4 ms·

Just remember that blindly updating dependencies that no one trustworthy has reviewed is opening yourself up to supply chain attacks. Blindly upgrading is wors

by lrvick 2y ago

Just remember that blindly updating dependencies that no one trustworthy has reviewed is opening yourself up to supply chain attacks. Blindly upgrading is worse than never upgrading unless you are addressing a specific CVE that impacts you. Public open source code is code you did not have to write which can be a time saver, but you do not get to skip code review. If you do not have time to review 2000 dependencies, then you should drop them favoring simple functions that only do what you need.

Culonavirus 2y ago
[flagged]
- lrvick 2y ago
  Shameless plug: If your team really wants more dependencies than they have the capacity to review, my team and I are happy to help greatly reduce this risk. My company (https://distrust.co https://distrust.co) has reviewed hundreds of dependencies on behalf of our clients, and some even pay for this as a monthly retainer service. JS dependency debt is good for my business.
  - playingalong 2y ago
    What guarantees do you offer?
    - lrvick 2y ago
      We are not an cyber insurance firm, so we don't offer any guarantees or compensation if you get compromised. We operate the same as any security auditing firm. One of our clients reviews all their dependencies in-house with their own team and has us be the second pass for extra assurance. They have also tested our team in the past by not revealing vulnerabilities they have already identified to be sure we are indeed reviewing the way we say we do. Security bugs are everywhere because very few internet rando library authors have infosec experinece, so you are unlikely to get a clean report on any given dependency tree, but /usually/ the items are low to medium risk and can be chased upstream or easily patched out. Sometimes however we find really problematic ones like CVE-2018-9057 that impact you if you have ever used it even once ever. Also there is an economy of scale here in that if one of our other clients asked for review of a react dependency last week, we can copy over our opinion and consume fewer hours on the clock.
  - Culonavirus 2y ago
    It's just an absurd idea that your typical, average "modern JS" devs using React + Redux/Next.js (with a truckload of other deps), for example (as is pretty common these days), will review (or wait for a review of or pay for reviews of) the dep tree. People have enough on their plate, I'm willing to put my life on a bet that 90% of JS devs don't review their deps. It's preposterous to even suggest that. Just look into your node modules of these projects. This is done in maybe the top 10% most rich AND security minded businesses out there, mostly in the FAANG or the banking/govt sector. Individual devs or small teams? Forget it. Never worked at a place that did so or even heard of one. It may be different with other languages and frameworks that may be moving more slowly or the dep tree is much flatter, but JS moves fast, browsers change often, and the dep trees are massive. Bugfixes and small feature upgrades could easily change a truckload of dep code. Then, as if it wasn't enough, I'm not even sure how would you review something like an Electron-based app... what, you're gonna review the entire Electron-Chromium-Node chain on top of all the mess mentioned above? Sure :D
    - lrvick 2y ago
      I would double down on your claim and say 99.9% of JS devs don't review dependencies. Also 100 years ago almost zero doctors washed their hands. The majority of people in a profession doing something does not make it any less negligent. My customer base is almost exclusively companies in industries like Fintech where giving strangers the ability to push any code they want to production is undesirable. In one case, the customer has their own internal team review all dependencies -and- has my team review them, and only adds a dependency to the allow list that get a thumbs up from both.

by lrvick 2y ago

Culonavirus 2y ago

[flagged]

lrvick 2y ago
Shameless plug: If your team really wants more dependencies than they have the capacity to review, my team and I are happy to help greatly reduce this risk. My company (https://distrust.co https://distrust.co) has reviewed hundreds of dependencies on behalf of our clients, and some even pay for this as a monthly retainer service. JS dependency debt is good for my business.
- playingalong 2y ago
  What guarantees do you offer?
  - lrvick 2y ago
    We are not an cyber insurance firm, so we don't offer any guarantees or compensation if you get compromised. We operate the same as any security auditing firm. One of our clients reviews all their dependencies in-house with their own team and has us be the second pass for extra assurance. They have also tested our team in the past by not revealing vulnerabilities they have already identified to be sure we are indeed reviewing the way we say we do. Security bugs are everywhere because very few internet rando library authors have infosec experinece, so you are unlikely to get a clean report on any given dependency tree, but /usually/ the items are low to medium risk and can be chased upstream or easily patched out. Sometimes however we find really problematic ones like CVE-2018-9057 that impact you if you have ever used it even once ever. Also there is an economy of scale here in that if one of our other clients asked for review of a react dependency last week, we can copy over our opinion and consume fewer hours on the clock.
- Culonavirus 2y ago
  It's just an absurd idea that your typical, average "modern JS" devs using React + Redux/Next.js (with a truckload of other deps), for example (as is pretty common these days), will review (or wait for a review of or pay for reviews of) the dep tree. People have enough on their plate, I'm willing to put my life on a bet that 90% of JS devs don't review their deps. It's preposterous to even suggest that. Just look into your node modules of these projects. This is done in maybe the top 10% most rich AND security minded businesses out there, mostly in the FAANG or the banking/govt sector. Individual devs or small teams? Forget it. Never worked at a place that did so or even heard of one. It may be different with other languages and frameworks that may be moving more slowly or the dep tree is much flatter, but JS moves fast, browsers change often, and the dep trees are massive. Bugfixes and small feature upgrades could easily change a truckload of dep code. Then, as if it wasn't enough, I'm not even sure how would you review something like an Electron-based app... what, you're gonna review the entire Electron-Chromium-Node chain on top of all the mess mentioned above? Sure :D
  - lrvick 2y ago
    I would double down on your claim and say 99.9% of JS devs don't review dependencies. Also 100 years ago almost zero doctors washed their hands. The majority of people in a profession doing something does not make it any less negligent. My customer base is almost exclusively companies in industries like Fintech where giving strangers the ability to push any code they want to production is undesirable. In one case, the customer has their own internal team review all dependencies -and- has my team review them, and only adds a dependency to the allow list that get a thumbs up from both.