3 ms·
How would you navigate ‘but I need $x.exe’? Dont get me wrong I’d love to say lolno to these types of requests, but basically everything requires npm these day
by hsbauauvhabzb 4y ago
How would you navigate ‘but I need $x.exe’?
Dont get me wrong I’d love to say lolno to these types of requests, but basically everything requires npm these days, while also being basically impossible to audit every dependency you install. I’m a huge fan of good security shouldn’t impact too much on productivity, but dependency trees make me lose sleep at night (waterhole attacks, EOL packages that are painful to remove, etc).
Pentester by trade with a background in software dev.
- pixl97 4y agoThe same way any business deals with any need. The requestor must make a business case for the need that is then reviewed. I need $x.exe is not just a security risk, it's a business continuity risk. What is the licensing of $X, do we need to pay licensing for it? Are we getting sued for using it? Are we doing to redistribute it, and can we? In general the average programmer, especially on a team should not be making that choice, and someone higher up should before really expensive surprises happen. I work in software composition analysis/static analysis/SBOM and ya, the average piece of software coming can be terrifying. Its common to see companies distributing things like open source packages in violation of the license. Even worse is when they are pulling in something like 'One-Js' and '0ne-Js' (made up for example) that shows up in audit of our SCA output.