3 ms·
Not to beat a dead horse but I see this again and again with dependencies. Each time I get more worried that the same will happen with rust. I understand the fa
by vsgherzi 7mo ago
Not to beat a dead horse but I see this again and again with dependencies. Each time I get more worried that the same will happen with rust. I understand the fat std library approach won’t work but I really still want a good solution where I can trust packages to be safe and high quality.
- rectang 7mo agoHosting curated dependencies is a commercially valuable service. Eventually an economy arises where people pay vendors to vet packages.
- tankenmate 7mo agoIt already exists; cloudsmith
- goodpoint 7mo agoIt's what linux distributions do.
- anthk 7mo agoLinux distros and BSD ports did that since the 90's. When Linux distros had barely a PM or just tarballs, Infomagic sold 4 CD full of libre software. When I had no internet at home, back in the day I bought 3 DVD's of Debian Sarge for 20 euros, about $20. A bargain, it was the price of a hard-cover best seller book. GB's of libre software, graphical install, 2.6 kernel, KDE3 desktop, very light on my Athlon 2000 with 256MB of RAM. It was incredible compared to what you got with Windows XP and 120 Euro per seat. Nonfree software and almost empty. And, well, if for instance I could get read only, ~16TB durable USB drive with tons of Guix packages offline (in a two yearly basis with stable releases) for $200 I would buy them in the spot. You would say that $200 for a distro it's expensive, but for what it provides, if you are only interested in libre gaming and tools, they amount you save can be huge. I've seen people spend $400 in Steam games because of the Holyday sales...
- deleted 7mo ago[deleted]
- pier25 7mo agoIf the fat std library is not viable you can only increase security requirements. Axios has like 100M downloads per week. A couple of people with MFA should have to approve changes before it gets published.
- brigandish 7mo agoAn alternative: - copy the dependencies' tests into your own tests - copy the code in to your codebase as a library using the same review process you would for code from your own team - treat updates to the library in the same way you would for updates to your own code Apparently, this extra work will now not be a problem, because we have AI making us 10x more efficient. To be honest, even without AI, we should've been doing this from the start, even if I understand why we haven't. The excuses are starting to wear thin though.
- tick_tock_tick 7mo agoI don't know where you've worked but a hostile and intelligent actor or internal red team would succeed under each of those cases at every job I've worked at.
- bitwank 7mo agoGood to know. Where were the places you worked at?
- Hackbraten 7mo agoDefending against a targeted attack is difficult, yes. But these recent campaigns were all directed at everyone. Auditing and inspecting your dependencies does absolutely help thwart that because there will always be people who don't.
- brigandish 7mo agoThey succeeded in poisoning the whole supply chain and making everyone distrust package management to a degree never seen before, and people who aren't reviewing their dependencies are already getting hit. You seem to suggest that we all accept that. That attitude might be the reason why the places you've worked would be under threat. The places I've worked would also be under threat, because several of my colleagues had that attitude, and this is why red teaming works.
- pjc50 7mo agoJust going to put features on hold for a month while I review the latest changes to ffmpeg.
- deleted 7mo ago[deleted]
- a-french-anon 7mo agoWhy wouldn't the "fat std" thing work? Yes it's hard to design properly, both in scope and actual design (especially for an unstandardized language still moving fast), but throwing the towel and punting the problem to the "free market" of uncurated public repos is even worse. It's what we call in France "la fête du slip". PS: that's one reason I try to use git submodules in my Common Lisp projects instead of QuickLisp, because I really see the size of my deptree this way.
- junon 7mo agoBecause fat std is rigid, impractical, and annoying.
- grey-area 7mo agoIn practice (e.g. Go) it’s actually pretty good and infinitely preferable to third party everything.
- PunchyHamster 7mo agoWorks just fine in Go.
- majorbugger 7mo agoYeah, it's annoying to have good support for dates in Java since 2014, instead of only getting it now like in JS.
- dboreham 7mo agoI think we found the constituency that led to the present sorry situation.
- junon 7mo agoThat's rather rude. If you're referring to my packages on npm, I joined way late to that game. This was also ~15 years ago.
- hypeatei 7mo ago
- Joeri 7mo agoNPM should have a curation mechanism, via staff review or crowdsourcing, where versions of popular packages are promoted to a stable set, like linux distros do. I would only use curated versions if they had such a thing.