Live data from Hacker News

Npm Audit: broken by design?

overreacted.io

201–210 of 268 posts

Re: Npm Audit: broken by design?

#201
post #175

Writing my comments in the snarky tone of the article. So the article boils down to “a bunch of these vulnerabilities aren’t applicable to my app which is built using a specific NPM package”. Congratulations. Welcome to the world of practical information security. As a security engineer, we’re lucky if your favorite package manager even associates vulnerability information with your packages. Never mind that you’re p…

The point is that if the feature is going to constantly produce false positives, it's useless. I concur with the author, I never check those warnings anymore.

It’s not a false positive, as described. It’s “mitigated by environment”. The vulnerability is real. The severity is arguably too high.

People throw around “false positive” as a catch-all for “I don’t care about this”. But there are a number of distinct reasons one might not care:

- the scanner is wrong (e.g. there’s a code bug in the scanner like detecting “printed” instead of “sprintf”.

- the output is wrong because the vulnerability isn’t a vulnerability anytime, anywhere under any circumstances

- the scanner is correct, but environment or mitigation’s mean it doesn’t apply to me or the severity is wrong in my environment (this is the case here)

- the scanner is correct, but is giving me output I don’t care about (eg I want to filter for only high/critical but I can’t)

- there is so much output that I can’t pay attention to all of it; it’s so overwhelming that I can’t stand to look at it

Many security products have problems with output that is too verbose. This seems like a trivial problem to work around here; after you’ve triaged that a particular vulnerability doesn’t apply to a particular project, then filter it out with grep -v (our put a bunch of such lines in a bash script and always pipe npm audit output to the script.

Also, I sympathize with concerns that the vulnerability reporter perhaps scored the vulnerability too high. But there’s no perfect solution for that, and I’d rather be aware of a vuln and choose to ignore it, than not be aware at all.

Re: Npm Audit: broken by design?

#202
post #175

Writing my comments in the snarky tone of the article. So the article boils down to “a bunch of these vulnerabilities aren’t applicable to my app which is built using a specific NPM package”. Congratulations. Welcome to the world of practical information security. As a security engineer, we’re lucky if your favorite package manager even associates vulnerability information with your packages. Never mind that you’re p…

As a security engineer, do you feel like the addition of npm audit is a net positive for the security of the npm ecosystem?

Net positive for awareness. Not sure I like the “force update with dependency that might break me”. NPM audit needs the ability to filter by severity and the ability for users to tune vuln severities per project.

Re: Npm Audit: broken by design?

#203
post #121

I guess we could have a documentary series! Next up, npm link: broken by design Synopsis of the chapter: A command with broken behavior that has been reported since as early as 2015, but that "got lost" every time the winds changed and the project decided to change where to manage bugs. What will happen in the latest attempt from an affected user? Tune in and be ready for an exciting ride! https://github.com/npm/cli/…

npm has been buggy for so long that it is actively driving me away from NodeJS.

I would like to wait to see if the rearchitecture for npm 7 actually allows them to test for regressions more productively, but at this point I don't know if I have the stamina to wait for my company to migrate to node 16.

Someone offers me a job doing Elixir or non-webapp stuff and I'm out. Probably permanently.

Re: Npm Audit: broken by design?

#204

> Inline all dependencies during publish… From a maintainer’s point of view, the upsides are clear: you get faster boot time, smaller downloads, and — as a nice bonus — no bogus vulnerability reports from your users. And when you inlined a version that later really does have a vulnerability, it is not easily flagged or fixed by your consumers. The tension between "upgrades (especially of indirect dependencies) might…

There is no magic bullet, no, but a lot of people are confused about how much less sense npm lockfiles make today than ruby lockfiles made when npm was still new.

Some of us are considerably salty about it. Especially the design-by-PR aspects of the whole thing that have resulted in confusing gyrations from one version to another.

Re: Npm Audit: broken by design?

#205
post #95

> Inline all dependencies during publish… From a maintainer’s point of view, the upsides are clear: you get faster boot time, smaller downloads, and — as a nice bonus — no bogus vulnerability reports from your users. And when you inlined a version that later really does have a vulnerability, it is not easily flagged or fixed by your consumers. The tension between "upgrades (especially of indirect dependencies) might…

Well said. I would add that I think the devDependencies solution is underrated. Not using it is a bad practice. npm has a nice feature, `npm prune --production` which will remove all the dev dependencies for you resulting in a clean build of the program. You can easily have things set up so that none of the development dependencies that have all these audit issues are ever present on your production machines if you d…

I'm currently using 'npm ci --prod', which means that they never get installed in the first place.

