4 ms·

Throwing the black hat on for a moment surely I would just move towards the subdependencies of these popular gems (which realistically is where you would be tar

by mhoad 4y ago

Throwing the black hat on for a moment surely I would just move towards the subdependencies of these popular gems (which realistically is where you would be targeting anyways I imagine) and can fairly reliably expect that my malicious changes get picked up upstream in due course. Am I missing something here?

joevandyk 4y ago
Those dependencies will be downloaded more often than the “popular” gems, so they will be affected by the same policies.
- mhoad 4y ago
  Cool that’s what I wanted to clarify. Thank you.
- injidup 4y ago
  They will be more popular!
colechristensen 4y ago
I see this kind of comment often, somebody implements a solid security improvement measure and a popular response is "what about x!?" No, enabling MFA for the most popular packages won't end all security, but also your strategy of targeting subdependencies isn't very good, every dependency of a popular project will be more popular than its dependent parent.
Gigachad 4y ago
I'd imagine this would end up being rolled out to almost all users eventually. Getting the top 100 done is just the warm up.
orblivion 4y ago
I don't know the Ruby ecosystem, but do dependencies go by hashes? If so, an update to the dependency won't immediately affect the Popular Gem. Sure, the maintainer could still naively update the dependencies and pull up a bad one during an update of the Popular Gem. But that Popular Gem update would have to happen after an attack on the dependency, and before the breach was discovered (assuming it has any way of being discovered before release of the popular package).
ryanbrunner 4y ago
One advantage (albeit by no means perfect) is that subdepdencies of Ruby gems tend to be much more limited than what you see in NPM (probably largely because you can only have one version of a gem running in an application). Lots and lots of gems depend on Rails and / or ActiveSupport. There's probably a lot more "glue" gems that are widely used for stuff like HTTP clients. Beyond that though, your typical gem doesn't have an enormous amount of dependencies, and there's a pretty good chance that the dependencies of the top X gems are themselves in the list of top X gems.

by mhoad 4y ago

joevandyk 4y ago

Those dependencies will be downloaded more often than the “popular” gems, so they will be affected by the same policies.

mhoad 4y ago
Cool that’s what I wanted to clarify. Thank you.
injidup 4y ago
They will be more popular!

colechristensen 4y ago

I see this kind of comment often, somebody implements a solid security improvement measure and a popular response is "what about x!?" No, enabling MFA for the most popular packages won't end all security, but also your strategy of targeting subdependencies isn't very good, every dependency of a popular project will be more popular than its dependent parent.

Gigachad 4y ago

I'd imagine this would end up being rolled out to almost all users eventually. Getting the top 100 done is just the warm up.

orblivion 4y ago

I don't know the Ruby ecosystem, but do dependencies go by hashes? If so, an update to the dependency won't immediately affect the Popular Gem. Sure, the maintainer could still naively update the dependencies and pull up a bad one during an update of the Popular Gem. But that Popular Gem update would have to happen after an attack on the dependency, and before the breach was discovered (assuming it has any way of being discovered before release of the popular package).

ryanbrunner 4y ago

One advantage (albeit by no means perfect) is that subdepdencies of Ruby gems tend to be much more limited than what you see in NPM (probably largely because you can only have one version of a gem running in an application). Lots and lots of gems depend on Rails and / or ActiveSupport. There's probably a lot more "glue" gems that are widely used for stuff like HTTP clients. Beyond that though, your typical gem doesn't have an enormous amount of dependencies, and there's a pretty good chance that the dependencies of the top X gems are themselves in the list of top X gems.