3 ms·

While the prior post was talking about reticence to trust OSS code in commercial environments, the problem is not limited to that arena. This change hit nationa

While the prior post was talking about reticence to trust OSS code in commercial environments, the problem is not limited to that arena. This change hit national news here, albeit very temporarily, not just tech and business news. If an OSS developer can drop a logic bomb on Russian interests, one could do it to anyone else they disagree with, and that might understandably make people uncomfortable. Furthermore, the “attack” was indiscriminate, hitting out at a geographical area potentially damaging the data of many innocent bystanders not just those responsible for, taking part in, or supporting, the invasion. Or is it OK for a code bomb to affect civilian targets? I know physical protests often inconvenience bystanders, intentionally so, a lot of the point is to do so in order to draw attention to the matter being protested, but wilful destruction of property is usually considered bad form for such protests (arguably at that point you have a riot, not a protest) and that is essentially what node.ipc change did. Putting commercial interests off OSS is a symptom of a deeper wrong here.

MrStonedOne 5y ago
ahtihn 5y ago
> one could do it to anyone else they disagree with, and that might understandably make people uncomfortable That's why you audit your dependencies and have tests right? Right?
- dspillett 5y ago
  It is one of the reasons why you should. But... * Many don't. * Even for those that do something might slip through the cracks, particularly given how deep and wide some dependency trees go in the current JS ecosystem. * Such attacks would still cause you problems once your audit spots one: you now have to hold back a version, perhaps back-porting security fixes, at least until you can migrate to another package or create your own (or, rather than creating fresh, decide to continue maintaining a fork of the affected one). And you may need a deeper audit, checking to see if anything else slipped by earlier that has left dangerous traces. And the existence of dependency audits doesn't make damaging protest updates like this right any more than the existence of secure zips makes pick-pocketing those without them fine.
  - ahtihn 5y ago
    > Such attacks would still cause you problems once your audit spots one: you now have to hold back a version That's not a problem caused by this "attack". You should assume that any open source project you use is unmaintained unless you have a support contract and that it will never get any updates again. A lot of these packages have a bus factor of 1 with no backup plan.

MrStonedOne 5y ago

ahtihn 5y ago

> one could do it to anyone else they disagree with, and that might understandably make people uncomfortable That's why you audit your dependencies and have tests right? Right?

dspillett 5y ago
It is one of the reasons why you should. But... * Many don't. * Even for those that do something might slip through the cracks, particularly given how deep and wide some dependency trees go in the current JS ecosystem. * Such attacks would still cause you problems once your audit spots one: you now have to hold back a version, perhaps back-porting security fixes, at least until you can migrate to another package or create your own (or, rather than creating fresh, decide to continue maintaining a fork of the affected one). And you may need a deeper audit, checking to see if anything else slipped by earlier that has left dangerous traces. And the existence of dependency audits doesn't make damaging protest updates like this right any more than the existence of secure zips makes pick-pocketing those without them fine.
- ahtihn 5y ago
  > Such attacks would still cause you problems once your audit spots one: you now have to hold back a version That's not a problem caused by this "attack". You should assume that any open source project you use is unmaintained unless you have a support contract and that it will never get any updates again. A lot of these packages have a bus factor of 1 with no backup plan.