My comment yesterday, which received one downvote and which I will repeat if/until they’re gone: HTTP and JS have to go. There are ways to replace them.
One downvote is not enough.
Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised
121–130 of 1001 posts
Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised
#122I think these kinds of attack would be strongly reduced if js had a strong standard library.
If it was provided, it would significantly trim dependency trees of all the small utility libraries.
Perhaps we need a common community effort to create a “distro” of curated and safe dependencies one can install safely, by analyzing the most popular packages and checking what’s common and small enough to be worth being included/forked.
Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised
#123Earlier quoted context omitted.
How do you manage secrets for your projects?
One option is pass, which is a shell script that uses GPG to manage passwords for command line tools. You can put the password store into a git repository if you need to sync it across machines.
Wait, what? "put the password store into a git repository"?!
Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised
#124We've seen many reports of supply chain attacks affecting NPM. Are these symptoms of operational complexity, which can affect any such service, or is there something fundamentally wrong with NPM?
There is a guy (ljharb) who is literally on TC39 - JavaScript specification committee - who is maintaining like 600 packages full of polyfills/dependencies/utilities. It's just javascript being javascript.
There was a huge uproar about that guy specifically and deep dependency graphs in general a year ago. A lot has already changed for lots of the popular frameworks and libraries. Dependency graphs are already much slimmer. The cultural change is happening, but we can't expect it to happen all at once.
Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised
#125I knew npm was a train wreck when I first used it years ago and it pulled in literally hundreds of dependencies for a simple app. I avoid anything that uses it like the plague.
I can tell a lot about a dev by the fact that they single out npm/js for this supply chain issue.
I think it’s just that a lot of old men don’t like how popular it has become with script kiddies.
Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised
#126I'm coming to the unfortunate realizattion that supply chain attacks like this are simply baked into the modern JavaScript ecosystem. Vendoring can mitigate your immediate exposure, but does not solve this problem. These attacks may just be the final push I needed to take server rendering (without js) more seriously. The HTMX folks convinced me that I can get REALLY far without any JavaScript, and my apps will probab…
HTMX is full of JavaScript. Server-side-rendering without JavaScript is just back to the stuff Perl and PHP give you.
Do you count LiveView (Elixir) in that assessment?
Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised
#127This happens because there's no auditing of new packages or versions. The distro's maintainer and the developer is the same person. The general solution is to do what Debian does. Keep a stable distro where new packages aren't added and versions change rarely (security updates and bugfixes only, no new functionality). This is what most people use. Keep a testing/unstable distro where new packages and new versions can…
> suffer from this problem
Benefit from this feature.
Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised
#128Is there a theoretical framework that can prevent this from happening? Proof-carrying code?
You can protect yourself using existing tools, but it's not trivial and requires serious custom work. Effectively you want minimal permissions and loud failures. This is something I'm trying to polish for my system now, but the idea is: yarn (and bundler and others) needs to talk only to the repositories. That means yarn install is only allowed outbound connections to localhost running a proxy for packages. It can on…
Why yarn instead of pnpm?
Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised
#129Earlier quoted context omitted.
> Until you go get malware While technically true, I have yet to see Go projects importing thousands of dependencies. They may certainly exist, but are absolutely not the rule. JS projects, however... We have to realize, that while supply chain attacks can happen everywhere, the best mitigations are development culture and solid standard library - looking at you, cargo. I am a JS developer by trade and I think that t…
Here's an example off the top of my mind: https://github.com/go-gitea/gitea/blob/main/go.sum
Half of go.sum dependencies generally are multiple versions of same package. 400 still a lot, but a huge project like gitea might need them I guess.
> cat go.sum |awk '{print $1}' | sort |uniq |wc -l
431
> wc -l go.sum
1156 go.sum
Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised
#130Earlier quoted context omitted.
How do you manage secrets for your projects?
Using a password manager for fetching them when needed. 1Password in my case, but I'm sure any password manager can be used for storing secrets for most programming projects.
Fun fact : Bitwarden’s cli is written in JavaScript and needs Node.js to run.