3 ms·

Once again, it is in the NPM ecosystem. OneCLI [0] does not save you either. Happens less with languages that have better standard libraries such as Go. If you

by rvz 7mo ago

Once again, it is in the NPM ecosystem. OneCLI [0] does not save you either. Happens less with languages that have better standard libraries such as Go. If you see any package that has hundreds of libraries, that increases the risk of a supply chain attack. A password manager does not need a CLI tool. [0] https://news.ycombinator.com/item?id=47585838 https://news.ycombinator.com/item?id=47585838

hrimfaxi 7mo ago
> A password manager does not need a CLI tool. Why not? Even macos keychain supports cli.
- gear54rus 7mo ago
  The above comment is just a bunch of generalizations not meant to address seriously that's why.
  - rvz 7mo ago
    So the comparison here is that you would rather trust a password manager with a CLI that imports hundreds of third-party dependencies over a first party password manager with a CLI that comes with the OS? I don't think macOS Keychain uses NPM and it isn't in TypeScript or Javascript and, yes it does not need a CLI either. The NPM and Java/Typescript ecosystem is part of the problem that encourages developers to import hundreds of third-party libraries, due to its weak standard library which it takes at least ONE transitive dependency to be compromised and it is game over.
    - hgoel 7mo ago
      You initially complained about CLIs, not the dependency mess of the JS ecosystem. You still have not said why this is an issue of having a CLI.
      - rvz 7mo ago
        > You initially complained about CLIs, not the dependency mess of the JS ecosystem. I complained about both. What does this say from the start? >> Once again, it is in the NPM ecosystem. > You still have not said why this is an issue of having a CLI. Why do you need one? Automation reasons? OpenClaw? This is an attractive way for an attacker to get ALL your passwords in your vault. The breach itself if run in GitHub Actions would just make it a coveted target to compromise it which makes having one worse not better and for easier exfiltration. So it makes even more sense for a password manager to not need a CLI at all. This is even before me mentioning the NPM and the Javascript ecosystem.
        hgoel 7mo ago
        >Why do you need one? Automation reasons? OpenClaw? This is an attractive way for an attacker to get ALL your passwords in your vault. I need one because I am not always using a graphical interface. What exactly in a GUI do you think makes it harder/less attractive for an attacker? If the GUI code is compromised in the same way as the CLI, it'll have the same level of access to your vault as soon as you enter your master password, exactly the same as in the CLI.
    - gear54rus 7mo ago
      It does not much matter if it imports 300 or 30 of them, those vulns will land somewhere in those 30 with equal frequency statistically. If you are advocating developing without dependencies at all, then please start (with any language) and show us all how much you actually ship. JS is a target of these dumb accusations because it's literally the best cross-platform way to ship apps. Stop inventing issues where there are none.
      - rvz 6mo ago
        > It does not much matter if it imports 300 or 30 of them, those vulns will land somewhere in those 30 with equal frequency statistically. The point is the risk is far higher with more dependencies as I said from the very start. But it happens much more frequently in the NPM ecosystem than in others. > If you are advocating developing without dependencies at all, then please start (with any language) and show us all how much you actually ship. The languages in the former (especially Go) encourages you to use the standard library when possible. Javascript / TypeScript does not and encourages you to import more libraries than you need. > JS is a target of these dumb accusations because it's literally the best cross-platform way to ship apps. Stop inventing issues where there are none. Nope. It is a target because of the necessity for developers to import random packages to solve a problem due to its weak standard library and the convenience that comes with installing them. You certainly have a Javascript bias towards this issue yourself and there is clearly a problem and you ignoring it just makes it worse. If it wasn't an issue, we would not be talking about yet another supply chain attack in the NPM ecosystem.
trinsic2 7mo ago
Yeah Im going to have to agree with this
internetter 7mo ago
> A password manager does not need a CLI tool. A password manager absolutely does need a CLI tool??
hgoel 7mo ago
I guess anyone/anything using a non-graphical interface should just not use a password manager for some reason? Not to mention that a graphical application is just as vulnerable to supply chain attacks.
imiric 7mo ago
> A password manager does not need a CLI tool. That's a wild statement. The CLI is just another UI. The problem in this case is JS and the NPM ecosystem. Go would be an improvement, but complexity is the enemy of security. Something like (pass)age is my preference for storing sensitive data.
fluidcruft 7mo ago
I seems like we need better standard libraries, but standard libraries turn into tarpits. I sort of like the way python's stdlib works.
traderj0e 6mo ago
I don't think Go's standard library has the functionality of the JS lib that was infected here. The Axios thing was a fair criticism of JS because Axios should never have been needed in the first place.

