3 ms·
I don't quite agree with your ancient Chinese proverb here. While it is ideal, we don't live in an ideal world. The world would have to be aware of these attac
by thenerdhead 4y ago
I don't quite agree with your ancient Chinese proverb here. While it is ideal, we don't live in an ideal world.
The world would have to be aware of these attack vectors and attack tactics to be able to mitigate them. That's not to say they haven't existed in concept for the last 10 years (which many have), just that very few utilized them maliciously until the last few years across the industry. (Also see the exponential increase of supply chain attacks in the last couple years alone and the vector/tactics used)
Security tends to be a cat and mouse game in my experience. If you wanted to even go down the Sun Tzu perspective, the best defense is to subdue the enemy without fighting. That allows one to understand the strengths and weaknesses of one and their enemy and to develop a defense that is flexible and adaptable to the moment and harden it for the future.
- fwlr 4y agoTo be specific, I was thinking that around the same time we started earnestly working on browser sandboxing and fine-grained extension/app privileges, we should have been doing the same thing for our packages. When Joe Normal tries to install an extension, Chrome tells him it wants to access his microphone; we could have had a similar thing here. “tennsserflow.py requests permission to modify the root filesystem”, “PERM: free-fortnite-skin asks to open URLs. grant / deny / uninstall ?”, etc.
- dgb23 4y agoThis needs support at the language/runtime level to be even remotely robust. Especially when we’re talking about highly dynamic and popular languages like JS/Python etc.
- thenerdhead 4y agoHere's a helpful analogy that represents a problem per line: We download code From the internet Written by unknown individuals That we haven't read Which we execute With full permissions On our trusted devices Where we keep our most important data