5 ms·

Basically, as per everything these days, the entire software industry is based on "download and run any old shit off the Internet" with little to no fucks given

by baz00 3y ago

Basically, as per everything these days, the entire software industry is based on "download and run any old shit off the Internet" with little to no fucks given about the source or trustworthyness or correctness. End users are no better because for most people, including a lot of novice Linux users, this isn't even considered as part of fixing or dealing with any particular problem. Cut / paste / job done. Worst is I've seen CD/CI systems which just pull unsigned unverified binaries off the internet and build software from github, random APT and YUM repos, all sorts of shit. This is then all thrown together and pushed into production systems.

acatton 3y ago
It doesn't have to be. Corporations which are FedRAMP[1] compliant, have to build software reproducibly in a fully isolated environment, only from reviewed code.[2] [1] https://en.wikipedia.org/wiki/FedRAMP https://en.wikipedia.org/wiki/FedRAMP [2] https://slsa.dev/ https://slsa.dev/
- metadat 3y ago
  In theory, yes. Who has really reviewed and analyzed every line of Kafka or Spark? Even the bigcos.. don't.
- Nursie 3y ago
  Ah, I remember when we all did that. It was just part of basic due diligence - pull all your dependencies into your own build system, review and check compatibility, then build completely locally. Of course a lot of what we built wasn’t public facing or exposed to the internet at all, so addressing the latest vulnerabilities in record time wasn’t quite as important as known-good builds. I’ve worked in one or two places recently (big bank) that are large enough to have their own internal repo systems and teams of security/compliance reviewers. Their versions of things can be a bit behind but are at least under control of the same org. Everywhere else, well, it feels a bit like cowboy country… (edit - the other trade-off was of course that you wrote a lot more of everything yourself, rather than pulling in whatever you felt like. This slows down the development cycle significantly but it does mean people had a greater understanding of everything in their stack, and products were often more lean as a result.)
pdntspa 3y ago
Or all those `curl install.sh | bash -` scripts that nobody checks that could do pretty much anything, esp when they ask you to sudo
- mtillman 3y ago
  Who is running random curl scripts without checking the code first? Is this common now?
  - zx8080 3y ago
    Quite so. A quick example from k3s installation page (https://docs.k3s.io/quick-start https://docs.k3s.io/quick-start): ``` curl -sfL https://get.k3s.io https://get.k3s.io | sh - ```
    - rangerelf 3y ago
      It bugs me to no end that they (those that give those instructions) are normalizing this.
  - d0mine 3y ago
    Nobody reads the source code of all software they are running.
  - firen777 3y ago
    Considering: - Not everyone is proficient in bash. - Some install scripts can easily go on for thousands of lines, especially if they are designed to work with multiple distro or architecture, or both. - Said install script might be integrated deep down into someone else's build pipeline. - ... that's assuming they aren't the type that would blindly download and run random exe from the web in the first place Pretty common, I would say.
  - RulerOf 3y ago
    Ever install docker on a pet Linux box? That script saves a lot of time.
thephyber 3y ago
Other than reputation analysis by Snyk, I honestly don’t know how to objectively analyze one repo/package versus another. Obviously I can make some basic heuristics, but I can’t reasonably evaluate all of the components of trust for every library, package, container, framework, repo even at a regular interval, let alone fast enough to just maintain patch levels (nevermind being reasonably productive). I actually considered first steps in making a business out of this idea, but I’m convinced that every developer overestimates their ability to identify untrustworthy repos/packages and companies aren’t willing to pay the actual cost (with either subscription dollars or in the friction it would add to reject almost all 3rd party code because it doesn’t meet high standards of quality and security in a transparent and verifiable way).
- RulerOf 3y ago
  >Obviously I can make some basic heuristics, but I can’t reasonably evaluate all of the components of trust for every library, package, container, framework, repo even at a regular interval, let alone fast enough to just maintain patch levels (nevermind being reasonably productive). Related: have you tried throwing a file (or a hash) at VirusTotal lately? If it's executable, they'll run it in a sandbox and give you a forensic report of everything it touched and did. I'm so suspicious of software I can't at least review the source code of that originates outside of trusted channels that I probably wouldn't run anything meeting that description that I couldn't compile myself if it weren't for that (and similar) tools.
  - thephyber 3y ago
    Virus scan is only 1% of security. Eg. How do I know with any certainty that a library passes all OWASP best practices? Or is well documented? Or is maintained? Or is responsive to security reports? [… and dozens of other similar properties]
  - nprateem 3y ago
    Reviewing code is an insurmountable task if you're using more than a few very simple packages.
marcus_holmes 3y ago
I personally believe this is going to be the biggest security nightmare of the next ten years. All those npm/gem/pip/deb packages that are imported by thousands of projects and Docker images, with maintainers who are retiring. So easy for a malicious actor to just slip in some code, and who has time to audit all those dependencies for every single update?

