161–170 of 329 posts
‘No way to prevent this’, Says Only Development Community Where This Regularly Happens — https://itnext.io/no-way-to-prevent-this-says-only-developme... >
I can't wait for npm/github to do literally anything at all to mitigate these attacks. Literally anything. Have we considered a basic WAF-style block on some postinstall script strings? LLM-assisted code scanning on publish? Is there anyone home? No I suspect not.
Third parties can detect compromised packages. It’s ridiculous Microsoft doesn’t.
Edit: a more suitable strategy is to do the minimal necessary actions for appearance purposes only, as its how to focus and optimize on its interest for revenue for its shareholders.
What would be the required budget to host an alternative registry? I'm surprised any GAFAM still hasn't stepped-in and started building their alternative, at least for NPM to up its game in order not to become completely irrelevant.
‘No way to prevent this’, Says Only Development Community Where This Regularly Happens — https://itnext.io/no-way-to-prevent-this-says-only-developme... >
Language exclusive package managers like this are nightmares for security, but npm simply does things so poorly I feel like they wanted something insecure.
Earlier quoted context omitted.
Language exclusive package managers like this are nightmares for security, but npm simply does things so poorly I feel like they wanted something insecure.
What about language exclusivity makes a package manager a security nightmare?
> Docker Container Escape > The payload checks for the Docker socket and, if present, attempts container escape through three sequential methods: So even if you're running devcontainers / VMs, these worms are already trying to escape. Make sure you're running a rootless VM engine (e.g. podman instead of docker) !
Why not run a proper virtual machine?
> In regards to the whole ecosystem: TC39 should take a look into adding a better standard library to JS itself, which would reduce the amount of one-liner packages. I concur, the best part of working with Deno way back was its standard library [0] and overall complete dev environment. It is just so damn obvious that a runtime comes with an integrated test runner and assertion library. 0 - https://docs.deno.com/runti…
Do any language standard libraries have a "3 hours ago" formatter? Thats what timeago.js does
Maybe slice.js, which just does python-style indexing with negative numbers. TC39 already made array.at() and array.slice() handle negative numbers.
‘No way to prevent this’, Says Only Development Community Where This Regularly Happens — https://itnext.io/no-way-to-prevent-this-says-only-developme... >
The "No way to prevent this" analogies seem to me to work better for Memory Safety because, as with Gun Safety, the simple fact is that everybody knows how to solve the problem, but one group insists it's impossible. There is crowing from the "Actually copy-paste is better" people when this happens, but when it's their turn they just jam their fingers in their ears. The memory safety and gun safety problems are the a…
I'm not following. Whats the 2nd Amendment equivalent for memory safety? The amount of C/C++ in production or something?
What would be the required budget to host an alternative registry? I'm surprised any GAFAM still hasn't stepped-in and started building their alternative, at least for NPM to up its game in order not to become completely irrelevant.
at amazon, they maintain a private internal registry of packages with approved licenses and audits. this has been in place for several years. i assume other big corps enforce similar policies