Oh no, not again a meditation on NPM supply chain attacks
1–10 of 235 posts
Re: Oh no, not again a meditation on NPM supply chain attacks
#2> The tools we use to build software are not secure by default, and almost all of the time, the companies that provide them are not held to account for the security of their products.
The companies? More like the unpaid open source community volunteers who the Fortune 500 leech off contributing nothing in return except demands for free support, fixes and more features.
Re: Oh no, not again a meditation on NPM supply chain attacks
#3Yes
Re: Oh no, not again a meditation on NPM supply chain attacks
#4> The tools we use to build software are not secure by default, and almost all of the time, the companies that provide them are not held to account for the security of their products. The companies? More like the unpaid open source community volunteers who the Fortune 500 leech off contributing nothing in return except demands for free support, fixes and more features.
This.
Re: Oh no, not again a meditation on NPM supply chain attacks
#5The beatings will continue until JS dev culture reforms.
Re: Oh no, not again a meditation on NPM supply chain attacks
#6I think if somebody wants to see library distribution channels tightened up they need to be very specific about what they would like to see changed and why it would be better, since it would appear that the status quo is serving what people actually want - being able to create and upload packages and update them when you want.
> But right now there are still no signed dependencies and nothing stopping people using AI agents, or just plain old scripts, from creating thousands of junk or namesquatting repositories.
This is as close as we get in this particular piece. So what's the alternative here exactly - do we want uploaders to sign up with Microsoft accounts? Some sort of developer vetting process? A curated lib store? I'm sure everybody will be thrilled if Microsoft does that to the JS ecosystem. (/s) I'm not seeing a great deal of difference between having someone's NPM creds and having someone's signing key. Let's make things better but let's also be precise, please.
Re: Oh no, not again a meditation on NPM supply chain attacks
#7"No Way To Prevent This" Says Only Package Manager Where This Regularly Happens
Re: Oh no, not again a meditation on NPM supply chain attacks
#8It's a stretch to pin blame on Microsoft. They're probably the reason the service is still up at all (TFA admits as much). In hindsight it's likely that all they wanted from the purchase was AI training material. At worst they're guilty of apathy, but that's no worse than the majority of npm ecosystem participants.
Re: Oh no, not again a meditation on NPM supply chain attacks
#9I think the cooldown approach would make this type of attack have practically no impact anymore, if nobody ever updates to a newly published package version until, say, 2-3 days have gone by, surely there will be enough time for owner of the package to notice he got pwnd.
Re: Oh no, not again a meditation on NPM supply chain attacks
#10I think if somebody wants to see library distribution channels tightened up they need to be very specific about what they would like to see changed and why it would be better, since it would appear that the status quo is serving what people actually want - being able to create and upload packages and update them when you want. > But right now there are still no signed dependencies and nothing stopping people using AI…
We treat code repositories as public infrastructure, but we don't want to pay for it, so corporations run them, with their profit interest in mind. This is the fundamental conflict, that I see.
And one solution, more non profits as organisations behind them.