3 ms·

> the kind of dependency developers install without a second thought Kind of a terrifying statement, right there.

agentifysh 11mo ago
yeah i mean this is a tough problem. unless you work for a government contractor where they have strict security policies, most devs are just going to run npm install without a second thought as there are a lot of packages. i dont know what the solution here is other than stop using npm
- irishcoffee 11mo ago
  > unless you work for a government contractor where they have strict security policies ... So you're saying there is a blueprint for mitigating this already, and it just isn't followed?
  - parliament32 11mo ago
    Yes, but it requires people. Typically, you identify a package you want (or a new version of a package you want) and you send off a request to a separate security team. They analyze and approve, and the package becomes available in your internal package manager. But this means 1) you need that team of people to do that work, and 2) there's a lot of hurry-up-and-wait involved.
    - irishcoffee 11mo ago
      > Yes, but it requires people. I've heard rumor of a few 100k people laid off in tech over the past few years that might be interested.
      - ThunderSizzle 11mo ago
        Whose gonna pay for it? The companies that laid off those people? They'll just continue on without worrying.
    - bigfatkitten 11mo ago
      Doesn't even require that many people. The analysis can mostly be automated, and the request process can be handled via peer review. Having one or two people for every 100-200 developers who can give sensible advice, provide some general oversight of what's going on, and step in to say 'no' occasionally does help though. Also means you can put an end to a popular antipattern that has grown in recent years: letting your production infrastructure talk to whatever it likes to download whatever it likes from the Internet.
      - blincoln 10mo ago
        I'd be curious how many of today's automatic package validation tools or peer review processes would have caught the lotusbail package discussed in the article. The malicious aspects were heavily obfuscated, and it worked as advertised.
  - kankerlijer 11mo ago
    It's more work and more restrictive I suppose. Any business is free to set up jfrog Artifactory and only allow the installation of approved dependencies. And anyone can pull Ironbank images I believe.
    - cxr 11mo ago
      Eschewing with lockfile-based package management schemes actually takes less work. <https://news.ycombinator.com/item?id=46008744 https://news.ycombinator.com/item?id=46008744>
- miroljub 11mo ago
  The issue with npm is JS doesn't have a stdlib, so developers need to rely on npm and third party libs even for things stdlib provide in languages like Java, Python, Go, ...
  - Eduard 11mo ago
    JS has a stdlib, so to say. See nodejs, and Web standard. And no programming language's stdlib includes e. g. WhatsApp API libraries
  - josephg 11mo ago
    Sure it does. The JS standard library these days is huge. Its way bigger than C, Zig and Rust. It includes: - Random numbers - Timezones, date formatting - JSON parsing & serialization - Functional programming tools (map, filter, reduce, Object.fromEntries, etc) - TypedArrays And if you use bun or nodejs, you also have out of the box access to an HTTP server, filesystem APIs, gzip, TLS and more. And if you're working in a browser, almost everything in jquery has since been pulled into the browser too. Eg, document.querySelector. Of course, web frameworks like react aren't part of the standard library in JS. Nor should they be. What more do you want JS to include by default? What do java, python and go have in their standard libraries that JS is missing?
    - krapp 11mo ago
      When people say "js doesn't have a stdlib" they mean "js doesn't have a robust general purpose stdlib like C++ or ${LANGUAGE_ID_RATHER_BE_USING}." But of course it fucking doesn't because it's a scripting language for the web. It has what it needs, and to do that it doesn't need much.
      - josephg 11mo ago
        > When people say "js doesn't have a stdlib" they mean "js doesn't have a robust general purpose stdlib like C++ ... It does though! The JS stdlib even includes an entire wasm runtime. Its huge! Seriously. I can barely think of any features in the C++ stdlib that are missing from JS. There's a couple - like JS is missing std::priority_queue. But JS has soooo much stuff that C++ is missing. Its insane.
- josephg 11mo ago
