4 ms·

If this was a clever hack, I'd agree with you, shit happens. But for gods sake, having secrets hardcoded in VCS?? You seem to understand threat modelling. Wha

If this was a clever hack, I'd agree with you, shit happens. But for gods sake, having secrets hardcoded in VCS?? You seem to understand threat modelling. What's the threat towards one of the biggest and most used package registry? It's not like npm Inc just started running the registry. They have been doing this for years. To let such a beginner mistake risk the supply chain of basically the entire JS ecosystem is not only sloppy, it's completely unprofessional. What can we do in the short-term? I'm not sure, but I hope smarter people than me comes up with some solutions ASAP before a compromise like this starts actually impact developers using npm.

0daystock 4y ago
It is long past time for channel-binding of bearer credentials. It's unconscionable we as engineering professionals allow the total sum of security controls of a system to constantly be reduced to a string humans pass around.
- judge2020 4y ago
  OIDC-based authorization between trusted parties seems to be picking up steam[0], with the main issue being that setting it up isn't as easy as "paste shared secret". 0: https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services https://docs.github.com/en/actions/deployment/security-harde...
  - tedivm 4y ago
    I wrote a blog post about connecting Github and AWS over OIDC. In my example I focus on using it to public images to ECR, but it's applicable to any AWS permission needs. https://blog.tedivm.com/guides/2021/10/github-actions-push-to-aws-ecr-without-credentials-oidc/ https://blog.tedivm.com/guides/2021/10/github-actions-push-t...
- capableweb 4y ago
  I agree, but even so, you can make things a lot more secure from "having plaintext credentials commit to source code versioning" without changing your entire infrastructure, which a move like that would require. Simply use environment variables and a .env file.

0daystock 4y ago

It is long past time for channel-binding of bearer credentials. It's unconscionable we as engineering professionals allow the total sum of security controls of a system to constantly be reduced to a string humans pass around.

judge2020 4y ago
OIDC-based authorization between trusted parties seems to be picking up steam[0], with the main issue being that setting it up isn't as easy as "paste shared secret". 0: https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services https://docs.github.com/en/actions/deployment/security-harde...
- tedivm 4y ago
  I wrote a blog post about connecting Github and AWS over OIDC. In my example I focus on using it to public images to ECR, but it's applicable to any AWS permission needs. https://blog.tedivm.com/guides/2021/10/github-actions-push-to-aws-ecr-without-credentials-oidc/ https://blog.tedivm.com/guides/2021/10/github-actions-push-t...
capableweb 4y ago
I agree, but even so, you can make things a lot more secure from "having plaintext credentials commit to source code versioning" without changing your entire infrastructure, which a move like that would require. Simply use environment variables and a .env file.