However it's incompatible with optionalPackages, so I'm carrying around some tertiary dependencies that are a small but noticeable fraction of the entire archive size.

Re: Npm Audit: broken by design?

#206

Earlier quoted context omitted.

Beautifully succinct. This quote: "Grey-hat hackers are rewarded based on the number and severity of CVEs that they write. This results in a proliferation of CVEs that have minor impact, or no impact at all, but which make exaggerated impact claims." Alignment of incentives is messed up. Goodhart-Strathern's and Campbell's laws apply.

Sounds like academic research publications. Sure, that will totally be a key step toward cancer therapy or better biofuels (realistically, the PI gets his jollies by shoving aldehyde groups onto random molecules)

Oh, you mean like the guys who tried to inject vulnerabilities into the linux kernel and got their entire university on Greg Kroah-Hartman's shit list? https://news.ycombinator.com/item?id=26887670

Re: Npm Audit: broken by design?

#207

Earlier quoted context omitted.

It's not really that crazy. This package is a small amount of code, but it's important code (the same goes for this package's dependency is-number). This package shows up in the dependency trees of some popular packages, which is probably where most of the weekly downloads come from. If you're writing straightforward application code where you already know you have a valid number, then this package probably isn't for…

leftpad was a small amount of code too. If it’s a small amount of code that’s design stable and downloaded often, it’s an extremely strong candidate for inclusion in the standard library.

It was added to the standard library: padStart

Re: Npm Audit: broken by design?

#208

Earlier quoted context omitted.

Having hundreds of developers work on the same code repository seems insanely complicated. What are the advantages? Where can I read more about monorepos?

They do not use an usual git repository. Companies using monorepos have tools to restrict people's access to parts of it, and filter log noise. Or, in other words, it's not that insanely complicated, because they have tools that make it look a lot like multiple repositories. And the large companies using multiple repositories have tools that make them look just like those monoreps. And HN has all those interesting th…

The feature I missed about Subversion was, if you could figure out how to treat your code like a proper tree, individual teams would check out one, maybe two directories, and only the leads and operational people ever had the whole thing.

I never entirely understood what it was in subversion's internals that prevented it from being used as a DCVS. We could figure out version numbers with branches and multiple repos. If not then, certainly now.

There's a space between subversion and Git that could be occupied with something that sheds the worst behaviors of each and makes something better.

Re: Npm Audit: broken by design?

#209
post #137
post #29

I found that much of the underlying cause is those mass reporting regex denial of services as being high severity bugs. So many people are reporting these in tons of different projects: https://github.com/search?q=regex+denial+of+service&type=iss... Anyhow it is just annoying and they broke NPM Audit based on these reports. It is good to fix all possible bugs, but many of these are not anywhere close to the level of…

I'm a maintainer of a few of the larger packages on npm. This is generally pretty accurate. Snyk Security seems only to find regex DoS bugs and I'm a bit disappointed in them being classified as high severity, and they're the only ones submitting reports right now. They seem pretty adamant on filing CVEs despite what the owner says (It's normally fine but these DoS vulns require very large input to be handed into the…

> Super broken, everything related to npm's package lock stuff is broken by design. I've been saying it for years now and it seems people still cling to blindly trusting what corporations say.

Because this isn't true. Just because you're experience this effect (which blows), doesn't mean the tool and related tooling are somehow broken. These Regex issues should be fixed, libraries should update to safe versions, things should advance and any incentive we have we should use to make this happen.

Re: Npm Audit: broken by design?

#210

Earlier quoted context omitted.

Big part of the insanity is also how projects introduce dependencies for very simple things like padding a number or a string.

https://www.npmjs.com/package/is-odd 447,211 weekly downloads for what can be done in vanilla JS with foo % 2 === 1;

You can thank Jon Schlinkert for that: https://github.com/jonschlinkert?tab=repositories

He abandoned the projects, but:

* https://github.com/jonschlinkert/is-odd

* https://github.com/jonschlinkert/is-even

Of course that doesn't stop them from getting ~500k downloads/week.

Post reply on HN