  > i dont know what the solution here is other than stop using npm Personally I think we need to start adding capability based systems into our programming languages. Random code shouldn't have "ambient authority" to just do anything on my computer with the same privileges as me. Like, if a function has this signature: function add(a: int, b: int) -> int Then it should only be able to read its input, and return any integer it wants. But it shouldn't get ambient authority to access anything else on my computer. No network access. No filesystem. Nothing. Philosophically, I kind of think of it like function arguments and globals. If I call a function foo(someobj), then function foo is explicitly given access to someobj. And it also has access to any globals in my program. But we generally consider globals to be smelly. Passing data explicitly is better. But the whole filesystem is essentially available as a global that any function, anywhere, can access. With full user permissions. I say no. I want languages where the filesystem itself (or a subset of it) can be passed as an argument. And if a function doesn't get passed a filesystem, it can't access a filesystem. If a function isn't passed a network socket, it can't just create one out of nothing. I don't think it would be that onerous. The main function would get passed "the whole operating system" in a sense - like the filesystem and so on. And then it can pass files and sockets and whatnot to functions that need access to that stuff. If we build something like that, we should be able to build something like npm but where you don't need to trust the developers of 3rd party software so much. The current system of trusting everyone with everything is insane.
  - irishcoffee 11mo ago
    > No network access. No filesystem. Nothing. Ironically, any c++ app I've written on windows does exactly this. "Are you sure you want to allow this program to access networking?" At least the first time I run it. I also rarely write/run code for windows.
    - christophilus 11mo ago
      Yeah, but if that app was built using a malicious dependency that only relied on the same permissions the app already uses, you’d just click “Yes” and move on and be pwned.
- ____tom____ 11mo ago
  Developing in a container might mitigate a lot of issues. Harder to compromise your development machine. I guess if you ship it you are still passing along contagion
sneak 11mo ago
Every docker image specified in a k8s yml or docker-compose file or github action that doesn’t end in :sha256@<hash> (ie specifying a label) is one “docker push” away from a compromise, given that tags/labels are not cryptographically specified. You’re just trusting DockerHub and the publisher (or anyone with their creds) to not rug you. The industry runs on a lot more unexamined trust than people think. They’re deployed automatically by machine, which definitionally can’t even give it a second thought. The upstream trust is literally specified in code, to be reused constantly automatically. You could get owned in your sleep without doing anything just because a publisher got phished one day.
- OptionOfT 11mo ago
  Pinning a GitHub Actions action doesn't prevent the action itself from doing an apt install, npm install or running a Docker image that is not pinned.
- ChrisMarshallNY 11mo ago
  That's one reason I barely use any dependencies. I'm forced to use a couple, but I tend to "roll my own," quite a bit. Well, I should qualify that. I do use quite a few dependencies, but they are ones that I wrote.
  - embedding-shape 11mo ago
    Requiring the use of lockfiles and strict adherence to checking updates, also helps. I tend to use dependencies for many things, but ones I've trusted over a long time, I know how they work, often chosen because of how they were implemented, so I can see the updates and review them myself. Scaling up to a team, you make that part of the process whenever you add a new dependencies, and someone's name always have to be "assigned" to a dependency, so people take ownership of the code that gets added. Often people figure out it's not worth it, and figure out a simpler way.
    - ChrisMarshallNY 11mo ago
      That sounds like a great policy.
sublinear 11mo ago
It's also hyperbole
- josephg 11mo ago
  I've worked in plenty of javascript shops and unfortunately its not so far off the mark. Its quite common to see JS projects with thousands of transitive dependencies. I've seen the same in python too.
  - morshu9001 11mo ago
    It's funny how Py has less of this reputation just because the package manager is so broken that you might have a hard time adding so many deps in the first place. (Maybe fixed with uv, but that's relatively new and not default.)
- ChrisMarshallNY 11mo ago
  I'm not so sure about that. I've watched developers judge dependencies by GH stars, and "shiny" quotient. On a completely unrelated tangent, I remember reading about a "GH Stars as a Service" outfit. I don't see any way that could be abused, though.../s
- pixl97 10mo ago
  Until you start doing SBOM and seeing what developers are pulling out in the field.
btbuildem 11mo ago
It's terrifying because it's true for a majority of developers.

