3 ms·

First, yes: there absolutely should be better tools for authors to sign & authenticate their own tools, with heightened cryptographic authentication means. Proj

First, yes: there absolutely should be better tools for authors to sign & authenticate their own tools, with heightened cryptographic authentication means. Projects like sigstore get this (and wish to respect privacy![1]). But what's spoken of here is a deep imposition, and doesn't empower authors, but demands of them. > I fail to see how MFA resolves the fundamental trust equation Nothing ever will. Your desire for a cathedral is incompatible fundamentally & at every level with the bazaar. Trying to drive open-source society towards an industrialized security state for the convenience of your probably non-contributing, not-paying industrialized software production needs is vastly unfair. If you have needs, you need to take your own responsibility. If you have risks, you need to pay to hedge them. Go hire NodeSource to help you get the Certified Modules you can trust. Go sign contracts with authors to get the support you need. Heck, just checkin your package-lock.json and go see what you are downloading: npm is immutable! You could literally do anything to help safeguard yourself, but you ask for absolute protection, something that even the biggest best corporations can never truly promise. Trying to prevent even one reasonably placed malicious employee from causing disruption is a near impossible task. But you ask for a fundamental safety. This is laughable. None of us can expect nor deserve that. > Until GitHub requires government-issued photo ID in addition to MFA What a vile & fascist imposition this would be! Woe be unto us if industrialzied software so hotly presses for it's own security that it embraces such ludicrous & perverse a cowardice as this. Relying on github as your source of trust, and pressuring them to pressure the world into turning over core information, is just as antithetical as I can image to the open source behavior & society that has advanced us so far. What a terrible thing to wish for! Egads, gross. [1] https://blog.sigstore.dev/privacy-in-sigstore-57cac15af0d0 https://blog.sigstore.dev/privacy-in-sigstore-57cac15af0d0 https://news.ycombinator.com/item?id=31533997 https://news.ycombinator.com/item?id=31533997

strawhatguy 4y ago
Thank you for writing this; far too much entitlement, far too much blame shifting in the parent comment. Ultimately problems with your code, including deps it pulls in, are your problem, no one else's. Code appropriately.
- rektide 4y ago
  Thank you. Ultimately I would agree that some more security is good, that we do we need capabilities & strategies for trust, need to make more options available. But I also think top-down, authoritarian measures are pitiful, reactionary, & an entitled response. This co-option & bending- of what has gotten us so far, & only infrequently been problematic- into something industrial & controlling, is unwarranted & vulgar. It's very important to realize that "success" cannot be the objective. There will always be fundamental questions of trust that are outstanding. Once we begin pretending that this is a "problem to be solved" and not an ongoing shifting changing scene we think too short-term, too limitedly. This is a long long iteration with no finality with no triumphant final cracking the code to get us security. Letting Microsoft and/or China[1] approve all PRs & everyone living happily ever sounds nice, but incompatible with the ethos & logos of open-source, of letting people be people & mutually encouraging each other. I'd also emphasize- strongly- that the real defenses are collectivized ones. Maybe we can build a social network of vouchers, people who look at releases & record a confidence or sureness they feel about the changes. Aggregate the results when we update packages. Open source has been a collective effort, and I think a lot of the security gains we want are from increased collectivization. This- notably- again bucks the idea of absolute security, of fundamental answers, and instead encourages & pushes in a good direction. [1] https://www.scmp.com/tech/big-tech/article/3178323/gitee-chinas-answer-github-review-all-code-temporarily-closing-open https://www.scmp.com/tech/big-tech/article/3178323/gitee-chi... https://news.ycombinator.com/item?id=31458770 https://news.ycombinator.com/item?id=31458770
  - tempodox 4y ago
    I believe the conquer-all thinking of big corporations is fundamentally incompatible with open-source culture, if there is such a thing. Top-down, authoritarian measures are too much in their DNA, and that includes the CYA angle. I suspect this might end with the usual “Embrace, Extend, Extinguish” — not because someone consciously follows an evil plan, but because of that fundamental incompatibility. It will increasingly be “our way or the highway” and people who disagree will have to make camp somewhere else, if they can. But can they really when NPM practically holds a monopoly position in its space?
bigiain 4y ago
> Your desire for a cathedral is incompatible fundamentally & at every level with the bazaar. My take on that is more like: Your bosses desire for you to build them a cathedral without doing most of the required work, by piling up free foundations, walls, pulpits, pipe organs, arched ceilings, spires, and left pad.js - that other people will give you for free, is a fundamentally flawed plan which will inevitably lead to things not fitting together quite right and ending up with something much more like a bazaar, that is significantly less beautiful and secure than the cathedral in the pitch deck.

strawhatguy 4y ago

Thank you for writing this; far too much entitlement, far too much blame shifting in the parent comment. Ultimately problems with your code, including deps it pulls in, are your problem, no one else's. Code appropriately.

rektide 4y ago
Thank you. Ultimately I would agree that some more security is good, that we do we need capabilities & strategies for trust, need to make more options available. But I also think top-down, authoritarian measures are pitiful, reactionary, & an entitled response. This co-option & bending- of what has gotten us so far, & only infrequently been problematic- into something industrial & controlling, is unwarranted & vulgar. It's very important to realize that "success" cannot be the objective. There will always be fundamental questions of trust that are outstanding. Once we begin pretending that this is a "problem to be solved" and not an ongoing shifting changing scene we think too short-term, too limitedly. This is a long long iteration with no finality with no triumphant final cracking the code to get us security. Letting Microsoft and/or China[1] approve all PRs & everyone living happily ever sounds nice, but incompatible with the ethos & logos of open-source, of letting people be people & mutually encouraging each other. I'd also emphasize- strongly- that the real defenses are collectivized ones. Maybe we can build a social network of vouchers, people who look at releases & record a confidence or sureness they feel about the changes. Aggregate the results when we update packages. Open source has been a collective effort, and I think a lot of the security gains we want are from increased collectivization. This- notably- again bucks the idea of absolute security, of fundamental answers, and instead encourages & pushes in a good direction. [1] https://www.scmp.com/tech/big-tech/article/3178323/gitee-chinas-answer-github-review-all-code-temporarily-closing-open https://www.scmp.com/tech/big-tech/article/3178323/gitee-chi... https://news.ycombinator.com/item?id=31458770 https://news.ycombinator.com/item?id=31458770
- tempodox 4y ago
  I believe the conquer-all thinking of big corporations is fundamentally incompatible with open-source culture, if there is such a thing. Top-down, authoritarian measures are too much in their DNA, and that includes the CYA angle. I suspect this might end with the usual “Embrace, Extend, Extinguish” — not because someone consciously follows an evil plan, but because of that fundamental incompatibility. It will increasingly be “our way or the highway” and people who disagree will have to make camp somewhere else, if they can. But can they really when NPM practically holds a monopoly position in its space?

bigiain 4y ago

> Your desire for a cathedral is incompatible fundamentally & at every level with the bazaar. My take on that is more like: Your bosses desire for you to build them a cathedral without doing most of the required work, by piling up free foundations, walls, pulpits, pipe organs, arched ceilings, spires, and left pad.js - that other people will give you for free, is a fundamentally flawed plan which will inevitably lead to things not fitting together quite right and ending up with something much more like a bazaar, that is significantly less beautiful and secure than the cathedral in the pitch deck.