3 ms·
Unfortunately that's "industry standard" nowadays. I lost count how often I had that discussion over the last two decades. Just look at stuff like pip, npm or
by finaard 3y ago
Unfortunately that's "industry standard" nowadays. I lost count how often I had that discussion over the last two decades.
Just look at stuff like pip, npm or pretty much any "modern" package manager in use by developers - they're all pretty much designed to pull in a shitload of arbitrary unaudited and in some causes unauditable dependencies.
And nobody wants to listen. That's why I prefer to work in heavily regulated areas nowadays - that way I can shorten that discussion with "yeah, but regulatory requirements don't let us do that, sorry"
The absolute basic should be having a local archive of dependencies which at least received a basic sanity check, and updates or additions to that should review changes being added. CI gets access to that cache, but by itself does not have network access to make sure no random crap gets pulled into the build. You'd be surprised how many popular build systems can't do that at all, or only with a lot of workarounds.
- pknopf 3y agoPackage managers that use git are less prone to this kinda of attack (goland, rust).
- steveklabnik 3y agoCargo does not “use git.”
- AnyTimeTraveler 3y agoWhat they meant was probably, that you have the option to rely entirely on using git repositories for your dependencies or even just paths to other projects on your disk. You can also setup your own dependency registry and only work with that.
- steveklabnik 3y agoThat is possible but it’s not the default and isn’t as nice as the default is.
- 3836293648 3y agoCargo absolutely uses git, or else we wouldn't've had that thing where setting it to use the cli git instead of some reimplementation lead to massive speedups
- steveklabnik 3y agoWhat I mean is that it doesn’t use git as the source of truth for packages (unless you point at a git repo instead of crates.io). It does use a git repo for the index.
- awesomeMilou 3y ago> they're all pretty much designed to pull in a shitload of arbitrary unaudited and in some causes unauditable dependencies. No they're not. The dependency circle jerk went so far to prompt NPM to display all subsequent dependencies on each libraries page. The issue lies with the industry as a whole exploiting the work of OSS developers for their own gain and having the audacity to complain when these volunteers won't additionally do a security audit for free.
- eternityforest 3y agoSeems like a lot of this could be solved with a whitelist of trusted dependencies. There are already lots of groups maintaining internal lists and analysis of dependencies they trust. If there was a platform for reporting safety, rather than reporting vulnerability, one could say "Only allow packages that someone from a fortune 500 company publish an analysis of".