3 ms·

left-pad

by dymk 4y ago

left-pad

speedgoose 4y ago
Yes it was a mistake from NPM to break the dependency tree. They fixed the issue relatively quickly.
- lolinder 4y ago
  The concern with left-pad isn't just that someone can break the build pipeline, it's that the author could just as easily have decided to push malicious code. By the time npm could react to that, your code base could already be compromised. Each additional dependency you add is another vector for a supply chain attack. If you keep your dependencies to the large libraries (say, use lodash instead of a hundred tiny libraries), there are at least fewer people in your supply chain. But if you are depending on left-pad for its 10 lines of code (that still managed to have bugs), how many other random tiny dependencies did you bring in? How many individuals are in your supply chain? All it takes is for one of them to go rogue. (Version pinning can help, but npm's default behavior is to accept minor version upgrades instead of pinning to the exact version that was live when you installed it. Lock files usually just get updated and recommitted without very much thought, so they don't help much either.)
  - deleted 4y ago
    [deleted]
  - speedgoose 4y ago
    I understand the concerns but it’s a risk most projects are willing to accept. Automated builds should use ‘npm ci’ to use the exact versions. If a developer goes crazy and push broken updates, it has been reversed and made the front page of most IT news websites in the past. The supply chain of software rely on so many things. It’s impossible for anyone to trust everything. I don’t trust OpenSSL for security, the Linux kernel still doesn’t have unit tests as far as I know, my intel CPU is a black box with proprietary microcode that is known to allow network access to anything , so many tiny libs in C are half maintained,… left-pad being offline for a few hours many years ago or fakers doing an infinite loop in one promptly removed release last year are not preventing me to sleep.

left-pad

by dymk 4y ago

left-pad

speedgoose 4y ago

Yes it was a mistake from NPM to break the dependency tree. They fixed the issue relatively quickly.

lolinder 4y ago
The concern with left-pad isn't just that someone can break the build pipeline, it's that the author could just as easily have decided to push malicious code. By the time npm could react to that, your code base could already be compromised. Each additional dependency you add is another vector for a supply chain attack. If you keep your dependencies to the large libraries (say, use lodash instead of a hundred tiny libraries), there are at least fewer people in your supply chain. But if you are depending on left-pad for its 10 lines of code (that still managed to have bugs), how many other random tiny dependencies did you bring in? How many individuals are in your supply chain? All it takes is for one of them to go rogue. (Version pinning can help, but npm's default behavior is to accept minor version upgrades instead of pinning to the exact version that was live when you installed it. Lock files usually just get updated and recommitted without very much thought, so they don't help much either.)
- deleted 4y ago
  [deleted]
- speedgoose 4y ago
  I understand the concerns but it’s a risk most projects are willing to accept. Automated builds should use ‘npm ci’ to use the exact versions. If a developer goes crazy and push broken updates, it has been reversed and made the front page of most IT news websites in the past. The supply chain of software rely on so many things. It’s impossible for anyone to trust everything. I don’t trust OpenSSL for security, the Linux kernel still doesn’t have unit tests as far as I know, my intel CPU is a black box with proprietary microcode that is known to allow network access to anything , so many tiny libs in C are half maintained,… left-pad being offline for a few hours many years ago or fakers doing an infinite loop in one promptly removed release last year are not preventing me to sleep.