3 ms·
> Honest question, what can be done to address this type of issue? Limit your number of (transitive) dependencies, to lower the risk. Yes, this often needs mor
by progval 5y ago
> Honest question, what can be done to address this type of issue?
Limit your number of (transitive) dependencies, to lower the risk. Yes, this often needs more work on your side.
Use a curated package repository such as Debian/Ubuntu or Fedora (or a repository your company maintains), and only use dependencies from there. Yes, this is very painful for ecosystems that are still moving fast such as JS/Go/Rust, because many packages are not available yet, and non-security updates are less frequent.
- hn_throwaway_99 5y ago> Limit your number of (transitive) dependencies, to lower the risk. This is not really a viable solution in the JS ecosystem if you're using any popular framework like Vue or React. Note Vue pulled in node-ipc. This "malicious actor" problem can be solved by NPM if they allowed better options when deciding which dependency version to pull. Right now it will pull any semver compatible version the moment it is published - there is no way to say "wait until all versions are at least a week or two old", which would basically eliminate most of the effects of nefarious versions.
- progval 5y ago> This is not really a viable solution in the JS ecosystem if you're using any popular framework like Vue or React. Note Vue pulled in node-ipc. Then you may need to reconsider using this kind of framework. If enough people do it, they may have to be more careful about what dependencies they have themselves.
- Ekaros 5y agoIt should have been clear from outset that pulling any number of transitive dependencies is horrible idea from security viewpoint. Ofc, it is fast and cheap in the moment... But, long term it clearly is not the best way.