5 ms·

> The tools we use to build software are not secure by default, and almost all of the time, the companies that provide them are not held to account for the secu

• mococa 1y ago
  This.
• austin-cheney 1y ago
  [flagged]
  • pavel_lishin 1y ago
    > Consider how many JavaScript developers are completely unemployable without that free software. Can you say more about this?
    • austin-cheney 1y ago
      [flagged]
      • tcoff91 1y ago
        I think that ultimately it’s the fault of the web platform. With just a bit of retraining those engineers that could not be productive without a ton of npm packages could ship an iPhone app written in Swift. JS’ standard library is abysmal.
        • austin-cheney 1y ago
          This sounds like blaming the victim. How do you on one hand call these people engineers, as if they are engineering something, and then on the other hand blame everything else for their inability to perform? That is weird. Its just a software platform. Would you really blame society for being too harsh if doctors, lawyers, police, teachers cannot do their jobs? It is weird to see so many people blame the web platform for hostility when its so much less challenging than it used to be. The most common cause of these frustrations I encountered while working in JavaScript is that developers are educated in something that looks like A, but JavaScript is not A, there is no training for JavaScript/Web, so therefore JavaScript/Web is hostile. As a self-taught developer that never made sense to me.
          • marcosdumay 1y ago
            I dunno. Would you blame doctors if they were unable to perform in a single hospital and had a verifiably good track record anywhere else?
            • jlaternman 1y ago
              If in the other hospitals they were able to rely on the expertise of others, but in that single hospital they could not hide their lack of deep knowledge and that led to deaths? I think the answer of that analogy is obvious—though I realise it is an analogy, not directly comparable.
          • tcoff91 1y ago
            The web is not an application platform, it’s a document rendering platform that has been hacked together to be an application platform. Without libraries it’s incredibly hard to be productive building applications. It’s only with dependencies that the web becomes an acceptable application platform. Look at how much JS it takes to implement a material-ui textfield that automatically grows and shrinks. Building a date picker is a pain in the ass. Making sure those things follow all the arcane aria standards to be accessible is difficult. There’s no good reason why everyone should have to rebuild their own date picker. Without libraries the web is the hardest application platform to use by far if you are trying to build actual apps and not just websites with content.
            • austin-cheney 1y ago
              > Look at how much JS it takes to implement a material-ui textfield that automatically grows and shrinks. I would do that with CSS. > Building a date picker is a pain in the ass. Making sure those things follow all the arcane aria standards to be accessible is difficult. If you want to display a visual calendar then yes, mostly. However, if instead you make date picking relative to now then it becomes very simple. It’s just adding or subtracting numbers from Date.now(). You can even produce date spans super easily. I understand where you are going. When everything starts from a visual UI perspective the code is just an implementation detail except that it’s dense. If instead you start at from the implementation perspective of how it really works at the lowest level then everything just appears step by step. Nobody starts building beautiful skyscrapers from the visual exterior first. No, they lay the foundation, a boring slab of concrete around some grounding poles.
      • pavel_lishin 1y ago
        I mean, you're right about that - but how many construction workers could build a house without having access to pre-cut lumber, pre-sharpened tools, nailguns, power equipment, pre-cast nails, etc., etc?
        • austin-cheney 1y ago
          My neighbor works construction and my son did for a while. They were working on the new Texas Instruments silicon prefab. The people that do the actual work with their hands are expected to do just about everything. We are talking about advanced metal work in a place with liquid nitrogen and harmful chemical agents. The actual engineers just walk around to validate the work conforms to the written plans. That is why these large engineering companies prefer to hire only from labor unions in a location that is extremely anti-union, because the union has the social resources to validate the candidates in ways the employer does not. Even in that environment there are more experienced people who are 10x producers.
