket.dev https://socket.dev Socket turns the whole npm security problem on its head and asks: what if we assume all open source may be malicious? Can we proactively detect indicators of compromised packages? What's the simplest way to mitigate this risk without hurting usability?

vhanda 5y ago
Socket seems interesting. I just installed it on some of my repos. In your FAQ, it says "We're working to make Socket the best open source security tool.", this was confusing for me, as I got the impression that Socket's codebase is Open Source, and I went looking for it. Maybe "We're working to make Socket the best security tool for open source packages" would be less confusing.
- feross 5y ago
  You are right. Thanks for the suggestion.
- hackernewds 5y ago
  Great feedback. I initially understood socket was open source as well, which would have prevented me from using it to secure open source projects? circular argument :)
pabs3 5y ago
How do you detect compromised packages? What indicators of compromise do you use? Is Socket itself open source? Can I run it locally on the command-line?
- feross 5y ago
  We look at the behavior of packages, what APIs they use, and how that changes over time. The list of issues we currently look for is here: https://socket.dev/npm/issue https://socket.dev/npm/issue Socket’s not open source at this time, but we’re releasing a CLI in the coming week if the GitHub App doesn’t suit your purposes.

Aeolun 5y ago

Working with NPM every day, that’s kind of how I look at it. Maybe my computer will be randomly wiped one day, but it’s not something you can worry about if you want to retain your sanity.

geocar 5y ago
> it's not something you can worry about if you want to retain your sanity. I build my nodejs/npm stuff in containers. Actually I build almost everything that way. There are a lot of advantages in addition to the security gains, such as that I don't need to rely on every javascript programmer in the world understanding semver (they don't, and I have wasted more of my "sanity" on tracking down API changes and sloppy type contracts than I ever have spent cleaning up after malice.
- Drdrdrq 5y ago
  That's a nice idea, thank you! No more worrying about node versions either.

squiffsquiff 5y ago

I hate to burst your bubble, but Anton Babenko's terraform modules are extremely popular. The difference here is that he added a input with a default value to a specific release version. Generally, if you're using terraform professionally you'd either fork or mirror the module and pin to a specific version. In such case this change would not affect you. If you had e.g. something in development calling 'latest' version of an impacted module you again would not see this. It's an optional argument that defaults to a value causing no outward change in behaviour.

fxtentacle 5y ago
I'd bet you that 95% of all programmers can't even explain from memory what exactly Terraform is. Case in point, I have no idea. I know it's something related to the cloud but none of my clients are using it. And their Wikipedia article is filled with buzzwords and no explanation of what it does, which doesn't exactly give me confidence that it'll be useful for regular companies. "Infrastructure as code"... so Ansible or docker compose? In any case, you don't need it if 2 HA bare metal servers do the job.
- paulgb 5y ago
  I’ll try: Terraform replaces all the actions you’d do in the AWS (or other cloud provider) console or API with declarative configuration code. This means you can parametrize it, version control it, compose it, etc. and generally treat it like code. It would be overkill for many things that have a single, fairly static configuration, but for things like ensuring that a dev and prod cluster have the same configuration, it’s a lifesaver.
  - fxtentacle 5y ago
    That is a great summary :) and it highlights the value proposition that I was missing: Version Control for Cloud Configurations
    - Drdrdrq 5y ago