Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies • Hacker News Board

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#251

Post by adamc » Wed, Feb 10, 2021, 4:44 PM UTC

ryandrake wrote: post #237

Spooky23 wrote: post #193

Earlier quoted context omitted.

It's a little bit of both. Maybe "problem" is the wrong word. It's a risk that you need to understand and account for. If you're running a bank, it's an existential impact that you must avoid. If you're running a message board, it's not. Look at what happened when the "left-pad" function disappeared from npm a few years ago. IIRC, it broke react. The downside of package managers like this is that many people have no…

Coming from the embedded world, where a lot of projects are safety-critical, it always kind of shocks me to see how cavalier others in the software world are about bringing in third party dependencies. Need a bit of code that would take you a day to write? Naaah, just find a third party library that does it (and does god knows what else). And bam! Like that it's part of the build. No code review of the dependency. No…

Except a lot of projects aren't shipping anything to anyone, they are providing a service. There, you have to assess the effect if the service goes down or is compromised. There is a wide range of significances. If Roll20 (D&D tabletop site) goes down, it may affect their revenue, but no one is going to get hurt. Etc.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#252

Post by eitland » Wed, Feb 10, 2021, 4:48 PM UTC

withinboredom wrote: post #244

oauea wrote: post #238

Earlier quoted context omitted.

Sounds like you had some poor experiences with people who didn't know what they were doing. The proper way to audit your dependencies is to run an in-house Maven repository server. Just like you would for npm, or any package repository really. So you just spin up Sonatype Nexus, proxy the repositories you trust and disallow releases from being overwritten. That way you're certain the jar you're using today, is the ex…

We do this. I had to work on a greenfield project and it used a ton of libs that weren’t in our repo. It was so annoying to have a list of repos to add to the in-house list, then discover things didn’t work, so now we need these. It literally added weeks of man-hours to the project, per day.

> It literally added weeks of man-hours to the project, per day.

Can you explain what exactly you mean here, because the way I read it realistic time estimates for the projects grew by weeks pr day which probably means

- I misread

- you wrote something you didn't mean

Anyways it sounds like something was way off and I have worked on some projects with Maven and other systems.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#253

Post by eitland » Wed, Feb 10, 2021, 4:50 PM UTC

the_af wrote: post #183

littlestymaar wrote: post #156

Earlier quoted context omitted.

Nobody in this thread argues that npm is not bad (it is), the current topic is: “is maven's design[1] better” and there is little evidence on this front. Maven was (yes, I'm using the past on purpose) not a panacea that later system failed to equal: it has the usability of an IRS form and never gained as much popularity in the Java world than npm in the JavaScript one for that reason. In 2014, last time I did Java fo…

Maven is/was huge in the Java world. For years it was pretty much the only way to resolve dependencies, until people got fed up with its many idiosyncrasies. > “we are getting .jar files individually and not using maven because it's a fucking mess” That seems odd and a bizarre edge case. Nobody worked like that with Java projects, and I bet nobody does today either.

> until people got fed up with its many idiosyncrasies.

Many of us still prefer Maven.

Having to deal with other people's artistic Gradle files works wonders when it comes to understanding the goodness of standards.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#254

Post by stephenr » Wed, Feb 10, 2021, 4:51 PM UTC

And still people won’t vendor their dependencies, so changes to dependencies are never reviewed.

To paraphrase family guy: you’re making this harder than it needs to be.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#255

Post by [deleted] » Wed, Feb 10, 2021, 4:53 PM UTC

ryukafalz wrote: post #194

I see a lot of people saying things like "this is why package signing is important" and "we need to know who the developers are" and "we need to audit everything." Some of that is true to some degree, but let me ask you this: why do we consider it acceptable that code you install through a package manager implicitly gets to do anything to your system that you can do? That seems silly! Surely we can do better than tha…

[deleted]

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#256

Post by bluefirebrand » Wed, Feb 10, 2021, 4:55 PM UTC

ryandrake wrote: post #237

Spooky23 wrote: post #193

Earlier quoted context omitted.