by rvz 7mo ago

hrimfaxi 7mo ago

> A password manager does not need a CLI tool. Why not? Even macos keychain supports cli.

gear54rus 7mo ago
The above comment is just a bunch of generalizations not meant to address seriously that's why.
- rvz 7mo ago
  So the comparison here is that you would rather trust a password manager with a CLI that imports hundreds of third-party dependencies over a first party password manager with a CLI that comes with the OS? I don't think macOS Keychain uses NPM and it isn't in TypeScript or Javascript and, yes it does not need a CLI either. The NPM and Java/Typescript ecosystem is part of the problem that encourages developers to import hundreds of third-party libraries, due to its weak standard library which it takes at least ONE transitive dependency to be compromised and it is game over.
  - hgoel 7mo ago
    You initially complained about CLIs, not the dependency mess of the JS ecosystem. You still have not said why this is an issue of having a CLI.
    - rvz 7mo ago
      > You initially complained about CLIs, not the dependency mess of the JS ecosystem. I complained about both. What does this say from the start? >> Once again, it is in the NPM ecosystem. > You still have not said why this is an issue of having a CLI. Why do you need one? Automation reasons? OpenClaw? This is an attractive way for an attacker to get ALL your passwords in your vault. The breach itself if run in GitHub Actions would just make it a coveted target to compromise it which makes having one worse not better and for easier exfiltration. So it makes even more sense for a password manager to not need a CLI at all. This is even before me mentioning the NPM and the Javascript ecosystem.
      - hgoel 7mo ago
        >Why do you need one? Automation reasons? OpenClaw? This is an attractive way for an attacker to get ALL your passwords in your vault. I need one because I am not always using a graphical interface. What exactly in a GUI do you think makes it harder/less attractive for an attacker? If the GUI code is compromised in the same way as the CLI, it'll have the same level of access to your vault as soon as you enter your master password, exactly the same as in the CLI.
  - gear54rus 7mo ago
    It does not much matter if it imports 300 or 30 of them, those vulns will land somewhere in those 30 with equal frequency statistically. If you are advocating developing without dependencies at all, then please start (with any language) and show us all how much you actually ship. JS is a target of these dumb accusations because it's literally the best cross-platform way to ship apps. Stop inventing issues where there are none.
    - rvz 6mo ago
      > It does not much matter if it imports 300 or 30 of them, those vulns will land somewhere in those 30 with equal frequency statistically. The point is the risk is far higher with more dependencies as I said from the very start. But it happens much more frequently in the NPM ecosystem than in others. > If you are advocating developing without dependencies at all, then please start (with any language) and show us all how much you actually ship. The languages in the former (especially Go) encourages you to use the standard library when possible. Javascript / TypeScript does not and encourages you to import more libraries than you need. > JS is a target of these dumb accusations because it's literally the best cross-platform way to ship apps. Stop inventing issues where there are none. Nope. It is a target because of the necessity for developers to import random packages to solve a problem due to its weak standard library and the convenience that comes with installing them. You certainly have a Javascript bias towards this issue yourself and there is clearly a problem and you ignoring it just makes it worse. If it wasn't an issue, we would not be talking about yet another supply chain attack in the NPM ecosystem.

trinsic2 7mo ago

Yeah Im going to have to agree with this

internetter 7mo ago

> A password manager does not need a CLI tool. A password manager absolutely does need a CLI tool??

hgoel 7mo ago

I guess anyone/anything using a non-graphical interface should just not use a password manager for some reason? Not to mention that a graphical application is just as vulnerable to supply chain attacks.

imiric 7mo ago

> A password manager does not need a CLI tool. That's a wild statement. The CLI is just another UI. The problem in this case is JS and the NPM ecosystem. Go would be an improvement, but complexity is the enemy of security. Something like (pass)age is my preference for storing sensitive data.

fluidcruft 7mo ago

I seems like we need better standard libraries, but standard libraries turn into tarpits. I sort of like the way python's stdlib works.

traderj0e 6mo ago

I don't think Go's standard library has the functionality of the JS lib that was infected here. The Axios thing was a fair criticism of JS because Axios should never have been needed in the first place.