5 ms·

I've never understood this position. How often do you add a dependency to your project, compile your project, and then never run your project ever? I can't thin

I've never understood this position. How often do you add a dependency to your project, compile your project, and then never run your project ever? I can't think of a single case where this would have protected me.

pletnes 4y ago
CI/CD servers, dev laptops etc could have more privileges than the production machines. For instance.
- iudqnolq 4y ago
  So you never run tests on your dev machine or CI/CD, and never run your code to manually test? I'm not experienced but I thought it was normal to have some way to try out what you've written on your dev machine. Is everyone else stepping through code in their head only, and their code is run for the first time when it's deployed to production?
  - mlyle 4y ago
    Your dev machine getting pwned is bad, but your CI server getting screwed up is worse. This way you don't need to sandbox the compiler, and it can freely use system resources and access source trees. You only need to sandbox the execution. (As some people point out in this thread, editors are starting to use compilers to get overall meta-information, too-- if you can't even -view the code- to tell if it's malicious without getting exploited, that's bad).
    - iudqnolq 4y ago
      > This way you don't need to sandbox the compiler, and it can freely use system resources and access source trees. You only need to sandbox the execution. If this is now only helping CI and not dev machines I don't see why it's worth the effort. Wouldn't it be much simpler and more reliable to just sandbox compilation of anything in your CI? > if you can't even -view the code- to tell if it's malicious without getting exploited, that's bad I guess? I can't think of a single time in my life where this would have practically helped me. I skim dependencies on GitHub for obvious red flags and then trust them. I assume places with the resources to do actual in-depth review can disable advanced analysis in their IDEs for that.
      - brundolf 4y ago
        You're digging in really hard trying to talk someone out of following good development practices because you don't personally think his effort is worth it. Personally, I don't think the effort being put into this argument is worth it.
      - mlyle 4y ago
        > Wouldn't it be much simpler and more reliable to just sandbox compilation of anything in your CI? Not really. The compiler has to be able to access large swaths of your code. You want to e.g. keep your code safe. You would have to have very finely-grained sandboxing to prevent substantive disclosure, and even then you're likely leaking information.
    - pletnes 4y ago
      Fancy IDEs perform code analysis and thus if you feed them something malicious I guess it’s feasible to run a shell command or similar. By definition, IDEs have to do that to compile code, run linters etc.
WalterBright 4y ago
It means you don't need to run the compiler in a sandbox. People do not expect the compiler to be susceptible to malware attacks, and I do what I can to live up to that trust. I haven't heard of anyone creating a malicious source file that would take advantage of a compiler bug to insert malware, but there have been a lot of such attacks on other unsuspecting programs, like those zip bomb files.
- iudqnolq 4y ago
  > People do not expect the compiler to be susceptible to malware attacks I'm not familiar with D, so I'll use the example of Rust. My usual workflow looks something like this 1. Make some changes 2. Either use `cargo test` to run my tests or `cargo run` to run my binary. In both those cases the code is first compiled and subsequently run. I care if running that command gives me malware. I don't care at what step it happens.
  - daedalus_f 4y ago
    Perhaps it’s about responsibility. It’s not the compilers fault if you chose to compile and run malware. But you could blame the compiler if it ran malware during the compilation process.
    - iudqnolq 4y ago
      All else equal I'd agree. But I'm perplexed why people spend a lot of effort on what seems to me like a purely philosophical benefit.
      - rnk 4y ago
        It's just address part of the problem, which of course is why it seems somewhat pointless. I need to: 1. Install packages/deps/libraries etc safely 2. Run code that includes those libraries that limits their capabilities centrally.
        4y ago
mozman 4y ago
Build servers?

pletnes 4y ago

CI/CD servers, dev laptops etc could have more privileges than the production machines. For instance.

iudqnolq 4y ago
So you never run tests on your dev machine or CI/CD, and never run your code to manually test? I'm not experienced but I thought it was normal to have some way to try out what you've written on your dev machine. Is everyone else stepping through code in their head only, and their code is run for the first time when it's deployed to production?
- mlyle 4y ago
  Your dev machine getting pwned is bad, but your CI server getting screwed up is worse. This way you don't need to sandbox the compiler, and it can freely use system resources and access source trees. You only need to sandbox the execution. (As some people point out in this thread, editors are starting to use compilers to get overall meta-information, too-- if you can't even -view the code- to tell if it's malicious without getting exploited, that's bad).
  - iudqnolq 4y ago
    > This way you don't need to sandbox the compiler, and it can freely use system resources and access source trees. You only need to sandbox the execution. If this is now only helping CI and not dev machines I don't see why it's worth the effort. Wouldn't it be much simpler and more reliable to just sandbox compilation of anything in your CI? > if you can't even -view the code- to tell if it's malicious without getting exploited, that's bad I guess? I can't think of a single time in my life where this would have practically helped me. I skim dependencies on GitHub for obvious red flags and then trust them. I assume places with the resources to do actual in-depth review can disable advanced analysis in their IDEs for that.
    - brundolf 4y ago
      You're digging in really hard trying to talk someone out of following good development practices because you don't personally think his effort is worth it. Personally, I don't think the effort being put into this argument is worth it.
    - mlyle 4y ago
      > Wouldn't it be much simpler and more reliable to just sandbox compilation of anything in your CI? Not really. The compiler has to be able to access large swaths of your code. You want to e.g. keep your code safe. You would have to have very finely-grained sandboxing to prevent substantive disclosure, and even then you're likely leaking information.
  - pletnes 4y ago
    Fancy IDEs perform code analysis and thus if you feed them something malicious I guess it’s feasible to run a shell command or similar. By definition, IDEs have to do that to compile code, run linters etc.

WalterBright 4y ago

It means you don't need to run the compiler in a sandbox. People do not expect the compiler to be susceptible to malware attacks, and I do what I can to live up to that trust. I haven't heard of anyone creating a malicious source file that would take advantage of a compiler bug to insert malware, but there have been a lot of such attacks on other unsuspecting programs, like those zip bomb files.

iudqnolq 4y ago
> People do not expect the compiler to be susceptible to malware attacks I'm not familiar with D, so I'll use the example of Rust. My usual workflow looks something like this 1. Make some changes 2. Either use `cargo test` to run my tests or `cargo run` to run my binary. In both those cases the code is first compiled and subsequently run. I care if running that command gives me malware. I don't care at what step it happens.
- daedalus_f 4y ago
  Perhaps it’s about responsibility. It’s not the compilers fault if you chose to compile and run malware. But you could blame the compiler if it ran malware during the compilation process.
  - iudqnolq 4y ago
    All else equal I'd agree. But I'm perplexed why people spend a lot of effort on what seems to me like a purely philosophical benefit.
    - rnk 4y ago
      It's just address part of the problem, which of course is why it seems somewhat pointless. I need to: 1. Install packages/deps/libraries etc safely 2. Run code that includes those libraries that limits their capabilities centrally.
      - 4y ago

mozman 4y ago

Build servers?