12 ms·
I'd like to think there are ways to do this and keep things decentralized. Things like: Once a package has more than [threshold] daily downloads for an extende
by btown 1y ago
I'd like to think there are ways to do this and keep things decentralized.
Things like: Once a package has more than [threshold] daily downloads for an extended period of time, it requires 2FA re-auth/step-up on two separate human-controlled accounts to approve any further code updates.
Or something like: for these popular packages, only a select list of automated build systems with reproducible builds can push directly to NPM, which would mean that any malware injector would need to first compromise the source code repository. Which, to be fair, wouldn't necessarily have stopped this worm from propagating entirely, but would have slowed its progress considerably.
This isn't a "sacrifice all of NPM's DX and decentralization" question. This is "a marginally more manual DX only when you're at a scale where you should be release-managing anyways."
- noodlesUK 1y agoI think that we should impose webauthn 2fa on all npm accounts as the only acceptable auth method if you have e.g., more than 1 million total downloads. Someone could pony up the cash to send out a few thousand yubikeys for this and we'd all be a lot safer.
- thewebguyd 1y agoWhy even put a package download count on it? Just require it for everything submitted to NPM. It's not hard.
- ronsor 1y agoBecause then it's extra hassle and expense for new developers to publish a package, and we're trying to keep things decentralized.
- thewebguyd 1y agoIt's already centralized by virtue of using and relying on NPM as the registry. If we want decentralized package management for node/javascript, you need to dump NPM - why not something like Go's system which is actually decentralized? There is no package repository/registry, it's all location based imports.
- LPisGood 1y agoI don’t understand what benefits this kind of “decentralization” offers
- q3k 1y agoLarger pool of people you can hack/blackmail/coerce into giving you access to millions of systems :)
- deleted 1y ago[deleted]
- kelnos 1y agoDecentralized? This is a centralized package registry. There is nothing decentralized about it.
- jay_kyburz 1y agooh right, good point, I wonder when somebody will just sue NPM for any damage caused. That's really the only way we'll see change I think.
- LtWorf 1y agoDownload counters are completely useless. I could download your package 2 million times in under a minute and cause you to need the 2FA. And true 2FA means you can't automate publishing from github's CI. Python is going the other direction. There is a fake 2FA that is just used to generate tokens and there is a preferential channel to upload to pypi via github's CI. But in my opinion none of this helps with security. But it does help to de-anonymise the developers, which is probably what they really want to do, without caring if those developers get hacked and someone else uses their identity to do uploads.
- ForHackernews 1y agoPyPI already has this. It was a little bit annoying when they imposed stricter security on maintainers, but I can see the need.
- LtWorf 1y agoPypi did that, i got 2 google keys for free. But I used them literally once, to create a token that never expires and that is what I actually use to upload on pypi. (I did a talk at minidebconf last year in toulouse about this). If implemented like this, it's completely useless, since there is actually no 2fa at all. Anyway the idea of making libre software developers work more is a bad idea. We do it for fun. If we have to do corporate stuff we want a corporate salary to go with.
- kelnos 1y agoHow would that work for CI release flows? I have my Rust crates, for example, set up to auto-publish whenever I push a tag to its repo.
- btown 1y agoEven the simplest "any maintainer can click a push notification on their phone to verify that they want to push an update to $package" would have stopped this worm in its tracks!
- LtWorf 1y ago> two separate human-controlled accounts to approve any further code updates. Except most projects have 1 developer… Plus, if I develop some project for free I don't want to be wasting time and work for free for large rich companies. They can pay up for code reviews and similar things instead of adding burden to developers!