Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pnpm has a new setting to stave off supply chain attacks

pnpm.io

Post reply on HN
Print view View original

11–20 of 152 posts

Re: Pnpm has a new setting to stave off supply chain attacks

#11

Post by progx »

OskarS wrote: post #6

I have a question: when I’ve seen people discussing this setting, people talk about using like ”3 days” or ”7 days” as the timeout, which seems insanely short to me for production use. As a C++ developer, I would be hesitant to use any dependency in the first six months of release in production, unless there’s some critical CVE or something (then again, we make client side applications with essentially no networking,…

Yes, but this is not only JS dependent, in PHP (composer) is the same.

Normally old major or minor packages don't get an update, only the latest.

E.g. 4.1.47 (no update), 4.2.1 (yes got update).

So if the problem is in 4.1 you must "upgrade" to 4.2.

With "perfect" semver, this shouldn't be a problem, cause 4.2 only add new features... but... back to reality, the world is not perfect.

Re: Pnpm has a new setting to stave off supply chain attacks

#12

Post by progx »

jonkoops wrote: post #10
progx wrote: post #9

That solve not really the problem. A better (not perfect) solution: Every package should by AI analysed on an update before it is public available, to detect dangerous code and set a rating. In package.json should be a rating defined, when remote package is below that value it could be updated, if it is higher a warning should appear. But this will cost, but i hope, that companies like github, etc. will allow package…

Ah, yes! The universal and uncheatable LLM! Surely nothing can go wrong.

As i wrote "not perfect". But better than anything else or nothing.

Re: Pnpm has a new setting to stave off supply chain attacks

#13

Post by progx »

jonkoops wrote: post #10
progx wrote: post #9

That solve not really the problem. A better (not perfect) solution: Every package should by AI analysed on an update before it is public available, to detect dangerous code and set a rating. In package.json should be a rating defined, when remote package is below that value it could be updated, if it is higher a warning should appear. But this will cost, but i hope, that companies like github, etc. will allow package…

Ah, yes! The universal and uncheatable LLM! Surely nothing can go wrong.

I can't wait to read about your solution.

Re: Pnpm has a new setting to stave off supply chain attacks

#14

Post by aa-jv »

fzeindl wrote: post #7
omnicognate wrote: post #4

Should have included the units in the name or required a choice of unit to be selected as part of the value. Sorry, just a bugbear of mine.

ISO8601 durations should be used, like PT3M.

Should be easy, just add the ISO8601-duration package to your project ..

/s

Re: Pnpm has a new setting to stave off supply chain attacks

#15

Post by robertlagrant »

progx wrote: post #12
jonkoops wrote: post #10

Earlier quoted context omitted.

Ah, yes! The universal and uncheatable LLM! Surely nothing can go wrong.

As i wrote "not perfect". But better than anything else or nothing.

The Politician's Syllogism[0] is instructive.

[0] https://en.wikipedia.org/wiki/Politician's_syllogism

Re: Pnpm has a new setting to stave off supply chain attacks

#16

Post by ozim »

OskarS wrote: post #6

I have a question: when I’ve seen people discussing this setting, people talk about using like ”3 days” or ”7 days” as the timeout, which seems insanely short to me for production use. As a C++ developer, I would be hesitant to use any dependency in the first six months of release in production, unless there’s some critical CVE or something (then again, we make client side applications with essentially no networking,…

NPM packages follow semantic versioning so minor versions should be fine to auto update. (there is still an issue what for package maintainer might be minor not being minor for you - but let's stick to ideal world for that)

I don't think people are having major versions updated every month, it is more really like 6 months or once a year.

I guess the problem might be people think auto updating minor versions in CI/CD pipeline will keep them more secure as bug fixes should be in minor versions but in reality we see it is not the case and attackers use it to spread malware.

Re: Pnpm has a new setting to stave off supply chain attacks

#17

Post by progx »

robertlagrant wrote: post #15
progx wrote: post #12

Earlier quoted context omitted.

As i wrote "not perfect". But better than anything else or nothing.

The Politician's Syllogism[0] is instructive. [0] https://en.wikipedia.org/wiki/Politician's_syllogism

OK, we are here now on reddit or facebook?

I thought we discuss here problems and possible solutions.

My fault.

Re: Pnpm has a new setting to stave off supply chain attacks

#18

Post by gausswho »

'Delayed dependency updates' is a response to supply-side attacks in the JavaScript world, but it aptly describes how I have come to approach technology broadly.

Large tech companies, as with most industry, have realized most people will pay with their privacy and data long before they'll pay with money. We live in a time of the Attention Currency, after all.

But you don't need to be a canary to live a technology-enabled life. Much software that you pay with your privacy and data has free or cheap open-source alternatives that approach the same or higher quality. When you orient your way of consuming to 'eh, I can wait till the version that respects me is built', life becomes more enjoyable in myriad ways.

I don't take this to absolute levels. I pay for fancy pants LLM's, currently. But I look forward to the day not too far away where I can get today's quality for libre in my homelab.

Re: Pnpm has a new setting to stave off supply chain attacks

#19

Post by [deleted] »

anematode wrote: post #3
postepowanieadm wrote: post #2

If everyone is going to wait 3 days before installing the latest version of a compromised package, it will take more than 3 days to detect an incident.

A lot of people will still use npm, so they'll be the canaries in the coal mine :) More seriously, automated scanners seem to do a good job already of finding malicious packages. It's a wonder that npm themselves haven't already deployed an automated countermeasure.

[deleted]
Post reply on HN