4 ms·

The WAPM backend is closed-source for now. However, the API layer based on GraphQL and the CLI are completely open for anyone to use: https://registry.wapm.io/

The WAPM backend is closed-source for now. However, the API layer based on GraphQL and the CLI are completely open for anyone to use: https://registry.wapm.io/graphql https://registry.wapm.io/graphql https://github.com/wasmerio/wapm-cli https://github.com/wasmerio/wapm-cli If anyone wants to replicate the WebAssembly Package Manager locally please send me an email to syrus@wasmer.io so we can start a discussion around a potential open-source path for it :) EDIT: removed "for security reasons among other things" as it might imply WAPM is not secure, and that's definitely not the case

tux3 5y ago
Closed source for security reasons? Do you mean it would not be secure if people were able to see the source?
- syrusakbary 5y ago
  Open-source code is obviously easier to exploit than closed source one. But that doesn't imply necessarily the existence of security bugs. For example, we might be using a dependency that is vulnerable to exploits or have an exploit in our own code that opens a security breach (hopefully not!). As an open-source maintainer I like to open projects for which the code-quality is high, and this implies doing a deep and thorough review of the codebase before open-sourcing.
  - tptacek 5y ago
    Open-source code is not in fact easier to exploit than closed-source code is. Security and openness are mostly orthogonal.
    - syrusakbary 5y ago
      > Open-source code is not in fact easier to exploit than closed-source code is Not sure if I agree with this. Obscure systems are usually harder to hack as they require an extra effort on discoverability that open systems don't have. Easier to exploit != more exploitable. One is about the threshold to discover an exploit, the other is about the total exploitable bugs. In my view, the "hackability level" is the same for both open and closed-source projects. Making something close it doesn't make it less hackeable, it just makes the threshold to discover bugs higher. Also, one may argue that with open-source projects you may be able to fix more bugs since those are in the open and more people can report them (thus, more secure). I think it really depends on the contribution level and where the codebase is at to see if security might be a concern or not. > Security and openness are mostly orthogonal. But I mostly agree with this ;)
      - tptacek 5y ago
        Most people would say that reducing the threshold to discover security bugs is a good thing.
        burnte 5y ago
        Security through obscurity is not security. The source WAS open, any bugs in it then are still discoverable. Opening source can actually make things more secure, the whole "many eyes" thing.
        kasey_junk 5y ago
        The interesting thing in this argument is that the first person is positing axiomatically that closed source is more secure, the second person is positing that open/closed largely doesn’t matter and finally your position axiomatically is that open is more secured. We’ve known since the 70s that you (provably) can’t trust source code. We know experientially that it’s easier to diagnose code than programs. We also know experientially that the teams involved have a dramatic effect on the security of the outcomes. How will we ever decide which of our three contestants will win?
        benatkin 5y ago
        Not quite. tptacek says "Most people would say that reducing the threshold to discover security bugs is a good thing." I think that restating what tptacek said earlier, "mostly orthoganal", to "largely doesn't matter", loses some of the meaning. One way of seeing it is that it's mostly orthaganal at a level of all software out there, but that for those who make a serious effort to be secure, there is a lot of benefit to being open source. There's Linus's Law, "given enough eyeballs, all bugs are shallow". I think if the maintainers of Linux didn't meaningfully address security concerns, it would just mean they were doing a bit better at whack-a-mole. You see this in popular open source projects like WordPress. So I think that's why a reader might think tptacek's two comments don't jibe with each other. If you are given a choice between an open source and a closed source application, you wouldn't just assume one is more secure than another. However, if you were starting off to make a secure system, it would be a good idea to make it open source.
    - CyberRabbi 5y ago
      This is often repeated but it’s just obviously not true. It’s much easier to figure out how to exploit a server if I have its source. If I don’t, I have to throw a bunch of stuff at the wall and hope something sticks. If I’m in the situation where I have a binary of a server without the source, I have to pay the cost of using ghidra or IDA for a few hours or days (or weeks) to figure out how the software is structured before I can come up with an exploit. If I’m dealing with an open source target that’s a cost I don’t have to pay.

tux3 5y ago

Closed source for security reasons? Do you mean it would not be secure if people were able to see the source?

syrusakbary 5y ago
Open-source code is obviously easier to exploit than closed source one. But that doesn't imply necessarily the existence of security bugs. For example, we might be using a dependency that is vulnerable to exploits or have an exploit in our own code that opens a security breach (hopefully not!). As an open-source maintainer I like to open projects for which the code-quality is high, and this implies doing a deep and thorough review of the codebase before open-sourcing.
- tptacek 5y ago
  Open-source code is not in fact easier to exploit than closed-source code is. Security and openness are mostly orthogonal.
  - syrusakbary 5y ago
    > Open-source code is not in fact easier to exploit than closed-source code is Not sure if I agree with this. Obscure systems are usually harder to hack as they require an extra effort on discoverability that open systems don't have. Easier to exploit != more exploitable. One is about the threshold to discover an exploit, the other is about the total exploitable bugs. In my view, the "hackability level" is the same for both open and closed-source projects. Making something close it doesn't make it less hackeable, it just makes the threshold to discover bugs higher. Also, one may argue that with open-source projects you may be able to fix more bugs since those are in the open and more people can report them (thus, more secure). I think it really depends on the contribution level and where the codebase is at to see if security might be a concern or not. > Security and openness are mostly orthogonal. But I mostly agree with this ;)
    - tptacek 5y ago
      Most people would say that reducing the threshold to discover security bugs is a good thing.
      - burnte 5y ago
        Security through obscurity is not security. The source WAS open, any bugs in it then are still discoverable. Opening source can actually make things more secure, the whole "many eyes" thing.
        kasey_junk 5y ago
        The interesting thing in this argument is that the first person is positing axiomatically that closed source is more secure, the second person is positing that open/closed largely doesn’t matter and finally your position axiomatically is that open is more secured. We’ve known since the 70s that you (provably) can’t trust source code. We know experientially that it’s easier to diagnose code than programs. We also know experientially that the teams involved have a dramatic effect on the security of the outcomes. How will we ever decide which of our three contestants will win?
        benatkin 5y ago
        Not quite. tptacek says "Most people would say that reducing the threshold to discover security bugs is a good thing." I think that restating what tptacek said earlier, "mostly orthoganal", to "largely doesn't matter", loses some of the meaning. One way of seeing it is that it's mostly orthaganal at a level of all software out there, but that for those who make a serious effort to be secure, there is a lot of benefit to being open source. There's Linus's Law, "given enough eyeballs, all bugs are shallow". I think if the maintainers of Linux didn't meaningfully address security concerns, it would just mean they were doing a bit better at whack-a-mole. You see this in popular open source projects like WordPress. So I think that's why a reader might think tptacek's two comments don't jibe with each other. If you are given a choice between an open source and a closed source application, you wouldn't just assume one is more secure than another. However, if you were starting off to make a secure system, it would be a good idea to make it open source.
  - CyberRabbi 5y ago
    This is often repeated but it’s just obviously not true. It’s much easier to figure out how to exploit a server if I have its source. If I don’t, I have to throw a bunch of stuff at the wall and hope something sticks. If I’m in the situation where I have a binary of a server without the source, I have to pay the cost of using ghidra or IDA for a few hours or days (or weeks) to figure out how the software is structured before I can come up with an exploit. If I’m dealing with an open source target that’s a cost I don’t have to pay.