It's a little bit of both. Maybe "problem" is the wrong word. It's a risk that you need to understand and account for. If you're running a bank, it's an existential impact that you must avoid. If you're running a message board, it's not. Look at what happened when the "left-pad" function disappeared from npm a few years ago. IIRC, it broke react. The downside of package managers like this is that many people have no…

Coming from the embedded world, where a lot of projects are safety-critical, it always kind of shocks me to see how cavalier others in the software world are about bringing in third party dependencies. Need a bit of code that would take you a day to write? Naaah, just find a third party library that does it (and does god knows what else). And bam! Like that it's part of the build. No code review of the dependency. No…

> Need a bit of code that would take you a day to write?

Even if it is a small library that has only a single maintainer the chances of you replicating it in a day seem slim to me unless it is truly trivial, or the library was also written in a day.

More likely you get a day in and realize that the problem has a whole bunch of gotchas that you didn't anticipate and the library maintainer already found and dealt with.

Again, this is only if the problem isn't truly trivial

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#257

Post by the_af » Wed, Feb 10, 2021, 4:56 PM UTC

eitland wrote: post #253

the_af wrote: post #183

Earlier quoted context omitted.

Maven is/was huge in the Java world. For years it was pretty much the only way to resolve dependencies, until people got fed up with its many idiosyncrasies. > “we are getting .jar files individually and not using maven because it's a fucking mess” That seems odd and a bizarre edge case. Nobody worked like that with Java projects, and I bet nobody does today either.

> until people got fed up with its many idiosyncrasies. Many of us still prefer Maven. Having to deal with other people's artistic Gradle files works wonders when it comes to understanding the goodness of standards.

Yes, of course.

Another example: SBT was supposed to be the "savior" in the Scala world and... I still have nightmares about SBT from a couple of years ago. Maybe it's finally become usable and intelligible in recent years.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#258

Post by h1fra » Wed, Feb 10, 2021, 4:57 PM UTC

ryukafalz wrote: post #228

easton wrote: post #217

Earlier quoted context omitted.

I believe that Deno (the "successor" to Node being written by Ryan Dahl) is supposed to fix this for server-side JavaScript/TypeScript. It doesn't grant any permissions to anything unless you specifically give them out (so you can say that only a specific module gets access to the filesystem, for instance, and on top of that it can only access /srv and not /etc). https://deno.land/manual@v1.7.2/getting_started/permis…

This looks like it's... getting there, but still too coarse-grained. It looks like those permissions are granted to the whole Deno process? So if your program needed both access to sensitive data on the filesystem and network access, and it used a malicious dependency, that dependency could take advantage of those permissions and exfiltrate that data. I could be wrong, but I don't see any mention of permissions on im…

yes while it goes in the right direction in theory, in practice it provides "almost" no additional security.

the only good differentiator right now that could definitely be implemented in nodejs directly is the the flag `--allow-net=`. it could prevent data exfiltration but requires the whole stack to require this flag.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#259

Post by sid- » Wed, Feb 10, 2021, 5:00 PM UTC

detaro wrote: post #235

eecc wrote: post #224

Earlier quoted context omitted.

Java does. Of course it’s never been used systematically and it has received precious little attention to DevOps ergonomics, but the infrastructure is there

I didn't know that. Do you happen to have a link with more details at hand?

https://docs.oracle.com/en/java/javase/15/security/permissio...

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#260

Post by austincheney » Wed, Feb 10, 2021, 5:00 PM UTC

ritchiea wrote: post #230

austincheney wrote: post #227

Earlier quoted context omitted.

> No one gets fired for using npm Most developers are eager to accept any resulting consequences because they don't own the consequences and because they are fearful of writing original code.

Some developers are fearful of writing original code. Others realize it's not going to be appreciated by their colleagues to write their own package manager to solve a problem most of the industry disregards. Imagine arguing for getting the "write our own package manager to replace npm/yarn/pip" ticket into a sprint.

It isn't about writing your own package manager. At least start with not using every package offered by NPM or dependencies that do. If you cannot attest to every package in your dependency tree you have failed dependency management.