Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Less is safer: Reducing the risk of supply chain attacks

obsidian.md

Post reply on HN
Print view View original

201–210 of 274 posts

Re: Less is safer: Reducing the risk of supply chain attacks

#201

Post by mnahkies »

RadiozRadioz wrote: post #98
joshdavham wrote: post #85

There’s some advice that’s been going around lately that I’ve been having trouble understanding: the idea that you should not be updating your dependencies when new patches are released (e.g., X.X.PATCH). I understand that not updating your dependencies when new patches are released reduces the chance of accidentally installing malware, but aren’t patches regularly released in order to improve security? Wouldn’t it g…

There's a key missing piece to this puzzle: being informed about _why_ you're updating and what the patches are. Nobody has time to read source code, but there are many tools and services that will tell you brief summaries of release notes. Npm Audit lists security vulnerabilities in your package versions for example. I do adopt the strategy of not updating unless required, as updates are not only an attack vector, b…

On the ReDos aspect, I find the current CVSS rating system lacking. Availability is important, but following secure coding principles (fail closed) I'd much rather my system go down than have integrity/confidentiality compromised.

It's frustrating that a potential availability issue often gets the same (high) rating as a integrity/confidentiality issue

Re: Less is safer: Reducing the risk of supply chain attacks

#202

Post by mallowdram »

gejose wrote: post #16

This is one way to look at it, but ignores the fact that most users use third party community plugins. Obsidian has a truly terrible security model for plugins. As I realized while building my own, Obsidian plugins have full, unrestricted access to all files in the vault. Obsidian could've instead opted to be more 'batteries-included', at the cost of more development effort, but instead leaves this to the community,…

Is there an alternate to obsidian?

Re: Less is safer: Reducing the risk of supply chain attacks

#203

Post by mallowdram »

setr wrote: post #133
hinkley wrote: post #97

Earlier quoted context omitted.

When I was young there were a few luminaries in the software world who talked about how there is a steady if small flow of ideas from video game design into conventional software. But I haven't heard anyone talk like that in quite sometime (unless it's me parroting them). Which is quite unfortunate. I think for example if someone from the old guard of Blizzard were to write a book or at least a novella that described…

I’ve been of the opinion that every hard problem in CS shows up somewhere in gamedev. It’s a great space for inspo.

My team's approach is game dev is probably for the hard problems in reality, behavior, ecology, language.

Re: Less is safer: Reducing the risk of supply chain attacks

#204

Post by 4ndrewl »

HSO wrote: post #188
lxgr wrote: post #170

Earlier quoted context omitted.

If it can open and write any file on the OS, it's pretty much game over. Too many ways to exfiltrate data even without network/socket access.

Worse, what keeps this from editing the config files for Little Snitch (or similar blockers)?

File system permissions?

Re: Less is safer: Reducing the risk of supply chain attacks

#205

Post by runningmike »

“ Supply chain attacks are malicious updates that sneak into open source code used by many apps.” No!

This should be: Supply chain attacks are malicious updates that sneak into source code used by many apps.

Stop blaming FOSS. Too many people still have the perception that FOSS software is insecure

Re: Less is safer: Reducing the risk of supply chain attacks

#206

Post by mooreds »

I was talking to our chief architect about a blog post about our zero dependency home grown HTTP server[0]; the project just hit 1.2 and uses virtual threads. I'm generally a fan of "don't reinvent the wheel"[1], but I think there are some cases where that control is worth the cost.

Defending against security vulnerabilities is definitely one of them, as long as you make the proper investments to harden what you write.

Joel Spolsky write about some other reasons too[2].

0: https://github.com/FusionAuth/java-http

1: https://en.wikipedia.org/wiki/Reinventing_the_wheel

2: https://www.joelonsoftware.com/2001/10/14/in-defense-of-not-...

Re: Less is safer: Reducing the risk of supply chain attacks

#207

Post by elcapitan »

I went from Evernote to Joplin to Obsidian and really like the model of md files with some logic added on top. Initially I used a lot of plugins mostly out of curiosity, but now it's mostly RemotelySave for syncing and some small convenience plugins, so I hope my exposure isn't too high.

The app doesn't have the bloaty feel of other Electron apps, but if there was a good more native alternative that fits my bill (md files editable in a graphical mode with good wikilink-syntax support and similar search etc), then I would actually consider switching.

Re: Less is safer: Reducing the risk of supply chain attacks

#208

Post by MetaWhirledPeas »

mnahkies wrote: post #200
darkamaul wrote: post #100

> We do not run postinstall scripts. This prevents packages from executing arbitrary code during installation. I get the intent, but I’m not sure this really buys much. If a package is compromised, the whole thing is already untrustworthy and skipping postinstall doesn’t suddenly make the rest of the code safe. If it isn’t compromised, then you risk breaking legitimate installation steps. From a security perspective,…

I agree but there's a bit of nuance here. Today scanning steps typically happen post install, which is wild but the status quo. Therefore preventing anything from running during install is desirable. I'd like to see the ability to scan/restrict as part of the installation step become popular, there are some proprietary tools that do this already but it's not yet a common capability.

Yes. For instance when we had that crypto malware npm fiasco a few days back I happened to be updating one of my packages. The audit lit up with dozens of critical issues, but of course this was after it installed everything. Luckily I had disabled install scripts so it became a matter of not running the code until I could get it reverted back.

Re: Less is safer: Reducing the risk of supply chain attacks

#210

Post by [deleted] »

Pikamander2 wrote: post #155
gejose wrote: post #16

This is one way to look at it, but ignores the fact that most users use third party community plugins. Obsidian has a truly terrible security model for plugins. As I realized while building my own, Obsidian plugins have full, unrestricted access to all files in the vault. Obsidian could've instead opted to be more 'batteries-included', at the cost of more development effort, but instead leaves this to the community,…

> could've instead opted to be more 'batteries-included', at the cost of more development effort, but instead leaves this to the community, which in turn increases the attack surface significantly. Ah, the WordPress model.

[deleted]
Post reply on HN