4 ms·

One of the things I love about the internet is learning how different people can be, I perceive it as different than me but I assume everyone has their quirks.

One of the things I love about the internet is learning how different people can be, I perceive it as different than me but I assume everyone has their quirks. In this case, this is one of the most extreme instances of people installing lots of dependencies. The moment I realized something was different in me was left pad, I already felt that couldn't be me. The log4j incident hit me different, it COULD have easily been me. A security vulnerability is like death or a terminal illness in my eyes. Successful companies that scale do so without incidents, If you are running a company and you have a vuln you are out of the race. So I tightened up a lot after that. I realize something similar with sex I just can't fathom putting my whole life on the line just to have sex with somebody and then have nothing to show for it, no relationship, nothing. And today we see this, people are really risking their companies, their reputation, their pride to have pretty colors on their IDE. I used to fight it, try to convince people, of course I still keep the pride of being different and weary, but in the end, you will likely be fine, and I only hold a statistical advantage, both are valid strategies of going about life I guess.

wizzwizz4 2y ago
> The log4j incident hit me different, it COULD have easily been me. That couldn't be me, because I don't use Java, PHP, Windows APIs, or `xdg-open`. The closest I come to Java-esque "include ALL THE BATTERIES" is the occasional Python script, but I won't use `http.server`. (Incidentally, I don't get very much done.)
- TZubiri 2y ago
  > (Incidentally, I don't get very much done.) Lol, that's definitely part of the tradeoff of security in life. > I don't use Java I didn't use Java either, but whatever I was using at the moment (Python) could have been anything, if I stayed in my other job or gotten a different one I could very well been using Java and been the one that installed the thing. >Python script, but I won't use `http.server`. (Incidentally, I don't get very much done.) Interesting, I use http.server or the Tcp socket server thing, but I consider myself to be in the extreme, there's still people that use Flask (and I do partake ocasionally) or things like Django, Spring, Next,etc... Same with binaries like Apache, Nginx. I mean you gotta use something, and if you go too far on the deep end, you get the risk of introducing the vulnerabilities yourself, (in addition to the risk of getting nothing done as you mentioned). I know my limits I wouldn't implement cryptography for example.
  - wizzwizz4 2y ago
    I consider it safe to use ASGI / Uvicorn or (if you're careful about which extensions you install) Django. Python has fewer, less-prominent built-in footguns than Java, so even though it's less secure in principle, it's easier to write / audit for security in practice. Not getting very much done isn't because I practice secure software development. It's easy to write secure software that works. I don't get much done because I try to find new ways to write secure software: experimentation and tool-building takes up a lot of my time, when I should really be writing hacks, documenting them, and moving on. Never roll your own crypto, unless you understand systems programming on that platform/arch very well: modern systems have all the side-channels, and take great pains to subvert your attempts to mitigate them.
Cthulhu_ 2y ago
A theme is fine - Google has been pushing Material for a while now, after all, so if you come from Google land the colours are familiar and preferred to you, same with themes like Solarized and whatnot. That said, I do agree that dependency management and reliance is a Problem these days. left-pad was the camel that broke the proverbial camel's back for many people, and it made people realise how ridiculous dependencies in at least NodeJS land has become. It was already silly in Java land since the 2000s, but more from the layers of abstraction and overhead that frameworks like Spring add (which is ironic because Spring was originally conceived to be a lightweight alternative to J2EE, but that's a thread on its own). I know the general community atmosphere in the Go ecosystem is adverse to adding dependencies and frameworks; it has a good standard library which was complete enough and which isn't yet fully bogged down by design by committee like Java and JS were (to their credit things are moving again), and its users are like "you know, plain Go is good enough", so they are much less likely to add frameworks or DSLs like assertion libraries. I'd like to know if the same thing is happening in the Rust ecosystem, I've never ventured there before.
- Macha 2y ago
  It had not occurred to me that a VS Code Theme was a full blown extension, since I've never installed one. I wonder if a lot of people have a mental model of a VS Code theme as a collection of CSS files, which should be relatively safe (even including those that install them).
- Narishma 2y ago
  The same thing is happening in Rust. Try to compile any random app and it pulls dozens if not hundreds of dependencies.

wizzwizz4 2y ago

> The log4j incident hit me different, it COULD have easily been me. That couldn't be me, because I don't use Java, PHP, Windows APIs, or `xdg-open`. The closest I come to Java-esque "include ALL THE BATTERIES" is the occasional Python script, but I won't use `http.server`. (Incidentally, I don't get very much done.)

TZubiri 2y ago
> (Incidentally, I don't get very much done.) Lol, that's definitely part of the tradeoff of security in life. > I don't use Java I didn't use Java either, but whatever I was using at the moment (Python) could have been anything, if I stayed in my other job or gotten a different one I could very well been using Java and been the one that installed the thing. >Python script, but I won't use `http.server`. (Incidentally, I don't get very much done.) Interesting, I use http.server or the Tcp socket server thing, but I consider myself to be in the extreme, there's still people that use Flask (and I do partake ocasionally) or things like Django, Spring, Next,etc... Same with binaries like Apache, Nginx. I mean you gotta use something, and if you go too far on the deep end, you get the risk of introducing the vulnerabilities yourself, (in addition to the risk of getting nothing done as you mentioned). I know my limits I wouldn't implement cryptography for example.
- wizzwizz4 2y ago
  I consider it safe to use ASGI / Uvicorn or (if you're careful about which extensions you install) Django. Python has fewer, less-prominent built-in footguns than Java, so even though it's less secure in principle, it's easier to write / audit for security in practice. Not getting very much done isn't because I practice secure software development. It's easy to write secure software that works. I don't get much done because I try to find new ways to write secure software: experimentation and tool-building takes up a lot of my time, when I should really be writing hacks, documenting them, and moving on. Never roll your own crypto, unless you understand systems programming on that platform/arch very well: modern systems have all the side-channels, and take great pains to subvert your attempts to mitigate them.

Cthulhu_ 2y ago

A theme is fine - Google has been pushing Material for a while now, after all, so if you come from Google land the colours are familiar and preferred to you, same with themes like Solarized and whatnot. That said, I do agree that dependency management and reliance is a Problem these days. left-pad was the camel that broke the proverbial camel's back for many people, and it made people realise how ridiculous dependencies in at least NodeJS land has become. It was already silly in Java land since the 2000s, but more from the layers of abstraction and overhead that frameworks like Spring add (which is ironic because Spring was originally conceived to be a lightweight alternative to J2EE, but that's a thread on its own). I know the general community atmosphere in the Go ecosystem is adverse to adding dependencies and frameworks; it has a good standard library which was complete enough and which isn't yet fully bogged down by design by committee like Java and JS were (to their credit things are moving again), and its users are like "you know, plain Go is good enough", so they are much less likely to add frameworks or DSLs like assertion libraries. I'd like to know if the same thing is happening in the Rust ecosystem, I've never ventured there before.

Macha 2y ago
It had not occurred to me that a VS Code Theme was a full blown extension, since I've never installed one. I wonder if a lot of people have a mental model of a VS Code theme as a collection of CSS files, which should be relatively safe (even including those that install them).
Narishma 2y ago
The same thing is happening in Rust. Try to compile any random app and it pulls dozens if not hundreds of dependencies.