Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Does anyone investigate open source packages before using in prod?

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 40 posts

Re: Ask HN: Does anyone investigate open source packages before using in prod?

#31

Post by carapace »

seanwilson wrote: post #26
carapace wrote: post #24

Earlier quoted context omitted.

I couldn't begin to estimate. (We don't use those.)

I just don't see how anyone could realistically look at all the lines of code that any nontrivial JavaScript app relies on in any depth. I'm sure most people don't review the code for their operating system, drivers, web server, compiler, browser etc. but they do assess if the entities that write + support them are worth trusting. This is likely the only realistic approach for complex JavaScript apps also.

> I just don't see how anyone could realistically look at all the lines of code that any nontrivial JavaScript app relies on in any depth.

Right. And that's really bad.

> I'm sure most people don't review the code for their operating system, drivers, web server, compiler, browser etc.

Right, but some people do. Hire one of them. (And if your "props dept." can't keep up with the changes to all the things that's also really bad.)

> they do assess if the entities that write + support them are worth trusting.

No one is a magic code elf. (Some people come close. Fabrice Bellard might count. But even that worthy commits bugs.)

Like I said in a sib comment, yeah, some things get a pass. Bash shell for example. Then again, remember e.g. "heartbleed"?

Re: Ask HN: Does anyone investigate open source packages before using in prod?

#32

Post by stevekemp »

alltakendamned wrote: post #15

It's interesting to see so many people here checking the code of all their open source packages, so here's my take on it as a security consultant: No, most people don't, they even have a hard time keeping library versions up to date.

I used to audit opensource code for security issues, on a regular basis, and even now before I install a public-facing application I generally have a look at the code.

It's not often I spot anything major, but I figure if I have the time I should do it just in case.

I often look at the code for PHP-extensions, npm-libraries, and similar that colleagues introduce. Just to be sure there's not anything blatently horrid going on.

Re: Ask HN: Does anyone investigate open source packages before using in prod?

#33

Post by [deleted] »

carapace wrote: post #31
seanwilson wrote: post #26

Earlier quoted context omitted.

I just don't see how anyone could realistically look at all the lines of code that any nontrivial JavaScript app relies on in any depth. I'm sure most people don't review the code for their operating system, drivers, web server, compiler, browser etc. but they do assess if the entities that write + support them are worth trusting. This is likely the only realistic approach for complex JavaScript apps also.

> I just don't see how anyone could realistically look at all the lines of code that any nontrivial JavaScript app relies on in any depth. Right. And that's really bad. > I'm sure most people don't review the code for their operating system, drivers, web server, compiler, browser etc. Right, but some people do. Hire one of them. (And if your "props dept." can't keep up with the changes to all the things that's also r…

[deleted]

Re: Ask HN: Does anyone investigate open source packages before using in prod?

#34

Post by seanwilson »

carapace wrote: post #31
seanwilson wrote: post #26

Earlier quoted context omitted.

I just don't see how anyone could realistically look at all the lines of code that any nontrivial JavaScript app relies on in any depth. I'm sure most people don't review the code for their operating system, drivers, web server, compiler, browser etc. but they do assess if the entities that write + support them are worth trusting. This is likely the only realistic approach for complex JavaScript apps also.

> I just don't see how anyone could realistically look at all the lines of code that any nontrivial JavaScript app relies on in any depth. Right. And that's really bad. > I'm sure most people don't review the code for their operating system, drivers, web server, compiler, browser etc. Right, but some people do. Hire one of them. (And if your "props dept." can't keep up with the changes to all the things that's also r…

> > I just don't see how anyone could realistically look at all the lines of code that any nontrivial JavaScript app relies on in any depth.

> Right. And that's really bad.

> > I'm sure most people don't review the code for their operating system, drivers, web server, compiler, browser etc.

> Right, but some people do. Hire one of them.

The interesting question isn't if you can do it, it's when should you, to what extent, and how much it will cost.

"Always do it, do it in-depth, the time consumed isn't important and the budget isn't important" is a bad approach for example and isn't helpful to the OP.

Successful software development is all about making appropriate tradeoffs - you're not going to get very far by conducting your own OpenSSL audit when all you want to do is write a todo web app.

