4 ms·

As head of eng in a ftse100, this is so far from the truth. .Net is a heavily targeted ecosphere, possibly moreso than npm, precisely because of its relation wi

by Jenk 4y ago

As head of eng in a ftse100, this is so far from the truth. .Net is a heavily targeted ecosphere, possibly moreso than npm, precisely because of its relation with finance. We have to contend with not only nuget and the sheer abundance of packages available (with their own transitive dependencies similar to the problems with npm - yes, even Microsoft packages have this risk) posing problems, but also the tooling itself. VS/Code is a fucking minefield of potential threats. Their extensions market place(s) are automatic RCE risks, and a developer/admin/whomever box getting pwned is a monumental risk. Zero-Trust applies to everyone and everything. Microsoft don't get a pass just for being Microsoft.

bob1029 4y ago
Are you claiming that Node/NPM is somehow a less vulnerable ecosystem than .NET/NuGet?
- Jenk 4y ago
  Nope. Next strawman, please.
- wongarsu 4y ago
  That's not what they said. They said .NET/NuGet shares some of the problems NPM has, and that it's targeted more because it's a juicer target. That doesn't mean it's more vulnerable, but it means it has to be less vulnerable to offer the same security. To offer a bad analogy: if a bank vault was as vulnerable as my fridge, people would constantly break into the bank vault but keep ignoring my fridge.
nathanaldensr 4y ago
Your reply is very uncharitable. Newer versions of .NET rely on next to zero non-Microsoft dependencies. The most notable exception to this used to be Newtonsoft.Json, which has since been replaced with Microsoft-owned System.Text.Json. You can easily implement very complex business applications with app stacks like ASP.NET or WPF while relying on exactly zero non-Microsoft dependencies. The GP never said Microsoft "gets a pass." They were pointing out that there are stacks like .NET where reliance on third-party unvetted libraries is greatly reduced if not eliminated outright. Additionally, nearly all businesses run Windows anyway, so using Visual Studio and Visual Studio Code are not the risks you make them out to be. Centralized Active Directory policies already help guard against rogue extensions and such, assuming IT even cares (they nearly never do in my experience). Yes, the surface area threat of .NET and NuGet is far, far lower than that of NPM for nearly all apps.

by Jenk 4y ago

bob1029 4y ago

Are you claiming that Node/NPM is somehow a less vulnerable ecosystem than .NET/NuGet?

Jenk 4y ago
Nope. Next strawman, please.
wongarsu 4y ago
That's not what they said. They said .NET/NuGet shares some of the problems NPM has, and that it's targeted more because it's a juicer target. That doesn't mean it's more vulnerable, but it means it has to be less vulnerable to offer the same security. To offer a bad analogy: if a bank vault was as vulnerable as my fridge, people would constantly break into the bank vault but keep ignoring my fridge.

nathanaldensr 4y ago

Your reply is very uncharitable. Newer versions of .NET rely on next to zero non-Microsoft dependencies. The most notable exception to this used to be Newtonsoft.Json, which has since been replaced with Microsoft-owned System.Text.Json. You can easily implement very complex business applications with app stacks like ASP.NET or WPF while relying on exactly zero non-Microsoft dependencies. The GP never said Microsoft "gets a pass." They were pointing out that there are stacks like .NET where reliance on third-party unvetted libraries is greatly reduced if not eliminated outright. Additionally, nearly all businesses run Windows anyway, so using Visual Studio and Visual Studio Code are not the risks you make them out to be. Centralized Active Directory policies already help guard against rogue extensions and such, assuming IT even cares (they nearly never do in my experience). Yes, the surface area threat of .NET and NuGet is far, far lower than that of NPM for nearly all apps.