3 ms·

One of these days we're going to learn our lesson and just write our own damned code.

CPLX 2y ago
Bet we won’t.
hyperhopper 2y ago
Then you get to write 10x the vulnerabilities yourself and not have nearly the same chance of any of them getting disclosed to you!
- ChrisMarshallNY 2y ago
  That argument doesn't seem to be aging well. I'd say that good [emphasis on "good"] coders can write very secure code. There's fundamental stuff, like encryption algos, that should be sourced from common (well-known and trusted) sources, but when we load in 100K of JS, so we can animate a disclosure triangle, I think it might not be a bad time to consider learning to do that, ourselves.
  - vikramkr 2y ago
    It's impossible to tell how that argument is aging since we don't have the counterfactual.
- sandwitches 2y ago
  So if you can't trust your developers to manage dependencies, and you can't trust them to write dependencies... why have you hired them at all? Seriously, what do they actually do? Hire people who can program, it isn't hard.
kelsey98765431 2y ago
One has to admit the game of cat and mouse that the web browser brought about has been quite valuable for advancing security as a field, unfortunately this sort of thing seems like we have to get burned to learn the pan is hot and mother warning us is not enough. Pay your security teams more, people.
- mulmen 2y ago
  Security is everyone’s job. You can’t outsource responsibility. The security tram should be compensated fairly but they should also be trusted within the organization. If you want to build secure software then realign incentives. There’s more to that than pay.
  - emporas 2y ago
    > Security is everyone’s job. Agree. There is something missing from the internet, and that is "Programmer Citizenship". As soon as someone pushes code to a repo, he has to prove his citizenship first, the good old fashioned way by handing his identity to the owner of the repo. His digital identity of course. As long as the identity is real, and is associated with a clean reputation, then code can be accepted with very little risk. When the reputation might not be so great, then new code has to be double checked before any merge into main.
- emporas 2y ago
  > One has to admit the game of cat and mouse that the web browser brought about Supply chain attacks can affect any toolchain, command line tools, games, everything under the sun.
echoangle 2y ago
Or just use subresource integrity
- stevenpetryk 2y ago
  Subresource integrity wouldn't work with Polyfill.io scripts, since they dynamically changed based on user agent.
AndyMcConachie 2y ago
How hard is it to download your includes and host them on your own domain? I know sometimes it's not possible, but whenever I can I always do this. If only because it means that if the remote version changes to a new version it doesn't break my code.
creshal 2y ago
Or just ship local copies of your dependencies. It's not that hard.
- commandlinefan 2y ago
  ... and all of _their_ dependencies. And read through them all to make sure that the local copy that you shipped didn't actually include a deliberately obfuscated exfiltration routine.
felideon 2y ago
We won't, as can be seen by everyone recommending having an LLM write your code.
dvngnt_ 2y ago
yeah let me just write an entire operating system to create a to-do list app
- sandwitches 2y ago
  Fortunately, people have already designed an operating system for you. You can either use it, or embed six more half-assed versions into a web browser and then ship that instead. Up to you.
sandwitches 2y ago
Some of us already have learned that lesson. Imagine how it feels to have to watch the same people touch the same hot stove over and over again. And people wonder why programmers quit and go into farming...
deleted 2y ago
[deleted]

CPLX 2y ago

Bet we won’t.

Then you get to write 10x the vulnerabilities yourself and not have nearly the same chance of any of them getting disclosed to you!

ChrisMarshallNY 2y ago
That argument doesn't seem to be aging well. I'd say that good [emphasis on "good"] coders can write very secure code. There's fundamental stuff, like encryption algos, that should be sourced from common (well-known and trusted) sources, but when we load in 100K of JS, so we can animate a disclosure triangle, I think it might not be a bad time to consider learning to do that, ourselves.
- vikramkr 2y ago
  It's impossible to tell how that argument is aging since we don't have the counterfactual.
sandwitches 2y ago
So if you can't trust your developers to manage dependencies, and you can't trust them to write dependencies... why have you hired them at all? Seriously, what do they actually do? Hire people who can program, it isn't hard.

kelsey98765431 2y ago

One has to admit the game of cat and mouse that the web browser brought about has been quite valuable for advancing security as a field, unfortunately this sort of thing seems like we have to get burned to learn the pan is hot and mother warning us is not enough. Pay your security teams more, people.

mulmen 2y ago
Security is everyone’s job. You can’t outsource responsibility. The security tram should be compensated fairly but they should also be trusted within the organization. If you want to build secure software then realign incentives. There’s more to that than pay.
- emporas 2y ago
  > Security is everyone’s job. Agree. There is something missing from the internet, and that is "Programmer Citizenship". As soon as someone pushes code to a repo, he has to prove his citizenship first, the good old fashioned way by handing his identity to the owner of the repo. His digital identity of course. As long as the identity is real, and is associated with a clean reputation, then code can be accepted with very little risk. When the reputation might not be so great, then new code has to be double checked before any merge into main.
emporas 2y ago
> One has to admit the game of cat and mouse that the web browser brought about Supply chain attacks can affect any toolchain, command line tools, games, everything under the sun.

echoangle 2y ago

Or just use subresource integrity

stevenpetryk 2y ago
Subresource integrity wouldn't work with Polyfill.io scripts, since they dynamically changed based on user agent.

AndyMcConachie 2y ago

How hard is it to download your includes and host them on your own domain? I know sometimes it's not possible, but whenever I can I always do this. If only because it means that if the remote version changes to a new version it doesn't break my code.

creshal 2y ago

Or just ship local copies of your dependencies. It's not that hard.

commandlinefan 2y ago
... and all of _their_ dependencies. And read through them all to make sure that the local copy that you shipped didn't actually include a deliberately obfuscated exfiltration routine.

felideon 2y ago

We won't, as can be seen by everyone recommending having an LLM write your code.

dvngnt_ 2y ago

yeah let me just write an entire operating system to create a to-do list app

sandwitches 2y ago
Fortunately, people have already designed an operating system for you. You can either use it, or embed six more half-assed versions into a web browser and then ship that instead. Up to you.

sandwitches 2y ago

Some of us already have learned that lesson. Imagine how it feels to have to watch the same people touch the same hot stove over and over again. And people wonder why programmers quit and go into farming...

deleted 2y ago

[deleted]