5 ms·

As a security guy, for years, you get laughed out of the room suggesting devs limit their dependencies and don't download half of the internet while building. Y

by wvh 1y ago

As a security guy, for years, you get laughed out of the room suggesting devs limit their dependencies and don't download half of the internet while building. You are an obstruction for making profit. And obviously reading the code does very little since modern (and especially Javascript) code just glues together frameworks and libraries, and there's no way a single human being is going to read a couple million lines of code. There are no real solutions to the problem, except for reducing exposure somewhat by limiting yourself to a mostly frozen subset of packages that are hopefully vetted more stringently by more people.

mgaunard 1y ago
I've always been very careful about dependencies, and freezing them to versions that are known to work well. I was shocked when I found out that at some of the most profitable shops, most of their code is just a bunch of different third-party libraries badly cobbled together, with only a superficial understanding of how those libraries work.
p0w3n3d 1y ago
> You are an obstruction for making profit. This explains a lot. Really, this is the great reason of why the society is collapsing as we speak. "There should be no DRM in phones" - "You Are An Obstruction To Making Profit". "People should own their devices, we must not disallow custom software on it" - "YAAOTMP" "sir, the application will weigh 2G and do almost nothing yet, should we minify it or use different framework?" - "YAAOTMP". "Madame, this product will cost too much and require unnecessary payments" - "YAAOTMP" Etc. etc. Like in this "Silicon Valley" comedy series. But for real, and affecting us greatly.
- ivan_gammel 1y ago
  Death comes to corp CEO, he screams YAAOTMP, death leaves shocked. Startup CEO watches the scene. His jedi sword turns from blue to red.
jen729w 1y ago
At my previous enterprise we had a saying: Security: we put the ‘no’ in ‘innovation’.
999900000999 1y ago
The "solution" would be using a language with a strong standard library and then having a trusted 3rd party manually audit any approved packages. THEN use artifactory on top of that. That's boring and slow though. Whatever I want my packages and I want them now. Apart of the issue is the whole industry is built upon goodwill and hope. Some 19 year old hacked together a new front end framework last week, better use it in prod because why not. Occasionally I want to turn off my brain and just buy some shoes. The Timberland website made that nearly impossible last week. When I gave up on logging in for free shipping and just paid full price, I get an email a few days later saying they ran out of shoes. Alright. I guess Amazon is dominant for a reason.
- silverliver 1y ago
  This is the right answer. I'm willing to stick my head out and assert that languages with a "minimal" standard library are defective by design. The argument of APIs being stuck is mood with approaches like Rust's epocs or "strict mode". Standard libraries should include everything needed to interact with modern systems. This means HTTP parsing, HTTP requests, and JSON parsing. Some laguages are excellent (like python), while some are half way there (like go), and some are just broken (Rust). External libraries are for niche or specialized functionality. External libraries are not for functionality that is used by most modern software. To put your head in the ground and insist otherwise is madness and will lead to ridiculous outcomes like this.
  - CaptainOfCoit 1y ago
    > External libraries are not for functionality that is used by most modern software. Where do you draw the line though? It seems like you mostly spend your time writing HTTP servers reading/writing JSON, but is that what everyone else also spends their time doing? You'll end up with a standard library weighing GBs, just because "most developers write HTTP servers", which doesn't sound like a better solution. I'm willing to stick my head the other way, and say I think the languages today are too large. Instead, they should have a smaller core, and the language designed in a way that you can extend the language via libraries. Basically more languages should be inspired by Lisps and everything should be a library.
epage 1y ago
This comes across as not being self-aware as to why security as laughed out of rooms: I read this as you correctly identifying some risks and said only offered the false-dichotomouy of solutions of "risk" and "no risk" without talking middle grounds between the two or finding third-ways that break the dichotomy. I could just be projecting my own bad experiences with "security" folks (in quotes as I can't speak to their qualifications). My other big gripe is when they don't recongnize UX as a vital part of security (if their solution is unsuable, it won't be used).
- romaniv 1y ago
  I've been a web developer for over two decades. I have specific well-tested solutions for avoiding external JS dependencies. Despite that, I have the exact same experience as the above security guy. Most developers love adding dependencies.
  - pingust1 1y ago
    [dead]
- bongodongobob 1y ago
  This is how our security lead is. "I've identified X as a vulnerability, recommended remediation is to remove it." "We literally can't." He pokes around finding obscure vulnerabilities and recommends removing business critical software, yet we don't have MFA, our servers and networking UIs are on the main VLAN accessable by anyone, we have no tools to patch third party software, and all of our root passwords are the same. We bring real security concerns to him like this, and they just get backlogged because his stupid tools he runs only detect software vulns. It's insanity.
CerebralCerb 1y ago
The post you replied to suggested a real solution to the problem. It was implemented in my current org years ago (after log4j) and we have not been affected by any of the malware dependencies that has happened since.
user34283 1y ago
Your proposed solution does not work for web applications built with node packages. Essentials tools such as Jest add 300 packages on their own. You already have hundreds to thousands of packages installed, fretting over a few more for that DatePicker or something is pretty much a waste of time.
awaythrow999 1y ago
Agree on the only solution being reducing dependencies. Even more weird in the EU where things like Cyber Resilience Act mandate patching publicly known vulnerabilities. Cool, so let's just stay up2date? Supply-chain vuln goes Brrrrrr
ozim 1y ago
Package registries should step up. They are doing some stuff but still NPM could do more.

