3 ms·

aube (npm/yarn/pnpm drop-in alternative) now has a "jailBuilds" flag that restricts access to network/filesystem access. https://aube.en.dev/package-manager/ja

aube (npm/yarn/pnpm drop-in alternative) now has a "jailBuilds" flag that restricts access to network/filesystem access. https://aube.en.dev/package-manager/jailed-builds.html https://aube.en.dev/package-manager/jailed-builds.html But this feels like a cat/mouse game.

cyanydeez 5mo ago
dino was wired with security in mind, but you can see developers dont tend towards aecurity
- rubnogueira 5mo ago
  Because there is a time and effort cost to swap over to another framework/runtime even if it brings benefits, and security is always considered "good for now" unfortunately. That is what made Bun popular, and tools like uv/pip, oxlint/eslint, orbstack/docker desktop, and the list goes on. Drop-in replacements where we get 10x with little effort.
- epicide 5mo ago
  Because employers don't tend towards security. In fact, many actively punish somebody for "sandbagging" or simply taking too long if they even suggest a security concern.
- esafak 5mo ago
  What is dino?
no-name-here 5mo ago
> aube (npm/yarn/pnpm drop-in alternative) now has a "jailBuilds" flag that restricts access to network/filesystem access. 1. It seems like the restrictions are only for lifecycle scripts, so wouldn't help if/when the package's actual code had malicious code inserted? 2. Package managers like pnpm seem to entirely block lifecycle scripts by default, so I guess this is an in-between solution. Still, I guess it's a step in the right direction for those want or need to run lifecycle scripts specifically.
- jdxcode 5mo ago
  1. the supply chain attacks I've seen are naive. They just leverage postinstall hooks. Malicious code also needs to be executed, not simply installed, so it's a lot less likely that an exploit would happen compared to postinstall since it can't just be buried in a transitive. 2. aube does the same. This is an extra level of protection if you've already whitelisted a package

cyanydeez 5mo ago

dino was wired with security in mind, but you can see developers dont tend towards aecurity

rubnogueira 5mo ago
Because there is a time and effort cost to swap over to another framework/runtime even if it brings benefits, and security is always considered "good for now" unfortunately. That is what made Bun popular, and tools like uv/pip, oxlint/eslint, orbstack/docker desktop, and the list goes on. Drop-in replacements where we get 10x with little effort.
epicide 5mo ago
Because employers don't tend towards security. In fact, many actively punish somebody for "sandbagging" or simply taking too long if they even suggest a security concern.
esafak 5mo ago
What is dino?

no-name-here 5mo ago

> aube (npm/yarn/pnpm drop-in alternative) now has a "jailBuilds" flag that restricts access to network/filesystem access. 1. It seems like the restrictions are only for lifecycle scripts, so wouldn't help if/when the package's actual code had malicious code inserted? 2. Package managers like pnpm seem to entirely block lifecycle scripts by default, so I guess this is an in-between solution. Still, I guess it's a step in the right direction for those want or need to run lifecycle scripts specifically.

jdxcode 5mo ago
1. the supply chain attacks I've seen are naive. They just leverage postinstall hooks. Malicious code also needs to be executed, not simply installed, so it's a lot less likely that an exploit would happen compared to postinstall since it can't just be buried in a transitive. 2. aube does the same. This is an extra level of protection if you've already whitelisted a package