Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Oh no, not again a meditation on NPM supply chain attacks

tane.dev

Post reply on HN
Print view View original

191–200 of 235 posts

Re: Oh no, not again a meditation on NPM supply chain attacks

#191

Post by watwut »

sarchertech wrote: post #28
ricardobeat wrote: post #23

Earlier quoted context omitted.

I find this perspective harmful to OSS as a whole. It is completely fine to release free software that other companies can use without restrictions, if you desire to do so. It is not meant to be a transaction. You share some, you take some. It’s also ok to release paid free software, or closed software, restrictive licenses, commercial licenses, and sell support contracts. It’s a choice.

Just because you can do something doesn’t mean you should. There’s also lot of pressure for devs not to use licenses that restrict use by large companies. Try adding something to your license that says companies making over $10 million per year in revenue have to pay, and half of the comments on show HN will be open source warriors either asking why you didn’t use a standard license or telling you that this isn’t ope…

The most likely and common result of releasing an open source project is that everyone ignores you. If they notice, you may get a question about license once in a while which you can ignore.

Re: Oh no, not again a meditation on NPM supply chain attacks

#192

Post by watwut »

josephg wrote: post #137
watwut wrote: post #80

Earlier quoted context omitted.

npm was a company for years now. It was initially created as a volunteer one person project, then they create company 10 years ago and eventually sold to Github which was sold to Microsoft. It has spent more time being developed as a paid thing then by unpaid volunteers doing it on the side.

I'm not talking about npm. I'm talking about the 3.1 million libraries hosted on npm. And the ~150k libraries available in rust's cargo, 187k ruby gems, 667k pip packages, and so on. For every React ("brought to you by facebook") there are thousands of tiny projects made for free by volunteers.

I have some there, two of them made on the clock on the job. For others I am 100% ok with them being used in the scope of the license. I would find it incredibly absurd if someone called users "leeches" for using these things.

Re: Oh no, not again a meditation on NPM supply chain attacks

#193

Post by FuriouslyAdrift »

watwut wrote: post #77
MrGilbert wrote: post #48

Earlier quoted context omitted.

> Nobody has the time I'd erase that part entirely, as it is not true, from my point of view. My day, as has every other person's day, has exactly 24 hours. As an employee, part of that time is dedicated to my employer. In return, I receive financial compensation. It's up to them to decide how they want to spend the resources they acquired. So yes, each and every company could, in theory, contribute back to Open Sour…

> In a highly capitalized world, where share holder value is more worth than anything else, there are only a few companies that do the right call and act responsible. It is not just that. In a well functioning theoretical free market, no one is going to have time either. The margins are supposed to end up being tight and the competition is supposed to weed out economic inefficiency. Voluntary pro-social behavior is a…

Basically... Japan

Re: Oh no, not again a meditation on NPM supply chain attacks

#194

Post by preommr »

user34283 wrote: post #126
hu3 wrote: post #113

My non-solution years ago was to use as little dependencies as possible. And vendor node_modules then review every line of code changed when I update dependencies. Not every project and team can do that. But when feasible, it's a strong mitigation layer. What worked was splitting dependency diff review among the team so it's less of a burden. We pin exact versions and update judiciously.

You can't realistically do that when for example you use Jest as your test runner, which alone would add 300 packages. ESLint would be another culprit, adding 80 packages. It quickly gets out of hand. To me it seems like the fewest projects could use this approach you described.

I've resorted to just running custom scripts with if statements instead of fancy assertions.

But occasionally I'll use vitest as well which has the same api as jest, and is much simpler. Especially if vite is already being used. It has a much smaller dependency tree.

Re: Oh no, not again a meditation on NPM supply chain attacks

#195

Post by trolleski »

ants_everywhere wrote: post #110
JensRantil wrote: post #96

Earlier quoted context omitted.

It's not just time. A lot of devs simply don't have the experience of dogging into third party sourcing code or understanding how one contributed to open source.

By "a lot of devs" do you mean devs at these companies? If so I think this is a good point. It's easy to see from any one open source project's perspective how a little help would go a long way. But it's really hard to see from the perspective of a company with a massive code base how you could possibly contribute to the ten gajillion dependencies you use, even if you wanted to. People will say things like "Why doesn…

jUsT uSE AI, dUh?

Re: Oh no, not again a meditation on NPM supply chain attacks

#196

Post by jacques_chester »

I disagree with theses in this piece.

1. "2FA doesn't work". Incorrect. MFA relying on SMS or TOTP is vulnerable to phishing. Token or device based is not. And indeed GitHub sponsored a program to give such tokens away to critical developers.

In 2021.

2. "There's no signing". Sigstore support shipped in like 2023.

The underlying view is that "Microsoft isn't doing anything". They have been. For years. Since at least 2022, based on my literal direct interactions with the individuals directly tasked to do the things that you say aren't or haven't been done.

I have no association with npm, GitHub or Microsoft. My connection was through Shopify and RubyGems. But it really steams me to see npm getting punched up with easily checked "facts".

Re: Oh no, not again a meditation on NPM supply chain attacks

#197

Post by thombles »

izacus wrote: post #81
thombles wrote: post #6

I think if somebody wants to see library distribution channels tightened up they need to be very specific about what they would like to see changed and why it would be better, since it would appear that the status quo is serving what people actually want - being able to create and upload packages and update them when you want. > But right now there are still no signed dependencies and nothing stopping people using AI…

What are you talking about, NPM keeps having issues that "status quo" of other platforms doesn't.

Crates.io had a major phishing campaign just the other day, but no major hacks yet as far as I know. Is that because they do something special that NPM has failed to do? Or is it just that NPM is a big and juicy target?

Re: Oh no, not again a meditation on NPM supply chain attacks

#198

Post by [deleted] »

brookst wrote: post #73
ricardobeat wrote: post #53

Earlier quoted context omitted.

> someone else’s work It is not “their” work anymore (IP rights discussions aside) once they published with an unrestricted license. That’s the point. You do it expecting nothing in return, and do it willingly. Expecting “fairness” is a misunderstanding of the whole spirit of it.

Semantic games with “their work”. An artist who sells a painting can still call it their work, even if someone else owns it. And I suppose the collector who bought it could also call it their work, though that phrasing isn’t usually used. It comes about because “work” is overloaded to mean both the activity of creating and the product/result of that activity.

[deleted]

Re: Oh no, not again a meditation on NPM supply chain attacks

#199

Post by rayhan0x01 »

homebrewer wrote: post #25

Here's a short recap of what you can do right now, because changing the ecosystem will take years, even if "we" bother to try doing it. 1. Switch to pnpm, it's not only faster and more space efficient, but also disables post-install scripts by default. Very few packages actually need those to function, most use it for spam and analytics. When you install packages into the project for the first time, it tells you what…

[dead]

Re: Oh no, not again a meditation on NPM supply chain attacks

#200

Post by hu3 »

user34283 wrote: post #159
hu3 wrote: post #148

Earlier quoted context omitted.

You usually can. You just gotta be a bit adventurous. https://github.com/lukeed/uvu is a testing library with almost no dependency. https://github.com/biomejs/biome is a linter written in Rust which in theory has a smaller attack surface. And as long as you stay some versions behind bleeding edge, you can use time in your favor to catch supply chain attacks before they reach your codebase.

Well, can you? Maybe you can. Or you're talking about an approach you utilized in some side projects rather than moderately sized commercial web applications? I don't imagine there's many out there that have less than hundreds of dependencies.

I'm talking about large, enterprise, projects.

Just because the project is large doesn't mean we should give up on reducing dependencies.

Hundreds is much better than thousands.

Post reply on HN