3 ms·

I don't think that's the real solution. Pay somebody either internally or externally to maintain a repo of all your dependencies and point your code at that. Y

I don't think that's the real solution. Pay somebody either internally or externally to maintain a repo of all your dependencies and point your code at that. You won't get a left-pad incident. You won't get a malicious .so incident (unless you mirror binaries instead of source code). Like if you ran out of screws to make your product with do you walk around the street and scrounge up some? No, you go to a trusted vendor and buy the screws.

yarg 3y ago
I'm not suggesting scrounging. I'm suggesting that the guys who've repeatedly proven themselves technically competent around security at scale might have a couple of useful ideas regarding how the industry might go about crawling its way out of this little security clusterfuck. And perhaps even stop treating something as simple as a BOM as an enterprise feature, given that the overhead on such things is damned near zilch and the security implications are staggering. https://www.cisa.gov/sbom https://www.cisa.gov/sbom
cmrdporcupine 3y ago
There's reasons why Google projects don't go out on the internet to get their 3rd party deps. They're all checked into Google3 (or chromium, etc.). One version only. With internal maintainers responsible for bringing it in and multiple people vetting it, and clear ownership over its management. E.g. you don't just get to willy nilly depend on a new version -- if you want to upgrade what's there, you gotta put a ring on it. If you upgrade it, you're likely going to be upgrading it for everyone, and the build system will run through the dependent tests for them all, etc. And the consequence is more responsible use of third party deps and less sprawling dependency trees and less complexity. And additional less security concerns as the code is checked in, its license vetted, and build systems are hunting around on the Internet for artifacts.
kmiller96 3y ago
I actually really like this idea. The community just needs to align on a good, simple, standard approach to mirroring repos...

yarg 3y ago

I'm not suggesting scrounging. I'm suggesting that the guys who've repeatedly proven themselves technically competent around security at scale might have a couple of useful ideas regarding how the industry might go about crawling its way out of this little security clusterfuck. And perhaps even stop treating something as simple as a BOM as an enterprise feature, given that the overhead on such things is damned near zilch and the security implications are staggering. https://www.cisa.gov/sbom https://www.cisa.gov/sbom

cmrdporcupine 3y ago

There's reasons why Google projects don't go out on the internet to get their 3rd party deps. They're all checked into Google3 (or chromium, etc.). One version only. With internal maintainers responsible for bringing it in and multiple people vetting it, and clear ownership over its management. E.g. you don't just get to willy nilly depend on a new version -- if you want to upgrade what's there, you gotta put a ring on it. If you upgrade it, you're likely going to be upgrading it for everyone, and the build system will run through the dependent tests for them all, etc. And the consequence is more responsible use of third party deps and less sprawling dependency trees and less complexity. And additional less security concerns as the code is checked in, its license vetted, and build systems are hunting around on the Internet for artifacts.

kmiller96 3y ago

I actually really like this idea. The community just needs to align on a good, simple, standard approach to mirroring repos...