Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Disrupting supply chain attacks on NPM and GitHub Actions

github.blog

Post reply on HN
Print view View original

41–50 of 59 posts

Re: Disrupting supply chain attacks on NPM and GitHub Actions

#41

Post by [deleted] »

lrvick wrote: post #40
alpineman wrote: post #10

>> high-impact npm accounts are now put into a read-only mode for 72 hours when they change their email or use a 2FA recovery code. This delay allows maintainers time to respond and recover the account before their account can be used to start an attack. 'what time shall we put here?' 'what's the longest hangover you ever had?' 'let's put 72 hours'

I paid $8 for the recently expired email domain of the sole author of NPM package "foreach", so then control to ship any code I wanted to 70k companies was just a support ticket or password reset away. 72 hours would not make a difference here. Talked to NPM about this when it went viral, and once again all they could say was enabling package signing, even optionally, would discourage inexperienced people from contri…

[deleted]

Re: Disrupting supply chain attacks on NPM and GitHub Actions

#42

Post by TacticalCoder »

hinkley wrote: post #32
pluto_modadic wrote: post #12

the bare minimum award, for the only language and only registry where this regularly happens.

At this rate I'm going to have "npm is by far the worst thing about NodeJS" printed on my gravestone.

> "npm is by far the worst thing about NodeJS"

I'll come and add: "after JavaScript".

Re: Disrupting supply chain attacks on NPM and GitHub Actions

#43

Post by inigyou »

lrvick wrote: post #40
alpineman wrote: post #10

>> high-impact npm accounts are now put into a read-only mode for 72 hours when they change their email or use a 2FA recovery code. This delay allows maintainers time to respond and recover the account before their account can be used to start an attack. 'what time shall we put here?' 'what's the longest hangover you ever had?' 'let's put 72 hours'

I paid $8 for the recently expired email domain of the sole author of NPM package "foreach", so then control to ship any code I wanted to 70k companies was just a support ticket or password reset away. 72 hours would not make a difference here. Talked to NPM about this when it went viral, and once again all they could say was enabling package signing, even optionally, would discourage inexperienced people from contri…

Who chose to depend on "foreach"? Millions of ill-advised people did. The author did not choose that.

Re: Disrupting supply chain attacks on NPM and GitHub Actions

#45

Post by e40 »

lrvick wrote: post #40
alpineman wrote: post #10

>> high-impact npm accounts are now put into a read-only mode for 72 hours when they change their email or use a 2FA recovery code. This delay allows maintainers time to respond and recover the account before their account can be used to start an attack. 'what time shall we put here?' 'what's the longest hangover you ever had?' 'let's put 72 hours'

I paid $8 for the recently expired email domain of the sole author of NPM package "foreach", so then control to ship any code I wanted to 70k companies was just a support ticket or password reset away. 72 hours would not make a difference here. Talked to NPM about this when it went viral, and once again all they could say was enabling package signing, even optionally, would discourage inexperienced people from contri…

> Sorry, if you are unwilling to take 10 minutes to learn how to sign your code, you have no business maintaining software releases millions of people depend on. Full stop.

The crux of the problem is right here.

Re: Disrupting supply chain attacks on NPM and GitHub Actions

#46

Post by acdha »

zzo38computer wrote: post #36

My only use of GitHub Actions specifies permissions that only allow it to write to the issue tracker, so if the program it executes (which is the "gh" program) is malicious then the only damage it can cause is to the issue tracker and not to the repository itself (unless GitHub Actions itself is compromised). Furthermore, there are no private files (I do not host private files on remote services such as GitHub), so t…

> I think one thing that would help is to support mutual TLS, with X.509 certificate chains for authentication. This is more secure than personal access tokens

This adds an large amount of overhead and complexity (i.e. you now need to manage a revocation list) but you didn’t really explain any benefit which isn’t already present except for the possibility of restricting access to the private key. That can have some benefits — e.g. it’d be nice if you could say that releases can only be signed by a particular key stored on a Yubikey with a physical presence check – but I think most of the benefits come not from using x.509 but rather from fine-grained permissions.

Most of the attacks we’re seeing are escalation from an initial minor compromise where an attacker compromised something which had far greater permissions than needed for the task the attacker first exploited, as well as the broken design of GitHub Actions with mutable tags. I don’t think TLS gives us enough to take effort away from working on those.

Re: Disrupting supply chain attacks on NPM and GitHub Actions

#47

Post by doubled112 »

insanitybit wrote: post #39
summarybot wrote: post #34

Earlier quoted context omitted.

In my opinion, things like scanners should not need to exist if npm's parent company, GitHub, were to take responsibility for what was published to npm. If Walmart sells you an item that ends up being a handgrenade there would be hell to pay. In this example, Walmart cannot simply say that Walmart is not in charge of what goes into the item and therefore "buyer beware." Yet, this is precisely what GitHub does with ev…

Walmart and Github are so different. Walmart doesn't let anyone come in and set up a booth to sell things, Github does. Thinking that Github should take responsibility for what's hosted on it is... well, radical, to say the least. What you're suggesting is a radical departure from how free software has been distributed historically. That goes well beyond Github and NPM.

Would the metaphor have worked better if it was Amazon?

Walmart does allow other stores to sell through their website.

Re: Disrupting supply chain attacks on NPM and GitHub Actions

#48

Post by inigyou »

summarybot wrote: post #34
insanitybit wrote: post #29

Earlier quoted context omitted.

Cooldowns have the benefit of being straightforward. It doesn't rely on updating rules, scanning, keeping up with obfuscation techniques, etc. It just stops installs for a period of time after publish. I think that cooldowns are mostly dumb but they're very cheap to deploy and they do give other approaches (like scanners) more time to adapt/ do their job.

In my opinion, things like scanners should not need to exist if npm's parent company, GitHub, were to take responsibility for what was published to npm. If Walmart sells you an item that ends up being a handgrenade there would be hell to pay. In this example, Walmart cannot simply say that Walmart is not in charge of what goes into the item and therefore "buyer beware." Yet, this is precisely what GitHub does with ev…

You're suggesting that only stuff billionaires like should be allowed on GitHub or npm. No Monero libraries, for example, or YouTube downloaders.

Re: Disrupting supply chain attacks on NPM and GitHub Actions

#49

Post by acdha »

lrvick wrote: post #37

It is fascinating how far people will go to do anything else at all other than having authors cryptographically sign their packages like every Linux package manager that matters since 1996. Linux package managers like debian/apt also ship hundreds of signed NPM packages. In other words the unpaid Linux community has once again solved a problem Microsoft fundamentally failed to. Some things never change.

What keeps Linux distributions safer is that fewer people are able to push updates and there’s a time delay. The compromises are because people exploit release pipelines and if your build infrastructure is compromised it’ll merrily sign the compromised packages as well.

Re: Disrupting supply chain attacks on NPM and GitHub Actions

#50

Post by insanitybit »

doubled112 wrote: post #47
insanitybit wrote: post #39

Earlier quoted context omitted.

Walmart and Github are so different. Walmart doesn't let anyone come in and set up a booth to sell things, Github does. Thinking that Github should take responsibility for what's hosted on it is... well, radical, to say the least. What you're suggesting is a radical departure from how free software has been distributed historically. That goes well beyond Github and NPM.

Would the metaphor have worked better if it was Amazon? Walmart does allow other stores to sell through their website.

I would just drop the metaphor entirely since I don't think they're helpful. If you want to advocate for liability, I'd do so directly
Post reply on HN