4 ms·

IMO, every software dev using node, with endless thousands of packages, all with unknown licenses, and with unknown origins, unaudited, and by default, the abil

by b112 3y ago

IMO, every software dev using node, with endless thousands of packages, all with unknown licenses, and with unknown origins, unaudited, and by default, the ability to execute scripts and code during install... And which if you audit all those packages, 10 seconds later they could be sold/stolen/hijacked for malicious intent... Yet devs think this is awesome... Shows why we're stuck gping dpwn this path. Because devs have shown, they do not care about security, at all.

glitchc 3y ago
That's it. Devs are cobbling together systems as quickly as possible from what are effectively black boxes. There's minimal insight into their underlying behaviour.
pipo234 3y ago
> devs have shown, they do not care about security, at all. Could add a grain of salt there, but I get your sentiment and would not want to argue their are big problems in the software industry, supply chain being one. We could be angry about that, but what can be done to improve the situation? Specifically: what should the government do? Proposed solution of adding a safe harbor framework to shield [companies] from liability is like saying: don't use npm, use our blessed supply chain. Sounds like a bold experiment, but IMO it's not obvious that this will curtail the reckless behaviours of those software devs you refer to.
- phoehne 3y ago
  Using a blessed supply chain is not as stupid as it sounds. We do it at work so that every dependency we take is scanned.
  - pipo234 3y ago
    Interesting. Is the blessing done by you, someone in your team, someone in another team, someone in another company, someone in government? Is the blessed supply chain comparable (not in volume, but in features, ease of use) to NPM or pip ecosystem? What do you do when you need the feature that isn't in the blessed set?
    - phoehne 3y ago
      It's done by another team. It's use is generally comparable to NPM and pip. In fact we use pip, but we pull from our servers instead of public. A lot of the scanning is automated and takes care of problems I've actually run into, like virus laden files. if something is not available, we don't use it. Because the cost of violating that policy is worse than having to find another solution.
  - c0pium 3y ago
    One useful side benefit of using a private package repo is telemetry. If every dev and CI/CD machine comes with your private pypi, and you want to know where some bad version was used, you can just check the logs as opposed to playing scanner roulette. Even if you did no scanning and literally just proxies public pypi, this would make it worth it.
deleted 3y ago
[deleted]
nobodyandproud 3y ago
> IMO, every software dev using node, with endless thousands of packages, all with unknown licenses, and with unknown origins, unaudited, and by default, the ability to execute scripts and code during install... And which if you audit all those packages, 10 seconds later they could be sold/stolen/hijacked for malicious intent... Yet devs think this is awesome... Like most devs (or engineering managers), I’m resigned to modern realities. It’s a race to the bottom and I’ve been dragged into flame wars by smug (and very wrong) engineers who believed semantic versioning would solve compatibility problems and the like. It’s impossible to justify the cost of full auditing and ground-up building. The only way to solve this is to force ground rules.
- c0pium 3y ago
  It’s really easy to develop (especially backend) code that doesn’t have this horrible problem. Just use literally any other language. This is neither modern nor a reality. Regulation can’t come to this snake oil industry fast enough.
  - loup-vaillant 3y ago
    Another way to see this is that regulation can drastically change "modern reality". Require a software bill of materials and the NPM dependency nightmare will soon cease to be a reality.
    - c0pium 3y ago
      I’ve heard this before, but I don’t understand why people think this. Having an SBOM for a lovecraftian horror won’t make it less of a horror, and it will give people something to point at and say “it must be safe, it’s got this cryptography stuff!”
      - loup-vaillant 3y ago
        What I’m saying is, with the SBOM you get to see the Lovecraftian horror, and it such a drag and a time sink to properly trace the transitive closure of all your dependencies that soon, you end up thinking of maybe having fewer of them. Besides, I’m of the opinion that knowing your dependencies is a requirement for all serious software. (Meaning, if you’re not already tracking your dependencies, you are not taking your own software seriously.)

by b112 3y ago

glitchc 3y ago

That's it. Devs are cobbling together systems as quickly as possible from what are effectively black boxes. There's minimal insight into their underlying behaviour.

pipo234 3y ago

> devs have shown, they do not care about security, at all. Could add a grain of salt there, but I get your sentiment and would not want to argue their are big problems in the software industry, supply chain being one. We could be angry about that, but what can be done to improve the situation? Specifically: what should the government do? Proposed solution of adding a safe harbor framework to shield [companies] from liability is like saying: don't use npm, use our blessed supply chain. Sounds like a bold experiment, but IMO it's not obvious that this will curtail the reckless behaviours of those software devs you refer to.

phoehne 3y ago
Using a blessed supply chain is not as stupid as it sounds. We do it at work so that every dependency we take is scanned.
- pipo234 3y ago
  Interesting. Is the blessing done by you, someone in your team, someone in another team, someone in another company, someone in government? Is the blessed supply chain comparable (not in volume, but in features, ease of use) to NPM or pip ecosystem? What do you do when you need the feature that isn't in the blessed set?
  - phoehne 3y ago
    It's done by another team. It's use is generally comparable to NPM and pip. In fact we use pip, but we pull from our servers instead of public. A lot of the scanning is automated and takes care of problems I've actually run into, like virus laden files. if something is not available, we don't use it. Because the cost of violating that policy is worse than having to find another solution.
- c0pium 3y ago
  One useful side benefit of using a private package repo is telemetry. If every dev and CI/CD machine comes with your private pypi, and you want to know where some bad version was used, you can just check the logs as opposed to playing scanner roulette. Even if you did no scanning and literally just proxies public pypi, this would make it worth it.

deleted 3y ago

[deleted]

nobodyandproud 3y ago

> IMO, every software dev using node, with endless thousands of packages, all with unknown licenses, and with unknown origins, unaudited, and by default, the ability to execute scripts and code during install... And which if you audit all those packages, 10 seconds later they could be sold/stolen/hijacked for malicious intent... Yet devs think this is awesome... Like most devs (or engineering managers), I’m resigned to modern realities. It’s a race to the bottom and I’ve been dragged into flame wars by smug (and very wrong) engineers who believed semantic versioning would solve compatibility problems and the like. It’s impossible to justify the cost of full auditing and ground-up building. The only way to solve this is to force ground rules.

c0pium 3y ago
It’s really easy to develop (especially backend) code that doesn’t have this horrible problem. Just use literally any other language. This is neither modern nor a reality. Regulation can’t come to this snake oil industry fast enough.
- loup-vaillant 3y ago
  Another way to see this is that regulation can drastically change "modern reality". Require a software bill of materials and the NPM dependency nightmare will soon cease to be a reality.
  - c0pium 3y ago
    I’ve heard this before, but I don’t understand why people think this. Having an SBOM for a lovecraftian horror won’t make it less of a horror, and it will give people something to point at and say “it must be safe, it’s got this cryptography stuff!”
    - loup-vaillant 3y ago
      What I’m saying is, with the SBOM you get to see the Lovecraftian horror, and it such a drag and a time sink to properly trace the transitive closure of all your dependencies that soon, you end up thinking of maybe having fewer of them. Besides, I’m of the opinion that knowing your dependencies is a requirement for all serious software. (Meaning, if you’re not already tracking your dependencies, you are not taking your own software seriously.)