          • em-bee 1y ago
            that's an interesting point about unions in the US. if true. because in europe (at least in austria and germany, but i suspect it's the case in most countries) unions do not do any validation of their members. having a job in an industry IS your validation to be a union member. the union then negotiates work conditions and pay on your behalf. figuring out whether you are qualified is the companies job.
    • user34283 1y ago
      It boils down to him feeling superior to web developers, who are far beneath him and couldn't possibly program with other tools.
      • austin-cheney 1y ago
        Actually, its the opposite. When you are no longer compatible to the workforce because you don't want waste all your time on the same basic literacy things over and over you start to feel extremely inferior when you cannot get a job. But the fact the concerns of superiority come up so repeatedly just serves to illustrate how much insecurity is baked into the workforce. Confident people don’t worry about high confidence in other people.
• giantg2 1y ago
  I remember joining my company right out of college. In the interview we started talking about open source since I had some open source Android apps. I asked if the company contributed back to the projects it used. The answer was no, but that they were planning to. Over a decade later... they finally created a policy to allow commits to open source projects. It's been used maybe 3 times in it's first year or so. Nobody has the time and the management culture doesnt want to waste budget on it.
  • rkagerer 1y ago
    That's such a self-harmful policy. I have a small business and I've been really supportive to both open source and small, paid-for commercial libraries and building blocks that I rely on. Also advocated this successfully at clients I've consulted with. We do a lot of technical vetting before adopting any particular dependency (vs. building out our own) and it just makes sense that we strive to foster the continued existence and excellence of our tools. Considering the incredible value companies get from open source, I have trouble understanding why they wouldn't throw some cash or idle cycles their way. Seemed to work out for the likes of Google while they were undergoing rapid growth.
  • MrGilbert 1y ago
    > Nobody has the time I'd erase that part entirely, as it is not true, from my point of view. My day, as has every other person's day, has exactly 24 hours. As an employee, part of that time is dedicated to my employer. In return, I receive financial compensation. It's up to them to decide how they want to spend the resources they acquired. So yes, each and every company could, in theory, contribute back to Open Source. But as there is no price tag attached to Open Source, there is also no incentive. In a highly capitalized world, where share holder value is more worth than anything else, there are only a few companies that do the right call and act responsible.
    • watwut 1y ago
      > In a highly capitalized world, where share holder value is more worth than anything else, there are only a few companies that do the right call and act responsible. It is not just that. In a well functioning theoretical free market, no one is going to have time either. The margins are supposed to end up being tight and the competition is supposed to weed out economic inefficiency. Voluntary pro-social behavior is a competitive disadvantage and an economic inefficiency. So, by design, the companies end up not "having time for that". You need a world that allows for inefficiency and rewards pro-social behavior. That is not the world where we are living in currently.
• watwut 1y ago
  Per survey I read, majority of open source is created by people who are paid for it. The unpaid volunteer working full time on something is effectively a myth.
  • clbrmbr 1y ago
    It depends on the domain. There are a lot of critical utilities in the systems space maintained by volunteers. The “xz” compression library was one recent infamous example where an exhausted volunteer maintainer was social engineered into a supply chain attack that briefly compromised OpenSSH. Not a lot of applications being maintained by altruists, but look under the hood in Linux/GNU/BSD and you fill find a lot of volunteers motivated by something other than money.
    • izacus 1y ago
      Yes, but even in those domains those projects are minorities and in many examples they make it effectively impossible to legally fund or contribute to them from the side of corporations.
      • xrisk 1y ago
        Yeah I’m not buying it. If the corporations wanted to, they would.
        • clbrmbr 1y ago
          As soon as you have more than one shareholder, unless it’s in your charter to support OSS, you need some justification. Corporations only “want” to make a profit unless they have another explicit mission at the highest level of governance.
      • graemep 1y ago
        Why is it legally impossible to fund or contribute? Do they turn down contributions from paid developers? Do they refuse donations or just have no no mechanism for accepting them? Do they not have any form of commercial services or licence? I think there are very few projects that do not accept support in any form.
