3 ms·
Whats the most full proof way of defending ourselves from such attacks? My opinion is that the applications should never deal with credentials at all. Sidecars
by vedhant 10mo ago
Whats the most full proof way of defending ourselves from such attacks? My opinion is that the applications should never deal with credentials at all. Sidecars can be run which can inject credentials in real time. These sidecars can be under tight surveillance against such attacks. After all, application code is the most volatile in an organization.
- lesuorac 10mo agoTo me this is asking the question of "what's the safest way to drink from a polluted river". The answer is really, don't. NPM and the JS eco-system has really gone down a path of zero security and they're paying the price for it. If you really need libraries from NPM and whatnot, vendorize them so you're relying on known-safe files and don't arbitrarily update them without re-verification.
- vedhant 10mo agoThis is true. Today its npm, tomorrow it could be some other language. Shouldnt we focus on solving it at the root?
- samdoesnothing 10mo agoSome of us need to drink from the river to eat :(