5 ms·

npmjs still contains the package: https://www.npmjs.com/search?q=rimrafall https://www.npmjs.com/search?q=rimrafall https://www.npmjs.com/package/rimrafall http

by illumen 12y ago

npmjs still contains the package: https://www.npmjs.com/search?q=rimrafall https://www.npmjs.com/search?q=rimrafall https://www.npmjs.com/package/rimrafall https://www.npmjs.com/package/rimrafall '0 downloads in the last month' There is no 'report package' button. The support link goes to a 'we are hiring' contact form. Report bad packages as security issues? https://www.npmjs.com/security https://www.npmjs.com/security Package signing. Review process. Scanning tools for dangerous packages. As a user, don't trust anything and isolate containers and jails. Ban bad actors. Charge for a curated package index. Lots of other plugin stores do better than npm.

raesene5 12y ago
that's interesting. Any pointers to package stores that do a better job on security? I'm researching the area a bit at the moment and I've not seen a lot of good practice out there, so would be interesting to have some good examples to hold up.
- thinkmoore 12y ago
  We haven't developed far enough for a package store at this point, but this is one of the use cases we're hoping to explore as part of our capability-based shell scripting language: shill-lang.org.
  - raesene5 12y ago
    cool. If you're looking for thoughts about threat models and ways to do it http://theupdateframework.com/index.html http://theupdateframework.com/index.html seems to have some good info.
- nailer 12y ago
  Fedora and RHEL have had mandatory signing since before either existed (back when it was RHL). Debian has had what we'd call 'EV' level security these days for about 15 years - people bringing their passports in and reading out their GPG public keys at LUGs.
deleted 12y ago
[deleted]
nailer 12y ago
I had the same thing - they have an abuse@ email in the Code of Conduct link that appears on every page. The email is the first thing listed. I've contacted them.
- nailer 12y ago
  The package has now been removed.
tlrobinson 12y ago
"Scanning tools for dangerous packages" This seems like an impossible problem (essentially the halting problem). On Linux perhaps you could build packages in a container then copy the results to the installation directory, but there's no guarantee require("rimrafall") won't just "child_process.exec('rm -rf /')".
- politician 12y ago
  At the very least, they could install packages in a VM and check that the VM can be rebooted.
  - tlrobinson 12y ago
    Then someone could just craft a package that deletes every file except the ones required for booting...

by illumen 12y ago

raesene5 12y ago

that's interesting. Any pointers to package stores that do a better job on security? I'm researching the area a bit at the moment and I've not seen a lot of good practice out there, so would be interesting to have some good examples to hold up.

thinkmoore 12y ago
We haven't developed far enough for a package store at this point, but this is one of the use cases we're hoping to explore as part of our capability-based shell scripting language: shill-lang.org.
- raesene5 12y ago
  cool. If you're looking for thoughts about threat models and ways to do it http://theupdateframework.com/index.html http://theupdateframework.com/index.html seems to have some good info.
nailer 12y ago
Fedora and RHEL have had mandatory signing since before either existed (back when it was RHL). Debian has had what we'd call 'EV' level security these days for about 15 years - people bringing their passports in and reading out their GPG public keys at LUGs.

deleted 12y ago

[deleted]

nailer 12y ago

I had the same thing - they have an abuse@ email in the Code of Conduct link that appears on every page. The email is the first thing listed. I've contacted them.

nailer 12y ago
The package has now been removed.

tlrobinson 12y ago

"Scanning tools for dangerous packages" This seems like an impossible problem (essentially the halting problem). On Linux perhaps you could build packages in a container then copy the results to the installation directory, but there's no guarantee require("rimrafall") won't just "child_process.exec('rm -rf /')".

politician 12y ago
At the very least, they could install packages in a VM and check that the VM can be rebooted.
- tlrobinson 12y ago
  Then someone could just craft a package that deletes every file except the ones required for booting...