Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We all dodged a bullet

xeiaso.net

Post reply on HN
Print view View original

131–140 of 498 posts

Re: We all dodged a bullet

#131

Post by ilvez »

stickfigure wrote: post #43
dsff3f3f3f wrote: post #5

> These kinds of dependencies are everywhere and nobody would even think that they could be harmful. Tons of people think these kind of micro dependencies are harmful and many of them have been saying it for years.

It wouldn't be a problem if there wasn't a culture of "just upgrade everything all the time" in the javascript ecosystem. We generally don't have this problem with Java libraries, because people pick versions and don't upgrade unless there's good reason.

From maintenance perspective both never and always seem like extremes though.

Upgrading when falling off the train is serious drawback on moving fast..

Re: We all dodged a bullet

#132

Post by procaryote »

AlienRobot wrote: post #90

Isn't it a bit crazy that phishing e-mails still exist? Like, couldn't this be solved by encrypting something in a header and using a public key in the DNS to unencrypt it?

I might be missing the joke, but there are several layers like SPF and DMARC available to only allow your whitelisted servers to send email on the behalf of your domain.

Wouldn't help in this case where someone bought a domain that looked a tiny bit like the authentic one for a very casual observer.

Re: We all dodged a bullet

#133

Post by ameliaquining »

wongarsu wrote: post #127
zahlman wrote: post #104

Earlier quoted context omitted.

Yes, but this is an ecosystem large enough to include people who have that time (and inclination and ability); and once they have reported a problem, everyone is on high alert.

If you steal the cookies from dev machines or steal ssh keys along with a list of recent ssh connections or do any other credential theft there are going to be lots of people left impacted. Yes, lots of people reading tech news or security bulletins is going to check if they were compromised and preemptively revoke those credentials. But that's work , meaning even among those informed there will be many who just assu…

If a dev doesn't happen to run npm install during the period between when the compromised package gets published and when npm yanks it (which for something this high-profile is generally measured in hours, not days), then they aren't going to be impacted. So an attacker's patience won't be rewarded with many valid credentials.

Re: We all dodged a bullet

#135

Post by christophilus »

procaryote wrote: post #124
dsff3f3f3f wrote: post #5

> These kinds of dependencies are everywhere and nobody would even think that they could be harmful. Tons of people think these kind of micro dependencies are harmful and many of them have been saying it for years.

I've nixed javascript in the backend in several places, partly because of the weird culture around dependencies. Having to audit that for compliance, or keeping it actually secure, is a nightmare. Nixing javascript in the frontend is a harder sell, sadly

What did you switch to instead? I used to be a C# dev, and have done my fair share of Go. Both of those have decent enough standard libraries that I never found myself with a large 3rd party dependency tree.

Ruby, Python, and Clojure, though? They weren’t any better than my npm projects, being roughly the same order of magnitude. Same seems to be true for Rust.

Re: We all dodged a bullet

#136

Post by vel0city »

zahlman wrote: post #126
zargon wrote: post #73

Earlier quoted context omitted.

> leave yourself logged into the platform all the time Or only log in when you need to open a google link. Or better yet, use a multi-account container for google.

> Or better yet, use a multi-account container for google. Pardon; a what? Got any reference links?

A Firefox plugin/feature, probably also available on other browsers as well. It is useful for siloing cookies, so you can easily be logged into Google on one set of browser tabs and block their cookies on another.

https://addons.mozilla.org/en-US/firefox/addon/multi-account...

Re: We all dodged a bullet

#138

Post by joshuat »

pluto_modadic wrote: post #89
com2kid wrote: post #58

Earlier quoted context omitted.

> You're a criminal with a one-in-a-million opportunity. Wouldn't you invest an extra week pushing a more fledged out exploit? Because the way this was pulled off, it was going to be found out right away. It wasn't a subtle insertion, it was a complete account take over. The attacker had only hours before discovery - so the logical thing to do is a hit and run. They asked what is the most money that can be extracted…

"found out right away"... by people with time to review security bulletins. There's loads of places I could see this slipping through the cracks for months.

The window of installation time would be pretty minimal, and the operating window would only be as long as those who deployed while the malicious package was up waited to do another deploy.

Re: We all dodged a bullet

#140

Post by padjo »

“A utility function that determines if its argument can be used like an array”

I see the JavaScript ecosystem hasn’t changed since leftpad then.

Post reply on HN