3 ms·
Top 10 maintainer here, got a few emails this morning about it. Meh. Shit happens. If we all Pikachu face every time an exploit happens we are lying to ourselv
by junon 4y ago
Top 10 maintainer here, got a few emails this morning about it.
Meh. Shit happens. If we all Pikachu face every time an exploit happens we are lying to ourselves. We'll never reach perfect security. It's a pipe dream.
What matters more is the disclosure and response. I'm not a huge advocate of npm personally, but I respect their response to this thus far. From what I gather (the email was a bit long-winded) nothing vastly detrimental occurred, they automatically invalidated passwords and going to publish again next time will require a couple minutes tops of extra work. I'll take it.
Let's all stop acting like products need to be perfectly and eternally secure. That's not how threat modelling works, any security professional knows that's impossible, and it's unfair to expect that from anyone, including big corporations.
Npm has done a lot of relevant and good work toward their security efforts over the years, in some cases going a bit far even in my own opinion. The comments I've seen so far have been a bit unfair.
- capableweb 4y agoIf this was a clever hack, I'd agree with you, shit happens. But for gods sake, having secrets hardcoded in VCS?? You seem to understand threat modelling. What's the threat towards one of the biggest and most used package registry? It's not like npm Inc just started running the registry. They have been doing this for years. To let such a beginner mistake risk the supply chain of basically the entire JS ecosystem is not only sloppy, it's completely unprofessional. What can we do in the short-term? I'm not sure, but I hope smarter people than me comes up with some solutions ASAP before a compromise like this starts actually impact developers using npm.
- 0daystock 4y agoIt is long past time for channel-binding of bearer credentials. It's unconscionable we as engineering professionals allow the total sum of security controls of a system to constantly be reduced to a string humans pass around.
- judge2020 4y agoOIDC-based authorization between trusted parties seems to be picking up steam[0], with the main issue being that setting it up isn't as easy as "paste shared secret". 0: https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services https://docs.github.com/en/actions/deployment/security-harde...
- tedivm 4y agoI wrote a blog post about connecting Github and AWS over OIDC. In my example I focus on using it to public images to ECR, but it's applicable to any AWS permission needs. https://blog.tedivm.com/guides/2021/10/github-actions-push-to-aws-ecr-without-credentials-oidc/ https://blog.tedivm.com/guides/2021/10/github-actions-push-t...
- capableweb 4y agoI agree, but even so, you can make things a lot more secure from "having plaintext credentials commit to source code versioning" without changing your entire infrastructure, which a move like that would require. Simply use environment variables and a .env file.
- deleted 4y ago[deleted]