Many packages suddenly disappeared • Hacker News Board

Re: Many packages suddenly disappeared

#201

Post by iDemonix » Sat, Jan 06, 2018, 9:52 PM UTC

paultopia wrote: post #184

Stupid question from non-pro here: everyone's always like "never commit libraries into source control." But, um, this kinda thing?

I think there's a difference between committing to source control and having local copies. For example, we use Red Hat Satellite at work which you give a list of upstream repos and filters, and it download copies locally (to what it calls a 'capsule'). Then to get those packages to your machines you have to publish through the lifecycle process (Test > Staging > Live A > Live B - or whatever you choose).

There's multiple ways to solve to mitigate the risk, but committing libraries in to source control can cause way more headaches than it prevents IMO.

Re: Many packages suddenly disappeared

#202

Post by joezydeco » Sat, Jan 06, 2018, 9:53 PM UTC

nine_k wrote: post #132

fiatjaf wrote: post #98

Earlier quoted context omitted.

What hasn't?

Quite a few. E.g. ssh definitely was not, Rust was not, TeX was not. But these were mostly second-thought projects of the "let's now finally do everything right" kind.

They certainly weren't the cores of other projects, ripped out and made into a standalone thing.

Re: Many packages suddenly disappeared

#203

Post by wybiral » Sat, Jan 06, 2018, 9:53 PM UTC

racbart wrote: post #5

PSA: Please be cautious because this is an excellent opportunity for taking over packages and injecting malware by malicious people. Example: https://www.npmjs.com/package/duplexer3 which has 4M monthly downloads just reappeared, published by a fresh npm user. They published another two versions since then, so it's possible they've initially republished unchanged package, but now are messing with the code. Previously…

Wait, they both say username = floatdrop [1] for me. What did they say for you?

[1] https://twitter.com/floatdrop

Re: Many packages suddenly disappeared

#204

Post by happy_rust44 » Sat, Jan 06, 2018, 9:54 PM UTC

nine_k wrote: post #132

fiatjaf wrote: post #98

Earlier quoted context omitted.

What hasn't?

Quite a few. E.g. ssh definitely was not, Rust was not, TeX was not. But these were mostly second-thought projects of the "let's now finally do everything right" kind.

to be fair rust was completely different way early its start and changed dramatically for good when it dropped few things like gc and focused on borrow-checker/concurrency

Re: Many packages suddenly disappeared

#205

Post by amself » Sat, Jan 06, 2018, 9:55 PM UTC

marpstar wrote: post #147

weinzierl wrote: post #69

Earlier quoted context omitted.

Detailed description what you could do with a malicious npm package is currently on he front page: "Harvesting credit card numbers and passwords from websites" https://news.ycombinator.com/item?id=16084575

am I the only one who thinks this could be more than a coincidence?

I find it hard to believe, but never say never, of course.

Re: Many packages suddenly disappeared

#206

Post by astrobe_ » Sat, Jan 06, 2018, 9:55 PM UTC

StavrosK wrote: post #19

vitaliyf wrote: post #16

Don't. Deploy. From. Internet.

What's the alternative? Have the maintainer snail-mail you the packages?

Git or similar?

Re: Many packages suddenly disappeared

#207

Post by gkya » Sat, Jan 06, 2018, 9:55 PM UTC

joezydeco wrote: post #20

sergiotapia wrote: post #9

Yikes, what is it about node/npm/javascript that makes it feel like a house of cards?

How about the idea that Node has been a hack from day one?

Node was a very interesting thing back when it started. It was a hack, but a nice kind of hack. You could write some efficient servers with it. But then the community that formed around it, with it the project went berserk.

Re: Many packages suddenly disappeared

#208

Post by rmrfrmrf » Sat, Jan 06, 2018, 9:57 PM UTC

notatoad wrote: post #106

lioeters wrote: post #89

Earlier quoted context omitted.

As a counterpoint, couldn't any sufficiently complex structure be called a hack and a house of cards, when you really dig down into how it's put together? Mm, maybe not any - as some complex systems are well-tested with solid architecture - but just some, or most..

A "house of cards" implies that you don't have to dig to topple it. If you have to really dig down into how it's put together in order to start pulling it apart it isn't really a house of cards. I don't use npm or node for anything serious, and i don't really have any knowledge of how NPM works, but this isn't the first time i've read this story of a whole bunch of packages disappearing and everybody's builds breakin…

Because when you’re on top, everyone loves seeing you fail.

A quick CVE search pulled up 18 vulnerabilities in RubyGems, including remote code execution.

Re: Many packages suddenly disappeared

#209

Post by tetha » Sat, Jan 06, 2018, 9:58 PM UTC

maxander wrote: post #179

tetha wrote: post #136

Earlier quoted context omitted.

> Is there a valid defense for a platform whose security relies on the unanimous cooperation of a widely-scattered developer base? The defense is staged deployment and active users. This obviously depends on the blutness of the malicious code. If I may assume easily noticed effects of the malicious code: A dev at our place - using java with maven - would update the library, his workstation would get owned. This could…

> If we can't notice the malicious code at all until due to really really smart activation mechanisms... well then we're in NSA conspiracy land again. What about really dumb activation methods? I.e., a condition that only triggers malicious behavior several months after the date the package was subverted. You don’t have to be the NSA to write that. What’s scary here is that there are simpleminded attacks that, AFAIK,…

Mh, I have a rather aggressive stance on these kind of incidents, no matter if they are availability or security related. You can fish for them, you can test for them, and there are entire classes of malicious code you cannot find. For everything you do, turing complete code can circumvent it. There's a lot of interesting reading material going on in the space of malware analysis regarding sandbox detection, for example.

So stop worrying. Try to catch as much as feasible before prod. Then focus on detecting, alerting and ending the actual incident. If code causes an incident, it't probably measurable and detectable. And even then you won't be able to catch everything. As long as a server has behavior observable from the internet, it could be exfiltrating data.

Re: Many packages suddenly disappeared

#210

Post by eitland » Sat, Jan 06, 2018, 9:58 PM UTC

tomjakubowski wrote: post #73

StavrosK wrote: post #49

Earlier quoted context omitted.

Wouldn't just pinning the hash of a package be a better solution?

That’s probably fine from the security perspective, but the hash won’t make the package re-appear if it disappears out of nowhere. That’s the other benefit of a private/on-premesis mirror.

Yarn caches locally, doesn't it?