Re: Ask HN: Does anyone investigate open source packages before using in prod?

#35

Post by carapace »

seanwilson wrote: post #34
carapace wrote: post #31

Earlier quoted context omitted.

> I just don't see how anyone could realistically look at all the lines of code that any nontrivial JavaScript app relies on in any depth. Right. And that's really bad. > I'm sure most people don't review the code for their operating system, drivers, web server, compiler, browser etc. Right, but some people do. Hire one of them. (And if your "props dept." can't keep up with the changes to all the things that's also r…

> > I just don't see how anyone could realistically look at all the lines of code that any nontrivial JavaScript app relies on in any depth. > Right. And that's really bad. > > I'm sure most people don't review the code for their operating system, drivers, web server, compiler, browser etc. > Right, but some people do. Hire one of them. The interesting question isn't if you can do it, it's when should you, to what ex…

Hey I'm just answering the question, yeah? We do it. It's not that hard. You pay the overhead upfront and have fewer surprises. Read the "Hollywood Secrets" book, it makes a lot of IMO good points.

I once helped a guy build a go-cart out of an old lawn mower engine and a bed frame. It was a lot of fun. We didn't do any research, we just made it.

If I'm provisioning a commercial fleet (for a delivery service or something) I'm going to do my homework to make sure the cars we deploy are low-maintenance, high-mileage, with a good safety record, etc.

Re: Ask HN: Does anyone investigate open source packages before using in prod?

#36

Post by amoitnga »

WA9ACE wrote: post #6

I normally read a good chunk, if not all of the code of a dependency before I add it to my projects except in the case of community standard things (in Ruby) such as ActiveSupport or Sequel. Going over a prospective dependency a few months ago bore fruit in proving why you should always do this. NewsAPI is a neat little API for fetching news whose docs just so happen to show a ruby gem. Being the lazy developer I am…

Is this malicious? I'm honestly curious, as I don't have much experience still in the field. my answer to OPs question is NO , but I'd like to grow.

Re: Ask HN: Does anyone investigate open source packages before using in prod?

#37

Post by amoitnga »

carapace wrote: post #30
gitgud wrote: post #28

Earlier quoted context omitted.

Thanks for the response, that's an interesting way to deal with it. How do you verify a dependency? Do you literally examine the source code? Make sure the build is reproduced? or just the meta data? (downloads, stars) has the portfolio actually prevented any vulnerabilities? It's pretty common for JS projects to have thousands of transitive dependencies, I'm not sure keeping a private portfolio is much use. The enti…

Cheers! > How do you verify a dependency? Do you literally examine the source code? Yeah. It's part of the overhead of using the software. You also look at the history of bugs and how they were handled. > It's pretty common for JS projects to have thousands of transitive dependencies Yeah, I know, and it's bonkers IMO. > The entire open-source ecosystem is built on the foundation of trust In practice, yes, but in the…

Thanks for sharing. It would be very interesting to know some of the examples when it payed off. Could you please share?

Re: Ask HN: Does anyone investigate open source packages before using in prod?

#39

Post by nikitaga »

overkalix wrote: post #21
nikitaga wrote: post #10

I am paranoid about security of all those packages, so yes, even before just downloading, I check the authors, activity and read the source code. Not always – e.g. I skip the source code if it's something big AND very reputable AND I decided that I need it such as scala/scala or facebook/react – but I do my best. It's very annoying, it's not free, and it affects what kinds of libraries I use. My projects have fewer a…

> My projects have fewer and smaller dependencies than typical Taking a look at your at your github projects and build.sbt... this is quite an understatement.

Haha well tbh I just didn't feel the need for more deps in such libraries. It's a tougher choice in application code!

Re: Ask HN: Does anyone investigate open source packages before using in prod?

#40

Post by bluGill »

sigjuice wrote: post #27
bluGill wrote: post #5

Yes, if there are no commits at all I know I'm stuck maintaining it.

Or it could be mature and stable software that doesn't need constant maintaining.

Maybe, but then I'd expect a small number of bug fix commits. Most software never matures in that way.
Post reply on HN