4 ms·

> I always prefer to self-host my dependencies Ime this has always been standard practice for production code at all the companies I've worked at and with as a

> I always prefer to self-host my dependencies Ime this has always been standard practice for production code at all the companies I've worked at and with as a SWE or PM - store dependencies within your own internal Artifactory, have it checked by a vuln scanner, and then called and deployed. That said, I came out of the Enterprise SaaS and Infra space so maybe workflows are different in B2C, but I didn't a difference in the customer calls I've been on. I guess my question is why your employer or any other org would not follow the model above?

ttyprintk 2y ago
Would an unwisely-configured site template or generator explain the scale here? Or, a malicious site template or generator purposefully sprinkling potential backdoors for later?
- alephnerd 2y ago
  But wouldn't some sort of SCA/SAST/DAST catch that? Like if I'm importing a site template, ideally I'd be verifying either it's source or it's source code as well. (Not being facetious btw - genuinely curious)
  - ttyprintk 2y ago
    I was hoping ongoing coverage would answer that; it sounds like a perfect example. I heard that the tampered code redirects traffic to a sports betting site.
baq 2y ago
> I guess my question is why your employer or any other org would not follow the model above? When you look at Artifactory pricing you ask yourself 'why should I pay them a metric truckload of money again?' And then dockerhub goes down. Or npm. Or pypi. Or github... or, worst case, this thread happens.
- alephnerd 2y ago
  I just gave Artifactory as an example. What about GHE, self-hosted GitLab, or your own in-house Git? Edit: was thinking - would be a pain in the butt to manage. That tracks, but every org ik has some corporate versioning system that also has an upsell for source scanning. (Not being facetious btw - genuinely curious)
  - baq 2y ago
    I've been a part of a team which had to manage a set of geodistributed Artifactory clusters and it was a pain in the butt to manage, too - but these were self-hosted. At a certain scale you have to pick the least worst solution though, Artifactory seems to be that.
- mrighele 2y ago
  There are cheaper or free alternatives to Artifactory. Yes they may not have all of the features but we are talking about a company that is fine with using a random CDN instead. Or, in the case of javascript, you could just vendor your dependencies or do a nice "git add node_modules".
smaudet 2y ago
> have it checked by a vuln scanner This is kinda sad. For introducing new dependencies, a vuln scanner makes sense (don't download viruses just because they came from a source checkout!), but we could have kept CDNs if we'd used signatures. EDIT: Never mind, been out of the game for a bit! I see there is SRI now... https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
swatcoder 2y ago
> I guess my question is why your employer or any other org would not follow the model above? Frankly, it's because many real-world products are pieced together by some ragtag group of bright people who have been made responsible for things they don't really know all that much about. The same thing that makes software engineering inviting to autodidacts and outsiders (no guild or license, pragmatic 'can you deliver' hiring) means that quite a lot of it isn't "engineered" at all. There are embarrassing gaps in practice everywhere you might look.
- josephg 2y ago
  Yep. The philosophy most software seems to be written with is “poke it until it works locally, then ship it!”. Bugs are things you react to when your users complain. Not things you engineer out of your software, or proactively solve. This works surprisingly well. It certainly makes it easier to get started in software. Well, so long as you don’t mind that most modern software performs terribly compared to what the computer is capable of. And suffers from reliability and security issues.
- chmod775 2y ago
  Counterpoint: It's not not about being an autodidact or an outsider. I was unlikely to meet any bad coders at work, due to how likely it is they were filtered by the hiring process, and thus I never met anyone writing truly cringe-worthy code in a professional setting. That was until I decided to go to university for a bit[1]. This is where, for the first time, I met people writing bad code professionally: professors[2]. "Bad" as in best-practices, the code usually worked. I've also seen research projects that managed to turn less than 1k LOC of python into a barely-maintainable mess[3]. I'll put my faith in an autodidact who had to prove themselves with skills and accomplishments alone over someone who got through the door with a university degree. An autodidact who doesn't care about their craft is not going to make the cut, or shouldn't. If your hiring process doesn't filter those people, why are you wasting your time at a company that probably doesn't know your value? [1] Free in my country, so not a big deal to attend some lectures besides work. Well, actually I'm paying for it with my taxes, so I might as well use it. [2] To be fair, the professors teaching in actual CS subjects were alright. Most fields include a few lectures on basic coding though, which were usually beyond disappointing. The non-CS subject that had the most competent coders was mathematics. Worst was economics. Yes, I meandered through a few subjects. [3] If you do well on some test you'd usually get job offers from professors, asking you to join their research projects. I showed up to interviews out of interest in the subject matter and professors are usually happy to tell you all about it, but wages for students are fixed at the legal minimum wage, so it couldn't ever be a serious consideration for someone already working on the free market.

