But safe-npm is not 90 days old yet.. :/
Show HN: Safe-NPM – only install packages that are +90 days old
11–20 of 69 posts
Re: Show HN: Safe-NPM – only install packages that are +90 days old
#12You could dual brand as vibe-npm, only install packages that are in your models training dataset
Re: Show HN: Safe-NPM – only install packages that are +90 days old
#13Why does elapsed time mean a library is safe? This is so ridiculous. It doesn't protect you against anything. I'm sure there are 1000s of old libraries out there with hidden vulnerabilities or malicious code.
Re: Show HN: Safe-NPM – only install packages that are +90 days old
#14Why does elapsed time mean a library is safe? This is so ridiculous. It doesn't protect you against anything. I'm sure there are 1000s of old libraries out there with hidden vulnerabilities or malicious code.
Most supply chain attacks have a very limited window in which they’re exploitable. This is not a panacea, but it is a good idea.
Re: Show HN: Safe-NPM – only install packages that are +90 days old
#15Why does elapsed time mean a library is safe? This is so ridiculous. It doesn't protect you against anything. I'm sure there are 1000s of old libraries out there with hidden vulnerabilities or malicious code.
Literally nothing can mean a “library is safe.”
The idea of “safe” in terms of risk and security has misled a lot of people into this wrong idea that there’s a binary state of safe and unsafe.
It’s all about risk management. You want to reduce risk as inexpensively as possible. One of many inexpensive approaches is “don’t install dependencies that are new.” Along with “don’t install dependencies that nobody else uses.” You might also apply the rule, “don’t install dependencies that aren't shipped with the OS.” Or “don’t use dependencies that haven’t been formally proven.” Etc.
Indeed, calling it “Safe-NPM” can be misleading. As if using it achieves some binary state of safety.
Re: Show HN: Safe-NPM – only install packages that are +90 days old
#16Why does elapsed time mean a library is safe? This is so ridiculous. It doesn't protect you against anything. I'm sure there are 1000s of old libraries out there with hidden vulnerabilities or malicious code.
[deleted]
Re: Show HN: Safe-NPM – only install packages that are +90 days old
#17If everybody does that, won't we take 90 days more to detect problems / hacks of npm packages ?
Re: Show HN: Safe-NPM – only install packages that are +90 days old
#18If everybody does that, won't we take 90 days more to detect problems / hacks of npm packages ?
No, cause the folks detecting the problems typically do so by actively scanning new releases (usually security companies do this). Few such problems are detected by people who do a "normal" update and receive compromised code, investigate, and then report the problem. It does happen, but it's not the "usual" way these supply chain attacks are discovered, especially not the really big ones.
Re: Show HN: Safe-NPM – only install packages that are +90 days old
#19Does anyone have any statistics on how long a compromised package has been in the wild on average?
Re: Show HN: Safe-NPM – only install packages that are +90 days old
#20"Here, install my new 1-day old NPM package that doesn't let you install packages younger than 90 days."
Pardon me, I couldn’t help myself :D