16 ms·
This is exactly the problem with “uncurated” package managers like NPM and PyPi and where a curated package system like APT and RPM offer such a strong advantag
by samwillis 5y ago
This is exactly the problem with “uncurated” package managers like NPM and PyPi and where a curated package system like APT and RPM offer such a strong advantage. Far fewer people for you to have to put your trust into, but still a trust based system. They have gone so completely out of favour though.
It’s understandable why people moved to the uncurated systems, it’s so much easier to publish and so the variety of what’s available is brilliant. But I don’t think the tooling is there yet with all the languages that use them. Really we should have the ability to control permissions at the library level, choosing specifically what they can do.
Deno is doing some interesting things at the app level but has any language done anything with library level permissions?
Maybe we will see a movement back to the curated package managers, there may even be an opportunity to provide a curated service layer over the uncurated package managers like PyPi and NPN, possibly a paid service?
- zokier 5y ago> has any language done anything with library level permissions? Java Security Manager?
- ungamedplayer 5y agoI think that's being deprecated.
- zokier 5y ago> there may even be an opportunity to provide a curated service layer over the uncurated package managers like PyPi and NPN, possibly a paid service? Anaconda comes to mind, and I've heard that for Haskell there is Stackage
- asiachick 5y agoI don't really think it has anything to do with curated. It has to do with popularity/accessibility. There are more JS programmers than just about anything (my belief) and they have an easy to use and contribute package manager. (unlike say C/C++). Curation, IMO, would crumble under the pressure. Also AFAICT, Rust's package manager is uncurated? So is Swift's but AFAIK Swift doesn't really have an "official" manager and so doesn't have the conditions for the same level of popularity/accessibility. Maybe that suggests no package manager is better? The C/C++ way? Because spreading malware is harder? Of course conversely, excepting exploit fixes is harder.
- malka 5y agoI think a better solution would be to never execute anything unsandboxed.
- tracker1 5y agoMy initial thoughts as well.. have been playing with development inside containers, and this just makes me sure I need to do it much more. Also, pushing for read-only containers in production for most things, along with running as a non-privileged user.
- hda2 5y agoUnless your program is a black box that doesn't interact with the rest of the world in any way, sandboxing will not be enough. People still need to mitigate the effects of malicious supply chains.
- yurish 5y agoThis may protect your computer, but not visitors of your site using malware npm module on front end.
- malka 5y agothat is the job of browser vendor to sandbox on the front-end side
- XorNot 5y agoCurated package managers are still vulnerable to supply-chain attacks. Solarwinds was the definition of a curated system and look how that turned out. In almost every way the problem comes back to the same basic failure which ransomware represents: OS level data and access is boring, but user level data and access is wide-open and you grant it constantly to all sorts of things - its hard-to-impossible to put comprehensible, maintainable barriers around stuff and we lack the tools and programming constructs to enable this - i.e. you can't write software where it will, without you doing a lot of work, upfront declare what files its touching and how in a deterministic way.