by baz00 3y ago

acatton 3y ago

It doesn't have to be. Corporations which are FedRAMP[1] compliant, have to build software reproducibly in a fully isolated environment, only from reviewed code.[2] [1] https://en.wikipedia.org/wiki/FedRAMP https://en.wikipedia.org/wiki/FedRAMP [2] https://slsa.dev/ https://slsa.dev/

metadat 3y ago
In theory, yes. Who has really reviewed and analyzed every line of Kafka or Spark? Even the bigcos.. don't.
Nursie 3y ago
Ah, I remember when we all did that. It was just part of basic due diligence - pull all your dependencies into your own build system, review and check compatibility, then build completely locally. Of course a lot of what we built wasn’t public facing or exposed to the internet at all, so addressing the latest vulnerabilities in record time wasn’t quite as important as known-good builds. I’ve worked in one or two places recently (big bank) that are large enough to have their own internal repo systems and teams of security/compliance reviewers. Their versions of things can be a bit behind but are at least under control of the same org. Everywhere else, well, it feels a bit like cowboy country… (edit - the other trade-off was of course that you wrote a lot more of everything yourself, rather than pulling in whatever you felt like. This slows down the development cycle significantly but it does mean people had a greater understanding of everything in their stack, and products were often more lean as a result.)

pdntspa 3y ago

Or all those `curl install.sh | bash -` scripts that nobody checks that could do pretty much anything, esp when they ask you to sudo

mtillman 3y ago
Who is running random curl scripts without checking the code first? Is this common now?
- zx8080 3y ago
  Quite so. A quick example from k3s installation page (https://docs.k3s.io/quick-start https://docs.k3s.io/quick-start): ``` curl -sfL https://get.k3s.io https://get.k3s.io | sh - ```
  - rangerelf 3y ago
    It bugs me to no end that they (those that give those instructions) are normalizing this.
- d0mine 3y ago
  Nobody reads the source code of all software they are running.
- firen777 3y ago
  Considering: - Not everyone is proficient in bash. - Some install scripts can easily go on for thousands of lines, especially if they are designed to work with multiple distro or architecture, or both. - Said install script might be integrated deep down into someone else's build pipeline. - ... that's assuming they aren't the type that would blindly download and run random exe from the web in the first place Pretty common, I would say.
- RulerOf 3y ago
  Ever install docker on a pet Linux box? That script saves a lot of time.

thephyber 3y ago

Other than reputation analysis by Snyk, I honestly don’t know how to objectively analyze one repo/package versus another. Obviously I can make some basic heuristics, but I can’t reasonably evaluate all of the components of trust for every library, package, container, framework, repo even at a regular interval, let alone fast enough to just maintain patch levels (nevermind being reasonably productive). I actually considered first steps in making a business out of this idea, but I’m convinced that every developer overestimates their ability to identify untrustworthy repos/packages and companies aren’t willing to pay the actual cost (with either subscription dollars or in the friction it would add to reject almost all 3rd party code because it doesn’t meet high standards of quality and security in a transparent and verifiable way).

RulerOf 3y ago
>Obviously I can make some basic heuristics, but I can’t reasonably evaluate all of the components of trust for every library, package, container, framework, repo even at a regular interval, let alone fast enough to just maintain patch levels (nevermind being reasonably productive). Related: have you tried throwing a file (or a hash) at VirusTotal lately? If it's executable, they'll run it in a sandbox and give you a forensic report of everything it touched and did. I'm so suspicious of software I can't at least review the source code of that originates outside of trusted channels that I probably wouldn't run anything meeting that description that I couldn't compile myself if it weren't for that (and similar) tools.
- thephyber 3y ago
  Virus scan is only 1% of security. Eg. How do I know with any certainty that a library passes all OWASP best practices? Or is well documented? Or is maintained? Or is responsive to security reports? [… and dozens of other similar properties]
- nprateem 3y ago
  Reviewing code is an insurmountable task if you're using more than a few very simple packages.

marcus_holmes 3y ago

I personally believe this is going to be the biggest security nightmare of the next ten years. All those npm/gem/pip/deb packages that are imported by thousands of projects and Docker images, with maintainers who are retiring. So easy for a malicious actor to just slip in some code, and who has time to audit all those dependencies for every single update?