yeah i mean this is a tough problem. unless you work for a government contractor where they have strict security policies, most devs are just going to run npm install without a second thought as there are a lot of packages. i dont know what the solution here is other than stop using npm

irishcoffee 11mo ago
> unless you work for a government contractor where they have strict security policies ... So you're saying there is a blueprint for mitigating this already, and it just isn't followed?
- parliament32 11mo ago
  Yes, but it requires people. Typically, you identify a package you want (or a new version of a package you want) and you send off a request to a separate security team. They analyze and approve, and the package becomes available in your internal package manager. But this means 1) you need that team of people to do that work, and 2) there's a lot of hurry-up-and-wait involved.
  - irishcoffee 11mo ago
    > Yes, but it requires people. I've heard rumor of a few 100k people laid off in tech over the past few years that might be interested.
    - ThunderSizzle 11mo ago
      Whose gonna pay for it? The companies that laid off those people? They'll just continue on without worrying.
  - bigfatkitten 11mo ago
    Doesn't even require that many people. The analysis can mostly be automated, and the request process can be handled via peer review. Having one or two people for every 100-200 developers who can give sensible advice, provide some general oversight of what's going on, and step in to say 'no' occasionally does help though. Also means you can put an end to a popular antipattern that has grown in recent years: letting your production infrastructure talk to whatever it likes to download whatever it likes from the Internet.
    - blincoln 10mo ago
      I'd be curious how many of today's automatic package validation tools or peer review processes would have caught the lotusbail package discussed in the article. The malicious aspects were heavily obfuscated, and it worked as advertised.
- kankerlijer 11mo ago
  It's more work and more restrictive I suppose. Any business is free to set up jfrog Artifactory and only allow the installation of approved dependencies. And anyone can pull Ironbank images I believe.
  - cxr 11mo ago
    Eschewing with lockfile-based package management schemes actually takes less work. <https://news.ycombinator.com/item?id=46008744 https://news.ycombinator.com/item?id=46008744>
miroljub 11mo ago
The issue with npm is JS doesn't have a stdlib, so developers need to rely on npm and third party libs even for things stdlib provide in languages like Java, Python, Go, ...
- Eduard 11mo ago
  JS has a stdlib, so to say. See nodejs, and Web standard. And no programming language's stdlib includes e. g. WhatsApp API libraries
- josephg 11mo ago
  Sure it does. The JS standard library these days is huge. Its way bigger than C, Zig and Rust. It includes: - Random numbers - Timezones, date formatting - JSON parsing & serialization - Functional programming tools (map, filter, reduce, Object.fromEntries, etc) - TypedArrays And if you use bun or nodejs, you also have out of the box access to an HTTP server, filesystem APIs, gzip, TLS and more. And if you're working in a browser, almost everything in jquery has since been pulled into the browser too. Eg, document.querySelector. Of course, web frameworks like react aren't part of the standard library in JS. Nor should they be. What more do you want JS to include by default? What do java, python and go have in their standard libraries that JS is missing?
  - krapp 11mo ago
    When people say "js doesn't have a stdlib" they mean "js doesn't have a robust general purpose stdlib like C++ or ${LANGUAGE_ID_RATHER_BE_USING}." But of course it fucking doesn't because it's a scripting language for the web. It has what it needs, and to do that it doesn't need much.
    - josephg 11mo ago
      > When people say "js doesn't have a stdlib" they mean "js doesn't have a robust general purpose stdlib like C++ ... It does though! The JS stdlib even includes an entire wasm runtime. Its huge! Seriously. I can barely think of any features in the C++ stdlib that are missing from JS. There's a couple - like JS is missing std::priority_queue. But JS has soooo much stuff that C++ is missing. Its insane.
josephg 11mo ago
> i dont know what the solution here is other than stop using npm Personally I think we need to start adding capability based systems into our programming languages. Random code shouldn't have "ambient authority" to just do anything on my computer with the same privileges as me. Like, if a function has this signature: function add(a: int, b: int) -> int Then it should only be able to read its input, and return any integer it wants. But it shouldn't get ambient authority to access anything else on my computer. No network access. No filesystem. Nothing. Philosophically, I kind of think of it like function arguments and globals. If I call a function foo(someobj), then function foo is explicitly given access to someobj. And it also has access to any globals in my program. But we generally consider globals to be smelly. Passing data explicitly is better. But the whole filesystem is essentially available as a global that any function, anywhere, can access. With full user permissions. I say no. I want languages where the filesystem itself (or a subset of it) can be passed as an argument. And if a function doesn't get passed a filesystem, it can't access a filesystem. If a function isn't passed a network socket, it can't just create one out of nothing. I don't think it would be that onerous. The main function would get passed "the whole operating system" in a sense - like the filesystem and so on. And then it can pass files and sockets and whatnot to functions that need access to that stuff. If we build something like that, we should be able to build something like npm but where you don't need to trust the developers of 3rd party software so much. The current system of trusting everyone with everything is insane.
- irishcoffee 11mo ago
  > No network access. No filesystem. Nothing. Ironically, any c++ app I've written on windows does exactly this. "Are you sure you want to allow this program to access networking?" At least the first time I run it. I also rarely write/run code for windows.
  - christophilus 11mo ago
    Yeah, but if that app was built using a malicious dependency that only relied on the same permissions the app already uses, you’d just click “Yes” and move on and be pwned.
____tom____ 11mo ago
Developing in a container might mitigate a lot of issues. Harder to compromise your development machine. I guess if you ship it you are still passing along contagion

