3 ms·

What do you expect the community to do? Stop using thousands of packages? Start vetting packages, as if security was important? There are already dozens of us

by ratww 4y ago

What do you expect the community to do? Stop using thousands of packages? Start vetting packages, as if security was important? There are already dozens of us saying it is possible to not have too many dependencies, and vet packages before installing. But every time we open our mouths we are treated as if we just escaped some sort of insane asylum. At a place I worked in the past we used to have a 40-line microservice using plain-node without any dependencies. That was by design. One junior dev took it upon himself, in their spare time, to convert the whole thing to use some js MVC framework, complete with a full-blown build process, transpilers, and all the nine yards. There was a big discussion in the PR and a lot of juniors complained that we should migrate because they "didn't learn plain node.js in college". We can't have nice things anymore.

dodgerdan 4y ago
> What do you expect the community to do? Ensuring that the core infrastructure of their software systems doesn’t have the same security standards as teenagers wordpress site would be an awesome start.
- ratww 4y ago
  Depending on what you're calling core infrastructure, it might not be something under control of "the community".
dgb23 4y ago
It surprises me that colleges teach web frameworks.
- ratww 4y ago
  Me too. But what really suprises me is that today that's virtually the only thing some of them are teaching. It's Java or Python for programming basics (arithmetics, ifs, print), then straight into frameworks.
  - dgb23 4y ago
    That's really unfortunate. I think education is the best place to teach these things bottom up. Especially considering that you understand a framework way better after creating one yourself. There are not that many essential parts in a web framework anyways, it's the plumbing, the tooling and the polish around them that makes them productive.
    - ratww 4y ago
      Exactly. IMO you're a 100x better developer when you at least tried to create something you use from scratch. I find however this will become harder and harder with newbies being constantly bombarded online with messages stating that creating anything from scratch is a futile exercise, together with companies influencing college curriculums.
- havblue 4y ago
  I suppose it's job security for a lot of us that colleges are producing developers who don't know what a string is.
deleted 4y ago
[deleted]
bin_bash 4y ago
It's unrealistic to vet the entire chain of dependencies especially considering how they can become vulnerable at any time. Developers can't be expected to be responsible for that. What we need is a set of policies around dependencies that we agree on as an industry and tools to help make securing our systems easier. We're working on it: https://slsa.dev/spec/v0.1/requirements https://slsa.dev/spec/v0.1/requirements
- ratww 4y ago
  Nope. It is completely realistic as long as you keep the chain of dependencies manageable. To vet dependencies properly you have to stop using thousands of them willy-nilly. To stop using thousands of them you mostly have to change only your development dependencies. Runtimes dependencies, even in large Javascript projects, are often well behaved and are rarely a big issue. Except maybe for a few large backend frameworks. No, that won't destroy your company. Anything that helps vetting will be more than welcome, though.

by ratww 4y ago

dodgerdan 4y ago

> What do you expect the community to do? Ensuring that the core infrastructure of their software systems doesn’t have the same security standards as teenagers wordpress site would be an awesome start.

ratww 4y ago
Depending on what you're calling core infrastructure, it might not be something under control of "the community".

dgb23 4y ago

It surprises me that colleges teach web frameworks.

ratww 4y ago
Me too. But what really suprises me is that today that's virtually the only thing some of them are teaching. It's Java or Python for programming basics (arithmetics, ifs, print), then straight into frameworks.
- dgb23 4y ago
  That's really unfortunate. I think education is the best place to teach these things bottom up. Especially considering that you understand a framework way better after creating one yourself. There are not that many essential parts in a web framework anyways, it's the plumbing, the tooling and the polish around them that makes them productive.
  - ratww 4y ago
    Exactly. IMO you're a 100x better developer when you at least tried to create something you use from scratch. I find however this will become harder and harder with newbies being constantly bombarded online with messages stating that creating anything from scratch is a futile exercise, together with companies influencing college curriculums.
havblue 4y ago
I suppose it's job security for a lot of us that colleges are producing developers who don't know what a string is.

deleted 4y ago

[deleted]

bin_bash 4y ago

It's unrealistic to vet the entire chain of dependencies especially considering how they can become vulnerable at any time. Developers can't be expected to be responsible for that. What we need is a set of policies around dependencies that we agree on as an industry and tools to help make securing our systems easier. We're working on it: https://slsa.dev/spec/v0.1/requirements https://slsa.dev/spec/v0.1/requirements

ratww 4y ago
Nope. It is completely realistic as long as you keep the chain of dependencies manageable. To vet dependencies properly you have to stop using thousands of them willy-nilly. To stop using thousands of them you mostly have to change only your development dependencies. Runtimes dependencies, even in large Javascript projects, are often well behaved and are rarely a big issue. Except maybe for a few large backend frameworks. No, that won't destroy your company. Anything that helps vetting will be more than welcome, though.