4 ms·

Don't write anything backend or cli tool in NPM would be good start

by PunchyHamster 6mo ago

MetaWhirledPeas 6mo ago
Other package managers are magically immune?
- c2h5oh 6mo ago
  They are not, but npm is uniquely bad in that regard. Refusal to implement security features that would have made attacks like this harder really doesn't help https://github.com/node-forward/discussions/issues/29 https://github.com/node-forward/discussions/issues/29
  - nirvdrum 6mo ago
    The lack of a comprehensive standard library for JavaScript also results in projects pulling many more third party dependencies than you would with most other modern environments. It’s just a bigger attack surface. And if you can compromise a module used for basic functionality that you’d get out of the box elsewhere, the blast radius will be enormous.
    - pico303 6mo ago
      Not to mention a culture of basically one-line packages ad infinitum. I downloaded a JS tool the other day to generate test reports and it had around 300 dependencies. Needless to say I’m running all my JS tools in a Docker container these days.
    - wombatpm 6mo ago
      So why hasn’t someone created a batteries include JS library? I don’t program in JS on the backend so I don’t know how feasible something like that is.
      - girvo 6mo ago
        Everyone’s ideas of what batteries should be included differ
        wolfi1 6mo ago
        I, for one, root for AAA
        hfsh 6mo ago
        *cries in ghettoblaster and Maglite D cells*
      - stevekemp 6mo ago
        https://github.com/stdlib-js/stdlib https://github.com/stdlib-js/stdlib was is one of several attempts at that, but yes the issue is that different people have very different views of what should be standard.
        fc417fc802 6mo ago
        That doesn't seem like it should be an issue in practice? Rather than a single standard library endorsed by the language stewards if the community at large converges on a small handful of "standard" solutions that seems like it would satisfy the security aspect of things.
      - erikerikson 6mo ago
        Lodash but also, which batteries?
- mayama 6mo ago
  You could write most of the cli tools using stdlib in python and go, without need for including hundreds of libraries even for trivial things.
- NamlchakKhandro 6mo ago
  yes obviously. isn't it obvious? it should be obvious. why isn't obvious?
deleted 6mo ago
[deleted]
ljm 6mo ago
Security by obscurity. If another language became as ubiquitous as JS then it'd be the same. In the context of TFA, don't rely on third party github actions that you haven't vetted. Most of them aren't needed and you can do the same with a few lines of bash. Which you can also then use locally.

Don't write anything backend or cli tool in NPM would be good start

MetaWhirledPeas 6mo ago

Other package managers are magically immune?

c2h5oh 6mo ago
They are not, but npm is uniquely bad in that regard. Refusal to implement security features that would have made attacks like this harder really doesn't help https://github.com/node-forward/discussions/issues/29 https://github.com/node-forward/discussions/issues/29
- nirvdrum 6mo ago
  The lack of a comprehensive standard library for JavaScript also results in projects pulling many more third party dependencies than you would with most other modern environments. It’s just a bigger attack surface. And if you can compromise a module used for basic functionality that you’d get out of the box elsewhere, the blast radius will be enormous.
  - pico303 6mo ago
    Not to mention a culture of basically one-line packages ad infinitum. I downloaded a JS tool the other day to generate test reports and it had around 300 dependencies. Needless to say I’m running all my JS tools in a Docker container these days.
  - wombatpm 6mo ago
    So why hasn’t someone created a batteries include JS library? I don’t program in JS on the backend so I don’t know how feasible something like that is.
    - girvo 6mo ago
      Everyone’s ideas of what batteries should be included differ
      - wolfi1 6mo ago
        I, for one, root for AAA
        hfsh 6mo ago
        *cries in ghettoblaster and Maglite D cells*
    - stevekemp 6mo ago
      https://github.com/stdlib-js/stdlib https://github.com/stdlib-js/stdlib was is one of several attempts at that, but yes the issue is that different people have very different views of what should be standard.
      - fc417fc802 6mo ago
        That doesn't seem like it should be an issue in practice? Rather than a single standard library endorsed by the language stewards if the community at large converges on a small handful of "standard" solutions that seems like it would satisfy the security aspect of things.
    - erikerikson 6mo ago
      Lodash but also, which batteries?
mayama 6mo ago
You could write most of the cli tools using stdlib in python and go, without need for including hundreds of libraries even for trivial things.
NamlchakKhandro 6mo ago
yes obviously. isn't it obvious? it should be obvious. why isn't obvious?

deleted 6mo ago

[deleted]

ljm 6mo ago

Security by obscurity. If another language became as ubiquitous as JS then it'd be the same. In the context of TFA, don't rely on third party github actions that you haven't vetted. Most of them aren't needed and you can do the same with a few lines of bash. Which you can also then use locally.