kjok

9 ms·

91.
by kjok 4y ago
And how do you propose we do this? Pay developers for "secure" contributions?
92.
by kjok 4y ago
Again some esoteric package that likely nobody uses. If you’re worried about such attacks, private registry mirrors can go a long way.
93.
by kjok 4y ago
Given that these malicious images seem esoteric (only a few hundred downloads), is this even a threat? Most companies have private mirrors that protect against such attacks.
94.
by kjok 4y ago
What's the concern here? You could containerize your scripts, each in a separate Docker container.
95.
Here's an idea: permission system for NPM packages(guruitsource.com)
4 points by kjok 4y ago|1 comments
96.
by kjok 5y ago
> Can't this be detected? Not really. Contrary to OP belief, there are tools that claim to detect such malicious packages. I wonder how effective they are.
97.
AskHN: Why are so many top-notch CS researchers working for a dropout?(research.fb.com)
3 points by kjok 6y ago|0 comments
98.
by kjok 6y ago
Very cool! What's the overhead compared to VMs?
99.
by kjok 6y ago
Congratulations on getting funded! Openbase looks cool. What worries me though is how secure are NPM packages. Is this something that openbase will address in the future?
100.
Ask HN: Where are you hosting your in-person meetings and why?
1 points by kjok 6y ago|0 comments
101.
by kjok 6y ago
They are from Georgia Tech https://twitter.com/codinghorror/status/1255975503057440768
102.
Use security vetted NPM and Python packages(asciinema.org)
6 points by kjok 6y ago|1 comments