sneak 11mo ago

Every docker image specified in a k8s yml or docker-compose file or github action that doesn’t end in :sha256@<hash> (ie specifying a label) is one “docker push” away from a compromise, given that tags/labels are not cryptographically specified. You’re just trusting DockerHub and the publisher (or anyone with their creds) to not rug you. The industry runs on a lot more unexamined trust than people think. They’re deployed automatically by machine, which definitionally can’t even give it a second thought. The upstream trust is literally specified in code, to be reused constantly automatically. You could get owned in your sleep without doing anything just because a publisher got phished one day.

OptionOfT 11mo ago
Pinning a GitHub Actions action doesn't prevent the action itself from doing an apt install, npm install or running a Docker image that is not pinned.
ChrisMarshallNY 11mo ago
That's one reason I barely use any dependencies. I'm forced to use a couple, but I tend to "roll my own," quite a bit. Well, I should qualify that. I do use quite a few dependencies, but they are ones that I wrote.
- embedding-shape 11mo ago
  Requiring the use of lockfiles and strict adherence to checking updates, also helps. I tend to use dependencies for many things, but ones I've trusted over a long time, I know how they work, often chosen because of how they were implemented, so I can see the updates and review them myself. Scaling up to a team, you make that part of the process whenever you add a new dependencies, and someone's name always have to be "assigned" to a dependency, so people take ownership of the code that gets added. Often people figure out it's not worth it, and figure out a simpler way.
  - ChrisMarshallNY 11mo ago
    That sounds like a great policy.

sublinear 11mo ago

It's also hyperbole

josephg 11mo ago
I've worked in plenty of javascript shops and unfortunately its not so far off the mark. Its quite common to see JS projects with thousands of transitive dependencies. I've seen the same in python too.
- morshu9001 11mo ago
  It's funny how Py has less of this reputation just because the package manager is so broken that you might have a hard time adding so many deps in the first place. (Maybe fixed with uv, but that's relatively new and not default.)
ChrisMarshallNY 11mo ago
I'm not so sure about that. I've watched developers judge dependencies by GH stars, and "shiny" quotient. On a completely unrelated tangent, I remember reading about a "GH Stars as a Service" outfit. I don't see any way that could be abused, though.../s
pixl97 10mo ago
Until you start doing SBOM and seeing what developers are pulling out in the field.

btbuildem 11mo ago

It's terrifying because it's true for a majority of developers.