5 ms·

We're building Socket to stop this exact type of attack. See https://socket.dev https://socket.dev Socket turns the whole npm security problem on its head and

by feross 5y ago

We're building Socket to stop this exact type of attack. See https://socket.dev https://socket.dev Socket turns the whole npm security problem on its head and asks: what if we assume all open source may be malicious? Can we proactively detect indicators of compromised packages? What's the simplest way to mitigate this risk without hurting usability?

vhanda 5y ago
Socket seems interesting. I just installed it on some of my repos. In your FAQ, it says "We're working to make Socket the best open source security tool.", this was confusing for me, as I got the impression that Socket's codebase is Open Source, and I went looking for it. Maybe "We're working to make Socket the best security tool for open source packages" would be less confusing.
- feross 5y ago
  You are right. Thanks for the suggestion.
- hackernewds 5y ago
  Great feedback. I initially understood socket was open source as well, which would have prevented me from using it to secure open source projects? circular argument :)
pabs3 5y ago
How do you detect compromised packages? What indicators of compromise do you use? Is Socket itself open source? Can I run it locally on the command-line?
- feross 5y ago
  We look at the behavior of packages, what APIs they use, and how that changes over time. The list of issues we currently look for is here: https://socket.dev/npm/issue https://socket.dev/npm/issue Socket’s not open source at this time, but we’re releasing a CLI in the coming week if the GitHub App doesn’t suit your purposes.
  - huynhhacnguyen 5y ago
    That's actually interesting, I will look into more details to see if we can integrate this into our systems. Do you have any avaiable technical documents so we can get a glimpse of how Socket is working, or is your Blog the best place to start?
  - pabs3 5y ago
    Re the typosquat issue, maybe also add bitsquatting https://www.youtube.com/watch?v=lZ8s1JwtNas https://www.youtube.com/watch?v=lZ8s1JwtNas https://github.com/artemdinaburg/bitsquat-script/ https://github.com/artemdinaburg/bitsquat-script/
  - pabs3 5y ago
    I absolutely love that you added a telemetry issue! I'm linking your page about it from the Debian privacy issues page. https://socket.dev/npm/issue/telemetry https://socket.dev/npm/issue/telemetry https://wiki.debian.org/PrivacyIssues https://wiki.debian.org/PrivacyIssues
emptysongglass 5y ago
Why should we trust closed-source software to audit open-source code? In the words of an infamous bounty hunter: "Does that seem right to you?"
- bryanrasmussen 5y ago
  In U.S detects Chinese malware -> Threat Alert detects NSA malware -> Silent pass-through I mean I guess I'm a pessimist, but also, I think I'm really a realist.
- hansel_der 5y ago
  "if you make any kind of ruckus, your body is forfit"

by feross 5y ago

vhanda 5y ago

Socket seems interesting. I just installed it on some of my repos. In your FAQ, it says "We're working to make Socket the best open source security tool.", this was confusing for me, as I got the impression that Socket's codebase is Open Source, and I went looking for it. Maybe "We're working to make Socket the best security tool for open source packages" would be less confusing.

feross 5y ago
You are right. Thanks for the suggestion.
hackernewds 5y ago
Great feedback. I initially understood socket was open source as well, which would have prevented me from using it to secure open source projects? circular argument :)

pabs3 5y ago

How do you detect compromised packages? What indicators of compromise do you use? Is Socket itself open source? Can I run it locally on the command-line?

feross 5y ago
We look at the behavior of packages, what APIs they use, and how that changes over time. The list of issues we currently look for is here: https://socket.dev/npm/issue https://socket.dev/npm/issue Socket’s not open source at this time, but we’re releasing a CLI in the coming week if the GitHub App doesn’t suit your purposes.
- huynhhacnguyen 5y ago
  That's actually interesting, I will look into more details to see if we can integrate this into our systems. Do you have any avaiable technical documents so we can get a glimpse of how Socket is working, or is your Blog the best place to start?
- pabs3 5y ago
  Re the typosquat issue, maybe also add bitsquatting https://www.youtube.com/watch?v=lZ8s1JwtNas https://www.youtube.com/watch?v=lZ8s1JwtNas https://github.com/artemdinaburg/bitsquat-script/ https://github.com/artemdinaburg/bitsquat-script/
- pabs3 5y ago
  I absolutely love that you added a telemetry issue! I'm linking your page about it from the Debian privacy issues page. https://socket.dev/npm/issue/telemetry https://socket.dev/npm/issue/telemetry https://wiki.debian.org/PrivacyIssues https://wiki.debian.org/PrivacyIssues

emptysongglass 5y ago

Why should we trust closed-source software to audit open-source code? In the words of an infamous bounty hunter: "Does that seem right to you?"

bryanrasmussen 5y ago
In U.S detects Chinese malware -> Threat Alert detects NSA malware -> Silent pass-through I mean I guess I'm a pessimist, but also, I think I'm really a realist.
hansel_der 5y ago
"if you make any kind of ruckus, your body is forfit"