Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NPM's release cooldown is security theater

blog.outv.im

Post reply on HN
Print view View original

31–40 of 78 posts

Re: NPM's release cooldown is security theater

#31

Post by brabel »

hn_throwaway_99 wrote: post #18
paulryanrogers wrote: post #2

> If everyone sets a cooldown, there will be no early adopter. Everyone is waiting for everyone else to be the canary, and the canary does not exist. Except there are researchers chomping at the bit to download every new release of packages in search of vulnerabilities they can exchange for fiat, reputational credit, or both.

100% agree. I hated this post because it's all based on this unfounded assumption as an axiom, which it presents using zero evidence. Different groups have different risks tolerances, and it's absurd to think that nobody is going to pull releases before the default cool down period.

> it's absurd to think that nobody is going to pull releases before the default cool down period.

Why is that absurd? It seems like a more likely outcome than just assuming there are enough "security researchers" out there doing this for every package?! IMO both sides here seem to have no evidence that the other is wrong.

Re: NPM's release cooldown is security theater

#32

Post by rectang »

HawtAds wrote: post #21
paulryanrogers wrote: post #2

> If everyone sets a cooldown, there will be no early adopter. Everyone is waiting for everyone else to be the canary, and the canary does not exist. Except there are researchers chomping at the bit to download every new release of packages in search of vulnerabilities they can exchange for fiat, reputational credit, or both.

*champing at the bit

So I went down the rabbit hole of the meaning of "champ", thinking it might mean something esoteric in the context of "champing at the bit" like "speaking the first line of the skit". But no, "champ" as a verb is just an alternative version of "chomp", or at least a word that differs very subtly from "chomp".

https://www.merriam-webster.com/dictionary/champing%20at%20t...

https://www.merriam-webster.com/dictionary/champ

The migration of "champing at the bit" to "chomping at the bit" is inevitable.

There don't seem to be many idioms like this, where the newer version is both semantically intuitive/meaningful and accepted by authorities. The closest is probably "hone in on", but the verb form of "home" as in "homing device" is still current, unlike the verb form of "champ". Another interesting one is the migration from "just deserts", using an archaic meaning of "desert" as in something deserved, to the modern form "just desserts". However there's much greater distance between "desserts" and the archaic meaning of "deserts" than between "chomp" and "champ".

Re: NPM's release cooldown is security theater

#33

Post by grahar64 »

I'm pretty sure it isn't.

I actually proposed a cooldown for apt-get in my PhD thesis in 2013 and calculated its impact. Because the meta-data for the Ubuntu apt repository can be completely downloaded you can simulate the impact of a cooldown on how many less packages would be installed and it isn't zero.

There are always people in a community running beta version, or up to date versions. There will be less with a cool down, but then depending on how critical your system is you could adjust cooldown length

Re: NPM's release cooldown is security theater

#34

Post by hn_throwaway_99 »

How do posts like this make it to the top of HN? Nearly all the comments here are saying the same thing I thought:

1. Security researchers and companies are incentivized to install packages early.

2. Even without security patches, people and teams can still set the cooldown period that is appropriate to their risk tolerance. Even if someone in the wild does "get bit", it's better that a smaller number of people get bit than everyone getting bit at the same time. That's not "security theater", that's limiting the blast radius.

I'd also add that adding in cooldown periods lowers the incentives for bad guys to try to compromise a package in the first place because there is a much greater chance all their work will be for naught.

So I started reading this post with interest, thinking it would have some reason I hadn't thought of, but it just boils down to the faulty premise that "Godot is not coming". Bullshit, at the very least I now have agency over where I am in the download timeline. I just don't understand how such bad posts built on the flimsiest of assumptions make it to the top of HN.

Re: NPM's release cooldown is security theater

#35

Post by sudobash1 »

cpburns2009 wrote: post #9

I don't disagree with this take. But I'm not going to risk installing a package uploaded 1 hour ago considering all of the compromises this year. I think a cooldown period is prudent to let the automated security scanners to do their thing.

It also includes time to allow discovering of compromised accounts. If the owner of a popular package is hacked, this gives the owner a week to raise alarms about this.

Re: NPM's release cooldown is security theater

#36

Post by woodruffw »

The conventional meaning of “security theater” requires performance instead of effective action. But the author doesn’t reach that meaning: they claim that cooldowns don’t universalize, which then gets misconstrued into “security theater.”

I don’t agree with either claim: I don’t think they’re security theater, and I do think they universalize, contingent on there being security parties that are incentivized to scan packages.

The latter is a big assumption, but I think it’s a win for us either way: if supply chain companies are actually capable of defending us, then we win. But if it turns out they can’t serve as the cooldown vanguard, then we have great evidence that they shouldn’t be trusted at all.

Re: NPM's release cooldown is security theater

#38

Post by zasz »

hn_throwaway_99 wrote: post #18
paulryanrogers wrote: post #2

> If everyone sets a cooldown, there will be no early adopter. Everyone is waiting for everyone else to be the canary, and the canary does not exist. Except there are researchers chomping at the bit to download every new release of packages in search of vulnerabilities they can exchange for fiat, reputational credit, or both.

100% agree. I hated this post because it's all based on this unfounded assumption as an axiom, which it presents using zero evidence. Different groups have different risks tolerances, and it's absurd to think that nobody is going to pull releases before the default cool down period.

It's worded a bit strongly, but it encourages critical thinking about downloading dependencies, how vetting should work, and where the human factor comes in. I think the top comment was right that some security researchers will audit packages no matter what, but it's good to not take that for granted.

Re: NPM's release cooldown is security theater

#39

Post by wbl »

cpburns2009 wrote: post #37
Quothling wrote: post #29

I am so uncultured that I was wondering why on earth we were waiting for Godot... But it's of couse because it's THAT Godot and not the game engine.

What Godot is that? I'm only passingly familiar with the game engine.

The one who will come tomorrow. https://en.wikipedia.org/wiki/Waiting_for_Godot

Re: NPM's release cooldown is security theater

#40

Post by Hackbraten »

shengpuerh wrote: post #20
loloquwowndueo wrote: post #14

Depending on those vaunted “security researchers” to take point and find all vulnerabilities in all packages is also fairly naive. That process costs money and produces a fairly valuable result - why would they give it away for free? So this will inevitably evolve into targeting only the high-value most popular packages and the exploiters will retreat to the long tail of less-popular ones. Lower payoff? Sure, but bea…

Finding vulns in popular OSS and disclosing is probably good for your reputation as a security researcher, even if it's not immediately profitable.

How is that sustainable?

Are security researchers going to be doing free labor for you indefinitely for exposure?

Post reply on HN