by wvh 1y ago

mgaunard 1y ago

I've always been very careful about dependencies, and freezing them to versions that are known to work well. I was shocked when I found out that at some of the most profitable shops, most of their code is just a bunch of different third-party libraries badly cobbled together, with only a superficial understanding of how those libraries work.

p0w3n3d 1y ago

> You are an obstruction for making profit. This explains a lot. Really, this is the great reason of why the society is collapsing as we speak. "There should be no DRM in phones" - "You Are An Obstruction To Making Profit". "People should own their devices, we must not disallow custom software on it" - "YAAOTMP" "sir, the application will weigh 2G and do almost nothing yet, should we minify it or use different framework?" - "YAAOTMP". "Madame, this product will cost too much and require unnecessary payments" - "YAAOTMP" Etc. etc. Like in this "Silicon Valley" comedy series. But for real, and affecting us greatly.

ivan_gammel 1y ago
Death comes to corp CEO, he screams YAAOTMP, death leaves shocked. Startup CEO watches the scene. His jedi sword turns from blue to red.

jen729w 1y ago

At my previous enterprise we had a saying: Security: we put the ‘no’ in ‘innovation’.

999900000999 1y ago

The "solution" would be using a language with a strong standard library and then having a trusted 3rd party manually audit any approved packages. THEN use artifactory on top of that. That's boring and slow though. Whatever I want my packages and I want them now. Apart of the issue is the whole industry is built upon goodwill and hope. Some 19 year old hacked together a new front end framework last week, better use it in prod because why not. Occasionally I want to turn off my brain and just buy some shoes. The Timberland website made that nearly impossible last week. When I gave up on logging in for free shipping and just paid full price, I get an email a few days later saying they ran out of shoes. Alright. I guess Amazon is dominant for a reason.

silverliver 1y ago
This is the right answer. I'm willing to stick my head out and assert that languages with a "minimal" standard library are defective by design. The argument of APIs being stuck is mood with approaches like Rust's epocs or "strict mode". Standard libraries should include everything needed to interact with modern systems. This means HTTP parsing, HTTP requests, and JSON parsing. Some laguages are excellent (like python), while some are half way there (like go), and some are just broken (Rust). External libraries are for niche or specialized functionality. External libraries are not for functionality that is used by most modern software. To put your head in the ground and insist otherwise is madness and will lead to ridiculous outcomes like this.
- CaptainOfCoit 1y ago
  > External libraries are not for functionality that is used by most modern software. Where do you draw the line though? It seems like you mostly spend your time writing HTTP servers reading/writing JSON, but is that what everyone else also spends their time doing? You'll end up with a standard library weighing GBs, just because "most developers write HTTP servers", which doesn't sound like a better solution. I'm willing to stick my head the other way, and say I think the languages today are too large. Instead, they should have a smaller core, and the language designed in a way that you can extend the language via libraries. Basically more languages should be inspired by Lisps and everything should be a library.

epage 1y ago

This comes across as not being self-aware as to why security as laughed out of rooms: I read this as you correctly identifying some risks and said only offered the false-dichotomouy of solutions of "risk" and "no risk" without talking middle grounds between the two or finding third-ways that break the dichotomy. I could just be projecting my own bad experiences with "security" folks (in quotes as I can't speak to their qualifications). My other big gripe is when they don't recongnize UX as a vital part of security (if their solution is unsuable, it won't be used).

romaniv 1y ago
I've been a web developer for over two decades. I have specific well-tested solutions for avoiding external JS dependencies. Despite that, I have the exact same experience as the above security guy. Most developers love adding dependencies.
- pingust1 1y ago
  [dead]
bongodongobob 1y ago
This is how our security lead is. "I've identified X as a vulnerability, recommended remediation is to remove it." "We literally can't." He pokes around finding obscure vulnerabilities and recommends removing business critical software, yet we don't have MFA, our servers and networking UIs are on the main VLAN accessable by anyone, we have no tools to patch third party software, and all of our root passwords are the same. We bring real security concerns to him like this, and they just get backlogged because his stupid tools he runs only detect software vulns. It's insanity.

CerebralCerb 1y ago

The post you replied to suggested a real solution to the problem. It was implemented in my current org years ago (after log4j) and we have not been affected by any of the malware dependencies that has happened since.

user34283 1y ago

Your proposed solution does not work for web applications built with node packages. Essentials tools such as Jest add 300 packages on their own. You already have hundreds to thousands of packages installed, fretting over a few more for that DatePicker or something is pretty much a waste of time.

awaythrow999 1y ago

Agree on the only solution being reducing dependencies. Even more weird in the EU where things like Cyber Resilience Act mandate patching publicly known vulnerabilities. Cool, so let's just stay up2date? Supply-chain vuln goes Brrrrrr

ozim 1y ago

Package registries should step up. They are doing some stuff but still NPM could do more.