Harvesting credit card numbers and passwords from websites

Post by downandout » Sat, Jan 06, 2018, 9:48 PM UTC

jmadsen wrote: post #39

I'm more of a back-end dev who doesn't know all the ins and outs of the actual software used - can someone explain to me why this is an npm problem, and not an excessive dependencies problem? I thought npm was simply a package manager - I don't see anything in the article that is specific to npm, except he happens to say that word.

Post by cesarb » Sat, Jan 06, 2018, 10:02 PM UTC

saryant wrote: post #22

fny wrote: post #16

Couldn't one circumvent CSP by sending the data to a legitimate analytics service that everyone uses like Google Analytics?

This is why, when I recently built a credit card form, we didn't include any trackers or third-party code (beyond our vendor's). No dependencies at all—our vendor also has no dependencies in the JS we use to implement the CC form. That did mean no jQuery, no Google Analytics, no NPM modules and we had to build it as a standalone page outside our React setup, but it's worth it to be able to definitively inspect every…

Post by drdrey » Sat, Jan 06, 2018, 10:13 PM UTC

jmadsen wrote: post #39

I'm more of a back-end dev who doesn't know all the ins and outs of the actual software used - can someone explain to me why this is an npm problem, and not an excessive dependencies problem? I thought npm was simply a package manager - I don't see anything in the article that is specific to npm, except he happens to say that word.

Post by jmadsen » Sat, Jan 06, 2018, 10:20 PM UTC

milesvp wrote: post #42

jmadsen wrote: post #39

I'm more of a back-end dev who doesn't know all the ins and outs of the actual software used - can someone explain to me why this is an npm problem, and not an excessive dependencies problem? I thought npm was simply a package manager - I don't see anything in the article that is specific to npm, except he happens to say that word.

What makes npm particularly bad, is that JS has such a teribad stdlib. When you need to write your own lpad() at some point its easier to include a stupid little package that has dealt with all the edge cases you don't want to care about. So you end up with way more third party deps than a kitchen sink type language. Otherwise, yes this is a fundamental dependency issue.

Post by dmitriid » Sat, Jan 06, 2018, 10:24 PM UTC

Silhouette wrote: post #33

dkersten wrote: post #9

Earlier quoted context omitted.

I was going to say the following: Except that being responsible for your dependencies (and the dependencies of your dependencies...) is impossibly hard. You would need to build everything yourself after auditing the code. But then I thought about it some more and its likely that you don’t need to audit the code, since the malware probably isn’t in the public git repo. Yes, its still a risk, but the probability of mal…

It's only impossibly hard to audit this kind of thing if you have an insanely large and deep tree of transitive dependencies in the first place. This seems to be a particularly bad problem in the JS world, for this and many other reasons, but most programming languages and their communities don't work that way. Auditing a small number of larger dependencies, when most of them are probably widely used and from reasona…