6 ms·

Wow that is naive. Geolocation by IP address is notoriously error-prone. The most obvious is former Soviet republics, or any neighbour of a target nation, bein

Wow that is naive. Geolocation by IP address is notoriously error-prone. The most obvious is former Soviet republics, or any neighbour of a target nation, being mis-identified. That includes Ukraine itself, by the way, but also Finland and Poland. How about territory that is disputed? Or adjacent to enclaves like Kaliningrad? But it can also include friendly-nation assets that just happen to be currently inside Russia or Belarus, including government entities and journalists. It can affect folks simply relying on mobile networks near borders. Address blocks are routinely reallocated, reassigned, reused, misused, on a global basis and an address range announced in Korea last year can show up in Canada tomorrow. Even geolocation by client-side request can be wrong, too. Not just because it's easy to lie, but major nations also fuck with the GPS, which is an issue currently affecting Baltic aviation¹. By the same token, IP geolocation databases are easily misled by self-reporting from mobile devices. Simple example: imagine someone using a dedicated VPS in the US as a personal VPN exit node for their devices when visiting mainland China (actually, we don't have to imagine: I did exactly this). Any IP-based location assumptions start out incorrect, since it's by VPN exit IP; but later on, thanks to mobile device reporting, that IP address can end up misclassified long-term as "Chinese". None of this is hypothetical. I visited Jordan a few years ago and whilst visiting ruins near Umm Qais, up by the Sea of Galilee, my phone was switching to Israeli networks. I also know of an Australian startup that was mis-identified as Russian and lost access to a major partner API². That's since resolved, but the point is, forget what you see on police procedurals; identifying the political jurisdiction of a device, whether it's by IP address or any other means, remains an art, not a science, and it's incredibly easy to be wrong. As for the suggestion that the rest of us remain unaffected; any malware incident in the node ecosystem requires immediate attention and audit from every security team, whether you were the intended target or not. This idiot has cost all of us time and energy. [1] https://www.theguardian.com/world/2022/mar/09/finland-gps-disturbances-aircrafts-russia https://www.theguardian.com/world/2022/mar/09/finland-gps-di... [2] https://twitter.com/cyclytics/status/1503211938133966851 https://twitter.com/cyclytics/status/1503211938133966851

rosndo 5y ago
> As for the suggestion that the rest of us remain unaffected; any malware incident in the node ecosystem requires immediate attention and audit from every security team, whether you were the intended target or not. This idiot has cost all of us time and energy. The truth is that you are the idiot if you only perform audits when someone else announces an incident. You’ve already lost at that point. It’s nobody else’s fault but yours if you waste time because of your shit policies. But go on, keep digging an ever deeper hole for yourself with pathetic attempts at shifting blame. It’s absolutely your security teams job to audit all incoming code, rather than blindly trusting stuff from NPM.
- inopinatus 5y ago
  This is doubling down with more poorly considered assumptions and demonstrating an overwhelming lack of knowledge about security process, and with such vehement and pernicious language I could only laugh aloud at the remarks. Because: we already do routine malware scanning and audit, and review of every changing dependency that we know of, and their transitive dependencies. The scale and frequency of change is one of the reasons to minimise exposure to the fragmented, chaotic shitshow of the node ecosystem. When there's an incident - and this is most definitely an incident - we have to do more work to verify there was no inadvertent occurrence, that it did not slip through, etc etc. What's more, one must necessarily download the shit to inspect it, which means you're potentially now holding an unexploded bomb sitting in your developer laptop, for which possibly the only mitigation is that it's sitting inside a container or virtual machine, and one must be careful not to trigger it. Due to the destruction of trust, we'll also be making an additional effort to remove and replace this and any other package from the same author, and any repository to which they have contributed has to be considered potentially tainted and subject to additional review. Since you didn't apparently know any of this, I don't think you have any standing to comment on security team procedures.
  - rosndo 5y ago
    Nah, your processes are just terrible. They might be “industry standard”, but so was storing plaintext credit card information. >This is doubling down with more poorly considered assumptions and demonstrating an overwhelming lack of knowledge about security process Sorry, but no. I’ve worked in this field for two decades. What you’re describing is meaningless security theatre meant to appease the people paying your salaries.
    - inopinatus 5y ago
      Oh look, some more poorly informed personal invective! I had no idea it was possible to triple down on being a clueless dick, but you’ve successfully demonstrated that point. Alas, nothing else. Oh, and only two decades? It explains the rookie naïveté and flailing, ranting insecurities, I suppose. But I think you’ve got a fourth go in you, why stop now? I’m sure there’s a few more witless assumptions and unoriginal epithets left to fling around in vacuous defense of the indefensible.

rosndo 5y ago

> As for the suggestion that the rest of us remain unaffected; any malware incident in the node ecosystem requires immediate attention and audit from every security team, whether you were the intended target or not. This idiot has cost all of us time and energy. The truth is that you are the idiot if you only perform audits when someone else announces an incident. You’ve already lost at that point. It’s nobody else’s fault but yours if you waste time because of your shit policies. But go on, keep digging an ever deeper hole for yourself with pathetic attempts at shifting blame. It’s absolutely your security teams job to audit all incoming code, rather than blindly trusting stuff from NPM.

inopinatus 5y ago
This is doubling down with more poorly considered assumptions and demonstrating an overwhelming lack of knowledge about security process, and with such vehement and pernicious language I could only laugh aloud at the remarks. Because: we already do routine malware scanning and audit, and review of every changing dependency that we know of, and their transitive dependencies. The scale and frequency of change is one of the reasons to minimise exposure to the fragmented, chaotic shitshow of the node ecosystem. When there's an incident - and this is most definitely an incident - we have to do more work to verify there was no inadvertent occurrence, that it did not slip through, etc etc. What's more, one must necessarily download the shit to inspect it, which means you're potentially now holding an unexploded bomb sitting in your developer laptop, for which possibly the only mitigation is that it's sitting inside a container or virtual machine, and one must be careful not to trigger it. Due to the destruction of trust, we'll also be making an additional effort to remove and replace this and any other package from the same author, and any repository to which they have contributed has to be considered potentially tainted and subject to additional review. Since you didn't apparently know any of this, I don't think you have any standing to comment on security team procedures.
- rosndo 5y ago
  Nah, your processes are just terrible. They might be “industry standard”, but so was storing plaintext credit card information. >This is doubling down with more poorly considered assumptions and demonstrating an overwhelming lack of knowledge about security process Sorry, but no. I’ve worked in this field for two decades. What you’re describing is meaningless security theatre meant to appease the people paying your salaries.
  - inopinatus 5y ago
    Oh look, some more poorly informed personal invective! I had no idea it was possible to triple down on being a clueless dick, but you’ve successfully demonstrated that point. Alas, nothing else. Oh, and only two decades? It explains the rookie naïveté and flailing, ranting insecurities, I suppose. But I think you’ve got a fourth go in you, why stop now? I’m sure there’s a few more witless assumptions and unoriginal epithets left to fling around in vacuous defense of the indefensible.