Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dependabot version updates introduce default package cooldown

github.blog

Post reply on HN
Print view View original

71–80 of 154 posts

Re: Dependabot version updates introduce default package cooldown

#71

Post by stingraycharles »

bitmasher9 wrote: post #67
zarzavat wrote: post #62

Earlier quoted context omitted.

A distro package manager provides access to a small set of packages that the distro thinks you might like. A language package manager provides access to the full set of packages. The language level package manager is solving a more ambitious problem. Distro package managers don't solve the problem they just punt on it, saying "you can add an unofficial source but you're on your own to maintain security". I agree with…

Debian stable has over 69,000 packages, which is more then some languages have…

It’s not about quantity but target audience and use case. They solve different problems.

Re: Dependabot version updates introduce default package cooldown

#72

Post by jjmarr »

Waterluvian wrote: post #52
JoshTriplett wrote: post #42

Earlier quoted context omitted.

> I’m convinced that updating so much more often is worse, not better. The issue of cooldowns aside (which is about delaying updates, not reducing their frequency): you're going to have the same set of problems when you update, whether you do it frequently or infrequently. The difference is that if you update frequently, you'll have a smaller set of updates (so it's easier to debug) and you'll have more opportunity t…

My logical read of the situation is that I end up making fewer overall changes if I end up upgrading a dependency once, not thrice, to a specific version. And the changes are their own source of risk.

In reality, one massive update is too big to digest and it never happens. So you're stuck on out-of-date packages having lost the ability to update.

That's never a problem until it suddenly is. Company is put at significant risk (courts want to reason by analogy and "engineers skipped maintenance and endangered people" is an easy one) and nobody is to blame since nobody owned the task.

Re: Dependabot version updates introduce default package cooldown

#73

Post by bitmasher9 »

stingraycharles wrote: post #71
bitmasher9 wrote: post #67

Earlier quoted context omitted.

Debian stable has over 69,000 packages, which is more then some languages have…

It’s not about quantity but target audience and use case. They solve different problems.

I don’t understand how they aren’t both generalized to “distributes software with versioning at a large scale”

Re: Dependabot version updates introduce default package cooldown

#74

Post by stingraycharles »

bitmasher9 wrote: post #73
stingraycharles wrote: post #71

Earlier quoted context omitted.

It’s not about quantity but target audience and use case. They solve different problems.

I don’t understand how they aren’t both generalized to “distributes software with versioning at a large scale”

Because they both have very different management processes (centralized vs distributed) and release cycles. They solve different problems.

Re: Dependabot version updates introduce default package cooldown

#75

Post by drdexebtjl »

brookst wrote: post #41
drdexebtjl wrote: post #36

Earlier quoted context omitted.

Every single one now will be more sneaky, and we’ll be operating on a 3-day cooldown for no reason.

You really think it has zero benefit whatsoever? Nothing malicious will be caught?

Pretty much. These tools are effective now only because the malware doesn’t have to avoid being detected at all to be successful.

Re: Dependabot version updates introduce default package cooldown

#76

Post by cmeacham98 »

bitmasher9 wrote: post #73
stingraycharles wrote: post #71

Earlier quoted context omitted.

It’s not about quantity but target audience and use case. They solve different problems.

I don’t understand how they aren’t both generalized to “distributes software with versioning at a large scale”

The difference comes from the fact distro maintainers choose the software they package, while language maintainers largely don't.

For example, how do you prevent somebody from phishing/typosquatting users with a package named similarly to a popular one? For distro maintainers the answer is simple - don't package it. Debian is unlikely to add a "f1refox" package. Language maintainers don't have that luxury.

Re: Dependabot version updates introduce default package cooldown

#77

Post by pixl97 »

cmckn wrote: post #66
zihotki wrote: post #15

If everyone starts applying cooldowns, won't it postpone the problem? So now there is a considerable amount of users who are affected and someone from the affected group discovers the infection and reports it. But if everyone will be delaying updates, won't be there less chances to catch it in time? I'm not fully sure if it's possible to preventively scan all NPM packages or how much compute it would require.

I agree, it’s just the wrong approach. As a user, there’s no way to know if a package has been audited during the cooldown by some generous cybersecurity firm before you pull it in, it’s just wishful thinking. Minimizing your dependencies is a more effective strategy against supply chain attacks.

Hence by writing your own code with its own set of vulns to be detected.

Re: Dependabot version updates introduce default package cooldown

#78

Post by pixl97 »

drdexebtjl wrote: post #36
tabwidth wrote: post #33

Earlier quoted context omitted.

Most of the malicious ones just curl something in a postinstall script, scanners already catch that. The sneaky ones don't look malicious until they run, and three days may not help.

Every single one now will be more sneaky, and we’ll be operating on a 3-day cooldown for no reason.

How exactly does that work?

I don't think that HNers understand the recent supply chain attacks very well at all. I also don't think they realize the tests the SCA/package providers do to all the major packages.

Almost all these attacks try to reach out to external sites to steal your data. That is exceptionally hard to hide in any meaningful way.

Re: Dependabot version updates introduce default package cooldown

#79

Post by bitmasher9 »

cmeacham98 wrote: post #76
bitmasher9 wrote: post #73

Earlier quoted context omitted.

I don’t understand how they aren’t both generalized to “distributes software with versioning at a large scale”

The difference comes from the fact distro maintainers choose the software they package, while language maintainers largely don't. For example, how do you prevent somebody from phishing/typosquatting users with a package named similarly to a popular one? For distro maintainers the answer is simple - don't package it. Debian is unlikely to add a "f1refox" package. Language maintainers don't have that luxury.

I think that’s a difference in implementation details, not a difference in what it fundamentally is.

I’m not arguing that there aren’t differences between the two, I’m arguing that they are fundamentally the same solution (gather all of the software in one location with) to same problem (how can I safely download some software).

Re: Dependabot version updates introduce default package cooldown

#80

Post by drdexebtjl »

pixl97 wrote: post #78
drdexebtjl wrote: post #36

Earlier quoted context omitted.

Every single one now will be more sneaky, and we’ll be operating on a 3-day cooldown for no reason.

How exactly does that work? I don't think that HNers understand the recent supply chain attacks very well at all. I also don't think they realize the tests the SCA/package providers do to all the major packages. Almost all these attacks try to reach out to external sites to steal your data. That is exceptionally hard to hide in any meaningful way.

    def steal_your_data():
      if datetime.now()
Post reply on HN