• ricardobeat 1y ago
  I find this perspective harmful to OSS as a whole. It is completely fine to release free software that other companies can use without restrictions, if you desire to do so. It is not meant to be a transaction. You share some, you take some. It’s also ok to release paid free software, or closed software, restrictive licenses, commercial licenses, and sell support contracts. It’s a choice.
  • sarchertech 1y ago
    Just because you can do something doesn’t mean you should. There’s also lot of pressure for devs not to use licenses that restrict use by large companies. Try adding something to your license that says companies making over $10 million per year in revenue have to pay, and half of the comments on show HN will be open source warriors either asking why you didn’t use a standard license or telling you that this isn’t open source and you have brought dishonor to your family.
    • ricardobeat 1y ago
      > Just because you can do something doesn’t mean you should. This implies some kind of fairness/moral contract in a license like MIT. There is none. It’s the closest thing to donating code to the public domain, and entirely voluntary. There are plenty of standard licenses with similar clauses restricting commercial use, no need to create a custom one. But indeed, the truth is that a restrictive license will massively reduce the project’s audience. And that is a perfectly fine choice to make.
      • sarchertech 1y ago
        > This implies some kind of fairness/moral contract in a license like MIT. The license tells you what you are legally allowed to do. It doesn’t supersede basic concepts of fairness. The average person would say that if you directly make millions of someone else’s work, the fair thing to do is to pay that person back in some way. Calling someone a leech is just saying that they aren’t following the the accusers model of fairness. That’s all. There’s no legal definition. We say things like “my company screwed me over when they fired me right before my RSUs vested” despite that being perfectly legal.
• tcoff91 1y ago
  20 of the packages were from Crowdstrike
  • JanneVee 1y ago
    I'm dumbstruck that Crowstrike exists with George Kurtz still at the helm. There is no accountability at all. Kurtz was CTO of McAfee when their update caused back in 2010. Why does these things keep following him?
• grafmax 1y ago
  Technology is insecure all the way down to the hardware. The structural cause of this is that companies aren’t held liable for insecure products, which are cheaper to build. So companies’ profit motives contribute to this mess not just through the exploitation of open source labor (as you describe) but through externalizing security costs as well.
  • stingraycharles 1y ago
    Isn’t all this stuff with Secure Enclave supposed to address these kind of things? It’s my take that over the past ~ decade a lot of these companies have been making things a lot better, Windows even requires secure boot these days as well.
    • snickerdoodle14 1y ago
      Not really, those technologies are basically designed to be able to enforce DRM remotely. Secure Enclave = store the encryption keys to media in a place where you can't get them Secure Boot = first step towards remote attestation so they can remotely verify you haven't modified your system to bypass the above Advertising rules the world.
      • brookst 1y ago
        How is that different? Is there such a thing as secure hardware that can prevent supply chain attacks (by enabling higher layers to guarantee security) and secure hardware that prevents copying data (by enabling higher layers to guarantee security)?
        • snickerdoodle14 1y ago
          Sure. Malware tends not to have physical hands that can touch the machine and any buttons attached to it. Physical ownership should be true ownership, but they're taking that away from you.
    • acdha 1y ago
• theknarf 1y ago
  Npm is owned by Github, which is owned by Microsoft. They could have put more tooling into making npm better. For example; pnpm require you to "approve-builds" so that its only running scripts from dependencies you decide on, and Deno have a bunch of security capabilities to restrict what scripts can and can't do. There is always going to be supply chain attacks, and the biggest package repositories are going to be hit the most. But that doesn't mean that Microsoft couldn't have spent more on building better tooling with better security settings on by default.
