3 ms·
> presumably this comprise was only found out because a lot of people did update This was supposedly discovered by "Socket researchers", and the product they'r
by Ukv 6mo ago
> presumably this comprise was only found out because a lot of people did update
This was supposedly discovered by "Socket researchers", and the product they're selling is proactive scanning to detect/block malicious packages, so I'd assume this would've been discovered even if no regular users had updated.
But I'd claim even for malware that's only discovered due to normal users updating, it'd generally be better to reduce the number of people affected with a slow roll-out (which should happen somewhat naturally if everyone sets, or doesn't set, their cool-down based on their own risk tolerance/threat model) rather than everyone jumping onto the malicious package at once and having way more people compromised than was necessary for discovery of the malware.
- vlovich123 6mo agoBetter for the cool down to be managed guaranteed centrally by the package forge rather than ad-hoc by each individual client.
- ornornor 6mo agoThat’s tricky, sometimes you really need the new version to be available right away.
- vlovich123 6mo agoThere’s ways to handle that. But that’s the exception, not the rule.
- friendzis 6mo agofoobarizer>=1.2.3 vs foobarizer==1.2.5
- piaste 6mo agoThe cooldown is a defence against malicious actors compromising the release infrastructure. Having the forge control it half-defeats the point; the attackers who gained permission to push a malicious release, might well have also gained permission to mark it as "urgent security hotfix, install immediately 0 cooldown".
- vlovich123 6mo agoI have not heard anyone seriously discuss that cooldown prevents compromise of the forge itself. It’s a concern but not the pressing concern today. And no, however compromised packages to the forge happens, that is not the same thing as marking “urgent security hotfix” which would require manual approval from the forge maintainers, not an automated process. The only automated process would be a blackout period where automated scanners try to find issues and a cool off period where the release gets progressively to 100% of all projects that depend on it over the course of a few days or a week.
- piaste 6mo agoBy "release infrastructure" I didn't mean gain admin access to github.com, I meant gaining the credentials to push out a release of that particular package.
- riteshnoronha16 6mo ago[dead]