GitLab discovers widespread NPM supply chain attack

Post by GrantMoyer » Mon, Dec 01, 2025, 11:21 PM UTC

naikrovek wrote: post #169

didntcheck wrote: post #85

Earlier quoted context omitted.

That's true, but the same may already be true of your browser's cookie file. I believe Chrome on MacOS and Windows (unsure about Linux) now does use OS features to prevent it being read from other executables, but Firefox doesn't (yet) But protecting specific directories is just whack-a-mole. The real fix is to properly sandbox code - an access whitelist rather than endlessly updating a patchy blacklist

Plan9 had per-process namespaces in 1995. One could easily allow or restrict visibility of almost anything to any program. There were/are some definite usability concerns with how it is done today (the OS was not designed to be friendly, but to try new things) and those could easily be solved. The core of this existed in the Plan9 kernel and the Plan9 kernel is small enough to be understood by one person. I’m kinda a…

Post by rhubarbtree » Tue, Dec 02, 2025, 7:58 AM UTC

rhubarbtree wrote: post #46

torben-friis wrote: post #40

Earlier quoted context omitted.

One factor is that node's philosophy is to have a very limited standard library and rely on community software for a ton of stuff. That means that not only the average project has a ton of dependencies, but also any given dependency will in turn have a ton of dependencies as well. there’s multiplicative effects in play.

This is the main reason. Pythons ecosystem also has silly trends and package churn, and plenty of untrained developers. It’s the lack of a proper standard library. As bad a language as it may be, Java shows how to get this right.