ttyprintk 2y ago

Would an unwisely-configured site template or generator explain the scale here? Or, a malicious site template or generator purposefully sprinkling potential backdoors for later?

alephnerd 2y ago
But wouldn't some sort of SCA/SAST/DAST catch that? Like if I'm importing a site template, ideally I'd be verifying either it's source or it's source code as well. (Not being facetious btw - genuinely curious)
- ttyprintk 2y ago
  I was hoping ongoing coverage would answer that; it sounds like a perfect example. I heard that the tampered code redirects traffic to a sports betting site.

baq 2y ago

> I guess my question is why your employer or any other org would not follow the model above? When you look at Artifactory pricing you ask yourself 'why should I pay them a metric truckload of money again?' And then dockerhub goes down. Or npm. Or pypi. Or github... or, worst case, this thread happens.

alephnerd 2y ago
I just gave Artifactory as an example. What about GHE, self-hosted GitLab, or your own in-house Git? Edit: was thinking - would be a pain in the butt to manage. That tracks, but every org ik has some corporate versioning system that also has an upsell for source scanning. (Not being facetious btw - genuinely curious)
- baq 2y ago
  I've been a part of a team which had to manage a set of geodistributed Artifactory clusters and it was a pain in the butt to manage, too - but these were self-hosted. At a certain scale you have to pick the least worst solution though, Artifactory seems to be that.
mrighele 2y ago
There are cheaper or free alternatives to Artifactory. Yes they may not have all of the features but we are talking about a company that is fine with using a random CDN instead. Or, in the case of javascript, you could just vendor your dependencies or do a nice "git add node_modules".

smaudet 2y ago

> have it checked by a vuln scanner This is kinda sad. For introducing new dependencies, a vuln scanner makes sense (don't download viruses just because they came from a source checkout!), but we could have kept CDNs if we'd used signatures. EDIT: Never mind, been out of the game for a bit! I see there is SRI now... https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

swatcoder 2y ago

> I guess my question is why your employer or any other org would not follow the model above? Frankly, it's because many real-world products are pieced together by some ragtag group of bright people who have been made responsible for things they don't really know all that much about. The same thing that makes software engineering inviting to autodidacts and outsiders (no guild or license, pragmatic 'can you deliver' hiring) means that quite a lot of it isn't "engineered" at all. There are embarrassing gaps in practice everywhere you might look.

josephg 2y ago
Yep. The philosophy most software seems to be written with is “poke it until it works locally, then ship it!”. Bugs are things you react to when your users complain. Not things you engineer out of your software, or proactively solve. This works surprisingly well. It certainly makes it easier to get started in software. Well, so long as you don’t mind that most modern software performs terribly compared to what the computer is capable of. And suffers from reliability and security issues.
chmod775 2y ago
Counterpoint: It's not not about being an autodidact or an outsider. I was unlikely to meet any bad coders at work, due to how likely it is they were filtered by the hiring process, and thus I never met anyone writing truly cringe-worthy code in a professional setting. That was until I decided to go to university for a bit[1]. This is where, for the first time, I met people writing bad code professionally: professors[2]. "Bad" as in best-practices, the code usually worked. I've also seen research projects that managed to turn less than 1k LOC of python into a barely-maintainable mess[3]. I'll put my faith in an autodidact who had to prove themselves with skills and accomplishments alone over someone who got through the door with a university degree. An autodidact who doesn't care about their craft is not going to make the cut, or shouldn't. If your hiring process doesn't filter those people, why are you wasting your time at a company that probably doesn't know your value? [1] Free in my country, so not a big deal to attend some lectures besides work. Well, actually I'm paying for it with my taxes, so I might as well use it. [2] To be fair, the professors teaching in actual CS subjects were alright. Most fields include a few lectures on basic coding though, which were usually beyond disappointing. The non-CS subject that had the most competent coders was mathematics. Worst was economics. Yes, I meandered through a few subjects. [3] If you do well on some test you'd usually get job offers from professors, asking you to join their research projects. I showed up to interviews out of interest in the subject matter and professors are usually happy to tell you all about it, but wages for students are fixed at the legal minimum wage, so it couldn't ever be a serious consideration for someone already working on the free market.