NPM's release cooldown is security theater
blog.outv.im
NPM's release cooldown is security theater
1–10 of 78 posts
Re: NPM's release cooldown is security theater
#2> If everyone sets a cooldown, there will be no early adopter. Everyone is waiting for everyone else to be the canary, and the canary does not exist.
Except there are researchers chomping at the bit to download every new release of packages in search of vulnerabilities they can exchange for fiat, reputational credit, or both.
Re: NPM's release cooldown is security theater
#3> If everyone sets a cooldown, there will be no early adopter.
This ignores all the security companies & researchers screening packages.
Re: NPM's release cooldown is security theater
#4I think the author is just totally ignorant, there's a whole community of security companies and researchers who are scanning every single package as it's released and have been doing so for some time now. Some of the details like how long the cooldown should be for are certainly up in the air, but the numbers have reasoning behind them.
Re: NPM's release cooldown is security theater
#5> If everyone sets a cooldown, there will be no early adopter. This ignores all the security companies & researchers screening packages.
Also ignores the common vector of the maintainer getting compromised and their credentials immediately being used to push malware.
Most maintainer are going to notice that themselves.
Re: NPM's release cooldown is security theater
#6I don't agree with this take, there are a bunch of security companies that are screening new versions of packages looking for vulnerabilities, so waiting a bit before upgrading to the lastest package is miles better than immediately upgrading.
Re: NPM's release cooldown is security theater
#7The archaic model where every tool gets full access to your home directory was never designed for the scenario where a single npm install will install and execute 100s of packages written by various authors.
One should sandbox all npm command executions.
Re: NPM's release cooldown is security theater
#8I do not use NPM. Works like a charm. Your mileage may vary
Re: NPM's release cooldown is security theater
#9I don't disagree with this take. But I'm not going to risk installing a package uploaded 1 hour ago considering all of the compromises this year. I think a cooldown period is prudent to let the automated security scanners to do their thing.
Re: NPM's release cooldown is security theater
#10The archaic model where every tool gets full access to your home directory was never designed for the scenario where a single npm install will install and execute 100s of packages written by various authors. One should sandbox all npm command executions. https://github.com/ashishb/amazing-sandbox
This is what I'm transitioning to. All third-party code runs in isolated containers: node/npm, python/pip.