Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Oh no, not again a meditation on NPM supply chain attacks

tane.dev

Post reply on HN
Print view View original

61–70 of 235 posts

Re: Oh no, not again a meditation on NPM supply chain attacks

#61

Post by theknarf »

cube00 wrote: post #2

> The tools we use to build software are not secure by default, and almost all of the time, the companies that provide them are not held to account for the security of their products. The companies? More like the unpaid open source community volunteers who the Fortune 500 leech off contributing nothing in return except demands for free support, fixes and more features.

Npm is owned by Github, which is owned by Microsoft. They could have put more tooling into making npm better. For example; pnpm require you to "approve-builds" so that its only running scripts from dependencies you decide on, and Deno have a bunch of security capabilities to restrict what scripts can and can't do. There is always going to be supply chain attacks, and the biggest package repositories are going to be hit the most. But that doesn't mean that Microsoft couldn't have spent more on building better tooling with better security settings on by default.

Re: Oh no, not again a meditation on NPM supply chain attacks

#62

Post by mr90210 »

2d8a875f-39a2-4 wrote: post #8

It's a stretch to pin blame on Microsoft. They're probably the reason the service is still up at all (TFA admits as much). In hindsight it's likely that all they wanted from the purchase was AI training material. At worst they're guilty of apathy, but that's no worse than the majority of npm ecosystem participants.

> It's a stretch to pin blame on Microsoft. They're probably the reason the service is still up at all.

I reckon that the ecosystem would have been much healthier if NPM had not been kept running without the care it requires.

Re: Oh no, not again a meditation on NPM supply chain attacks

#63

Post by tanepiper »

cube00 wrote: post #2

> The tools we use to build software are not secure by default, and almost all of the time, the companies that provide them are not held to account for the security of their products. The companies? More like the unpaid open source community volunteers who the Fortune 500 leech off contributing nothing in return except demands for free support, fixes and more features.

Author of the article here - holistically this isn't just about NPM dependencies, it's the entire stacks we work with. Cloud vendors provide security, but out of the box they don't provide secure platforms - a lot of this is left up to developers, without security experts - this is dangerous - I have 25 years of experience and I wouldn't want to touch the depths of RBAC.

SaaS products don't enforce good security - I've seen some internally that don't have MFA or EntraID integration because they simply don't have those as features (mostly legacy systems these days, but they still exist).

I'm also an open-source author (I have the most used bit.ly library on npm - and have had demands and requests too), and I'm the only person you can publicly see on our [company github](https://github.com/ikea) - there's reasons for this - but not every company is leeching, rather there is simply no other alternative.

Re: Oh no, not again a meditation on NPM supply chain attacks

#64

Post by Arch-TK »

clbrmbr wrote: post #30
watwut wrote: post #22

Earlier quoted context omitted.

Per survey I read, majority of open source is created by people who are paid for it. The unpaid volunteer working full time on something is effectively a myth.

It depends on the domain. There are a lot of critical utilities in the systems space maintained by volunteers. The “xz” compression library was one recent infamous example where an exhausted volunteer maintainer was social engineered into a supply chain attack that briefly compromised OpenSSH. Not a lot of applications being maintained by altruists, but look under the hood in Linux/GNU/BSD and you fill find a lot of…

It briefly compromised the custom patched Debian version of OpenSSH. The issue had nothing to do with OpenSSH itself.

Re: Oh no, not again a meditation on NPM supply chain attacks

#65

Post by throw-qqqqq »

watwut wrote: post #43
austin-cheney wrote: post #38

Earlier quoted context omitted.

I don’t think that is correct. VS Code developers and the TypeScript team is paid by MS. Core of React is paid by Meta, or was. Java language is paid by Oracle as is the LiberaSuite and MySQL. Most of the Linux foundation projects, which includes Node are volunteers. Most of the Apache foundation software is from volunteers. Most NPM packages are from volunteers. OpenSSL is volunteers. There is also a big difference…

> Linux foundation projects, which includes Node are volunteers. The survey found that specifically linux code is dominated by people who are paid for it. > Most of the Apache foundation software is from volunteers. Large Apache project specifically are backed by companies per Apache rules. Each project must have at least three active backing companies. They contribute the most of the code.

> The survey found that specifically linux code is dominated by people who are paid for it.

Yes the kernel code, but the Linux Foundation projects (mentioned in the comment you quote) are MUCH more than the kernel.

See the list on https://www.linuxfoundation.org/projects

Re: Oh no, not again a meditation on NPM supply chain attacks

#67

Post by [deleted] »

apimade wrote: post #40

Here’s a one-liner for node devs on MacOS, pin your versions and manually update your supply chain until your tooling supports supply chain vetting, or at least some level of protection against instantly-updated malicious upstream packages. Would love to see some default-secure package management / repo options. Even a 24 hour delayed mirror would be better than than what we have today. find . -name package.json -not…

[deleted]

Re: Oh no, not again a meditation on NPM supply chain attacks

#68

Post by brookst »

snickerdoodle14 wrote: post #60
stingraycharles wrote: post #55

Earlier quoted context omitted.

Isn’t all this stuff with Secure Enclave supposed to address these kind of things? It’s my take that over the past ~ decade a lot of these companies have been making things a lot better, Windows even requires secure boot these days as well.

Not really, those technologies are basically designed to be able to enforce DRM remotely. Secure Enclave = store the encryption keys to media in a place where you can't get them Secure Boot = first step towards remote attestation so they can remotely verify you haven't modified your system to bypass the above Advertising rules the world.

How is that different?

Is there such a thing as secure hardware that can prevent supply chain attacks (by enabling higher layers to guarantee security) and secure hardware that prevents copying data (by enabling higher layers to guarantee security)?

Re: Oh no, not again a meditation on NPM supply chain attacks

#69

Post by righthand »

2d8a875f-39a2-4 wrote: post #8

It's a stretch to pin blame on Microsoft. They're probably the reason the service is still up at all (TFA admits as much). In hindsight it's likely that all they wanted from the purchase was AI training material. At worst they're guilty of apathy, but that's no worse than the majority of npm ecosystem participants.

It’s NOT a stretch to blame Microsoft. How many billions have we spent chasing “AI”? These issues could have been easily solved if we spent the consideration on them. This has been going on well over a decade.

Microsoft isn’t any better steward than the original teams.

This issue has happened Plenty under Microsoft’s ownership.

Re: Oh no, not again a meditation on NPM supply chain attacks

#70

Post by ants_everywhere »

cube00 wrote: post #2

> The tools we use to build software are not secure by default, and almost all of the time, the companies that provide them are not held to account for the security of their products. The companies? More like the unpaid open source community volunteers who the Fortune 500 leech off contributing nothing in return except demands for free support, fixes and more features.

> More like the unpaid open source community volunteers who the Fortune 500 leech off contributing nothing in return except demands for free support, fixes and more features.

People who work on permissively licensed software are donating their time to these Fortune 500 companies. It hardly seems fair to call the companies leeches for accepting these freely given donations.

Post reply on HN