Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dependency cooldowns turn you into a free-rider

calpaterson.com

Post reply on HN
Print view View original

41–50 of 131 posts

Re: Dependency cooldowns turn you into a free-rider

#41

Post by BlackFly »

I think what you actually want is audit sharing as the cooldown period. No audit shared with the community yet? The package is still in cooldown. Or you can risk it and run unaudited dependencies or audit it yourself and potentially share that.

It seems to me that many organizations are relying on other companies to do their auditing in any case, why not just admit that and explicitly rely on that? Choose who you trust, accept their audits. Organizations can perform or even outsource their own auditing and publish that.

https://mozilla.github.io/cargo-vet/

Re: Dependency cooldowns turn you into a free-rider

#42

Post by _3u10 »

ryanjshaw wrote: post #13

This doesn’t solve the problem either, which is that of the Confused Deputy [1]. An arbitrary piece of code I’m downloading shouldn’t be able to run as Ryan by default with access to everything Ryan has. We need to revitalize research into capabilities-based security on consumer OSs, which AFAIK is the only thing that solves this problem. (Web browsers - literally user “agents” - solve this problem with capabilities…

I’ve never seen code that is downloaded run itself. Why not be the change you want to see in the world and run sudo or spawn your browser in a jail. Or download as another user.

Re: Dependency cooldowns turn you into a free-rider

#44

Post by suzzer99 »

8cvor6j844qw_d6 wrote: post #17

Not everyone has the same update cycle. That's not free-riding. The framing around not being on the latest version as irresponsible doesn't hold up.

Yeah this. If I don't buy the new iPhone XX.0 but instead wait for XX.1, which could include software and hardware fixes, does that make me a free rider?

Re: Dependency cooldowns turn you into a free-rider

#45

Post by xg15 »

bnjemian wrote: post #9

Okay sure, but what happens when a high CVE is discovered that requires immediate patching – does that get around the Upload Queue? If so, it's possible one could opportunistically co-author the patch and shuttle in a vulnerability, circumventing the Upload Queue. If you instead decide that the Upload Queue can't be circumvented, now you're increasing the duration a patch for a CVE is visible. Even if the CVE disclos…

> Okay sure, but what happens when a high CVE is discovered that requires immediate patching

I'm pretty sure, once cooldowns are widely implemented, the first priority of attackers will become to convince people to make an exception for their update because "this is really really urgent" etc.

Re: Dependency cooldowns turn you into a free-rider

#46

Post by endymi0n »

_3u10 wrote: post #42
ryanjshaw wrote: post #13

This doesn’t solve the problem either, which is that of the Confused Deputy [1]. An arbitrary piece of code I’m downloading shouldn’t be able to run as Ryan by default with access to everything Ryan has. We need to revitalize research into capabilities-based security on consumer OSs, which AFAIK is the only thing that solves this problem. (Web browsers - literally user “agents” - solve this problem with capabilities…

I’ve never seen code that is downloaded run itself. Why not be the change you want to see in the world and run sudo or spawn your browser in a jail. Or download as another user.

Welcome to npm post-install scripts... https://docs.npmjs.com/cli/v11/using-npm/scripts

Re: Dependency cooldowns turn you into a free-rider

#48

Post by fendy3002 »

qsera wrote: post #31

One thing I don't understand about cooldowns is that it seems that if everybody uses cooldowns then there is no effective cooldown. Then you ll have to keep increase the cooldown period to get the advanatage...

there are parties that don't want that cooldown, libraries or software writers. XZ utils backdoor are found by Microsoft and Postgresql developer Andres Freund due to high CPU usage (or latency? CMIIW) during SSH tests, those are the people who will keep the same workflow.

Re: Dependency cooldowns turn you into a free-rider

#49

Post by Dedime »

The brilliance of the implementation of cooldowns: For someone to go download and run it, automated or otherwise, they simply follow the standard installation process.

Users who want take the extra precaution of waiting an additional period of time must decide to manually configure this with their tooling.

This practice has been a thing in the sysadmin community for years and years - most sysadmins know that you never install Windows updates on the day they release.

Having a step before publication means that's it's essentially opt-in pre-release software, and that comes with baggage - I have zero doubts that many entities who download packages to scan for malware explicitly exclude pre-release software, or don't discover it at all until it's released through normal channels.

Re: Dependency cooldowns turn you into a free-rider

#50

Post by burnto »

Yes the publish-distribute delay pattern looks like a reasonable design.

But you’re not a “free-rider” if you intentionally let others leap before you. You’re just being cautious, which is rational behavior and should be baked into assumptions about how any ecosystem actually works.

Post reply on HN