• tanepiper 1y ago
  Author of the article here - holistically this isn't just about NPM dependencies, it's the entire stacks we work with. Cloud vendors provide security, but out of the box they don't provide secure platforms - a lot of this is left up to developers, without security experts - this is dangerous - I have 25 years of experience and I wouldn't want to touch the depths of RBAC. SaaS products don't enforce good security - I've seen some internally that don't have MFA or EntraID integration because they simply don't have those as features (mostly legacy systems these days, but they still exist). I'm also an open-source author (I have the most used bit.ly library on npm - and have had demands and requests too), and I'm the only person you can publicly see on our [company github](https://github.com/ikea https://github.com/ikea) - there's reasons for this - but not every company is leeching, rather there is simply no other alternative.
  • ants_everywhere 1y ago
    > Cloud vendors provide security, but out of the box they don't provide secure platforms - a lot of this is left up to developers, without security experts - A lot of the spread of Shai-Hulud is due to s having overly broad credentials on NPM, GitHub and elsewhere. It's not that NPM doesn't support scoped credentials, it's that developers don't want to deal with it so it's not the default. There's no reason why, for example, a developer needs a live credential to publish their package when they're just hacking on code. This is related to the `curl | bash` pattern. Projects like NPM want to make it easy to get started and hard to reach a failure case so they sacrifice well-known security practices during the growth phase.
    • pixl97 1y ago
      I mean quite often access based errors are very opaque, I mean it is for good reason, but when you're new to something it's one of those things that leads you to give up. You want to write code, not spend 3 hours figuring out why your token doesn't work. Security things will get hacked on later, but again it will cause all kinds of problems because the ecosystem wasn't built for it.
      • 1y ago
• ants_everywhere 1y ago
  > More like the unpaid open source community volunteers who the Fortune 500 leech off contributing nothing in return except demands for free support, fixes and more features. People who work on permissively licensed software are donating their time to these Fortune 500 companies. It hardly seems fair to call the companies leeches for accepting these freely given donations.
  • JensRantil 1y ago
    It's not just time. A lot of devs simply don't have the experience of dogging into third party sourcing code or understanding how one contributed to open source.
    • ants_everywhere 1y ago
      By "a lot of devs" do you mean devs at these companies? If so I think this is a good point. It's easy to see from any one open source project's perspective how a little help would go a long way. But it's really hard to see from the perspective of a company with a massive code base how you could possibly contribute to the ten gajillion dependencies you use, even if you wanted to. People will say things like "Why doesn't Foo company contribute when they have the resources?" But from what I've seen, the engineers at Foo would often love to contribute, but no team has the headcount to do it. And acquiring the headcount would require making a case to management that contributing to that open source project is worth the cost of devoting a team to it.
      • trolleski 1y ago
        jUsT uSE AI, dUh?
      • em-bee 1y ago
        it's really hard to see from the perspective of a company with a massive code base how you could possibly contribute to the ten gajillion dependencies you use, even if you wanted to counterpoint: you don't need to actively contribute to all upstream projects, but you do need to be prepared to maintain, fix, or replace any dependency you have. if you can't do that, you should pay someone to do it. if you can't do that either then you should not be using the dependency in the first place. yes, it can happen that you underestimate the resources needed for that, or that a project you use looked very stable and supported, but suddenly you can't find anyone who has the knowledge to fix the issue you have, but then that's simply bad luck. it can happen with company backed projects too. you need to deal with that. have no sympathy if you can't.
• raisaguys 1y ago
  [flagged]
• keybored 1y ago
  Fool me once, shame on you. Fool me repeatedly again and again, then?
• psunavy03 1y ago
  Well? If you license software the way most FOSS products are licensed, that's a natural result. It is literally putting up a sign saying "free beer." You can't give permission for them to use the stuff for free and then accuse them of "leeching." If the expectation is contribution in kind, that needs to be in the license agreement.
• thayne 1y ago
  In the case of npm though it is run by a very wealthy company: Microsoft. But also, most OSS Software is provided without warranty. Commercial companies should either be held accountable for ensuring the open source components are secure or paying someone (either the maintainer directly, or a third party distributor) to verify the security of the component.