3 ms·
Coming at this from a naive perspective, do we care if a module is provably, definitely imported? I think for supply chain attacks it should be sufficient to sa
by janalsncm 4y ago
Coming at this from a naive perspective, do we care if a module is provably, definitely imported? I think for supply chain attacks it should be sufficient to say this module might be imported and deserves attention. I assume Rice’s theorem would also say that even though malicious code is imported it might not run the malicious bits today or on this machine [1]. But that doesn’t mean I’m ok with having it there.
[1] https://en.m.wikipedia.org/wiki/Stuxnet https://en.m.wikipedia.org/wiki/Stuxnet
- maweki 4y agoIt's undecidable whether there even is an import of stuff. It's every non-trivial property that's undecidable. So the question whether a certain line is reached is as undecidable as the question what values can arguments have at that line. So it's undecidable whether a dynamic import statement is reached and what its import argument will be. And even if the value is static, then it's undecidable whether the content of the imported module has been just changed.