Live data from Hacker News

The solution the supply chain problems is removing your deps from .gitignore

news.ycombinator.com

11–13 of 13 posts

Re: The solution the supply chain problems is removing your deps from .gitignore

#11
post #7

Earlier quoted context omitted.

> If you already had left pad cached then you were not affected by its disappearance. The evidence of course is that when you say "left pad" no one knows what you're referring to because nothing bad ever happened. > If a package needs an install script to be used, to compile some native code for example, you still need to run the install script before you can use the package. This already sounds like a giant red fuck…

> There is 100% benefit in running that shit in a development environment. Most of the recent supply chain attacks specifically target stealing secrets from development environments. > But hey thanks for proving me right about the unhinged complaints. I'm sorry if I'm upsetting you, but I am not complaining or trying to provoke you. "Just check in the dependencies and review them" is not a revolutionary idea. It make…

> Most of the recent supply chain attacks specifically target stealing secrets from development environments.

If your secrets in a dev environment can actually do any damage if leaked, you're doing something very fucking wrong.

> React's last minor version bump included 100 files and ~5k changes.

So you're choosing over engineered dependencies and then complaining they're too big.

Somehow I think the problem, as usual, started with the meat sack on the chair.

Re: The solution the supply chain problems is removing your deps from .gitignore

#12

Earlier quoted context omitted.

> There is 100% benefit in running that shit in a development environment. Most of the recent supply chain attacks specifically target stealing secrets from development environments. > But hey thanks for proving me right about the unhinged complaints. I'm sorry if I'm upsetting you, but I am not complaining or trying to provoke you. "Just check in the dependencies and review them" is not a revolutionary idea. It make…

> Most of the recent supply chain attacks specifically target stealing secrets from development environments. If your secrets in a dev environment can actually do any damage if leaked, you're doing something very fucking wrong. > React's last minor version bump included 100 files and ~5k changes. So you're choosing over engineered dependencies and then complaining they're too big. Somehow I think the problem, as usua…

I think we may be talking past each other at this point, but secrets from a dev env can be more valuable than secrets from a production env.

With things necessary for a dev env, like read/write access to source control, attackers can get access to internal data, and push malicious code that gets run in a prod env anyway.

If you want to make the claim that using react is an insane indefensible choice from a security standpoint, you are being idealistic at best.

Telling people not to use react does not help anyone, and that type of recommendation causes reputational damage to the security industry.

Re: The solution the supply chain problems is removing your deps from .gitignore

#13

Earlier quoted context omitted.

> Most of the recent supply chain attacks specifically target stealing secrets from development environments. If your secrets in a dev environment can actually do any damage if leaked, you're doing something very fucking wrong. > React's last minor version bump included 100 files and ~5k changes. So you're choosing over engineered dependencies and then complaining they're too big. Somehow I think the problem, as usua…

I think we may be talking past each other at this point, but secrets from a dev env can be more valuable than secrets from a production env. With things necessary for a dev env, like read/write access to source control, attackers can get access to internal data, and push malicious code that gets run in a prod env anyway. If you want to make the claim that using react is an insane indefensible choice from a security s…

We are clearly talking about different things.

Access to source control is required on a developer workstation.

It is not required inside an application environment on that workstation (eg a VM or other such system that both provides a standard environment and creates separation)

I'm not making any claims about the security of react.

Post reply on HN