Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Maybe you shouldn't install new software for a bit

xeiaso.net

Post reply on HN
Print view View original

291–300 of 497 posts

Re: Maybe you shouldn't install new software for a bit

#291

Post by user34283 »

hennell wrote: post #248
whilenot-dev wrote: post #233

Earlier quoted context omitted.

You forgot case #4: Worked at a startup where the frontend team thought it was a good idea to use lock files during development, but to do a "fresh" install of all dependecies during the deployment step. And yes, they still thought they were doing the right thing.

To be fair npm makes (made?) it weirdly hard to use lock files so a lot of people did that by mistake. And when you do use lock, it reinstalls every time so a retagged package can just silently update.

I can’t comment on the behavior of ancient npm versions, but with modern npm I would not even know how to skip using a lockfile.

As for the parent comment about not using the lockfile for the production build, that’s just incredibly incompetent.

Maybe they should hire someone who knows what they are doing. Contrary to the popular beliefs of backend engineers online, you also need some competency to do frontend properly.

In this case what’s needed is „npm ci“ instead of „npm install“ or better „pnpm install —frozen-lockfile“.

Pnpm will also do that automatically if the CI environment variable is set.

Re: Maybe you shouldn't install new software for a bit

#293

Post by [deleted] »

hennell wrote: post #248
whilenot-dev wrote: post #233

Earlier quoted context omitted.

You forgot case #4: Worked at a startup where the frontend team thought it was a good idea to use lock files during development, but to do a "fresh" install of all dependecies during the deployment step. And yes, they still thought they were doing the right thing.

To be fair npm makes (made?) it weirdly hard to use lock files so a lot of people did that by mistake. And when you do use lock, it reinstalls every time so a retagged package can just silently update.

[deleted]

Re: Maybe you shouldn't install new software for a bit

#294

Post by skydhash »

pjmlp wrote: post #215
cperciva wrote: post #11

Alternatively, switch to an operating system like FreeBSD which doesn't take a YOLO approach to security. Security fixes don't just get tossed into the FreeBSD kernel without coordination; they go through the FreeBSD security team and we have binary updates (via FreeBSD Update, and via pkgbase for 15.0-RELEASE) published within a couple minutes of the patches hitting the src tree. (Roughly speaking, a few seconds for…

Only to be thrown out of the windows with a plain "curl | sh".

curl | sh is more prevalent in Linux where you can expect a stable ABI from the kernel and sometimes GNU libc. No such things in BSD land. Packages are built against a release always. They don't maintain binary compatibility.

Re: Maybe you shouldn't install new software for a bit

#297

Post by pjmlp »

skydhash wrote: post #294
pjmlp wrote: post #215

Earlier quoted context omitted.

Only to be thrown out of the windows with a plain "curl | sh".

curl | sh is more prevalent in Linux where you can expect a stable ABI from the kernel and sometimes GNU libc. No such things in BSD land. Packages are built against a release always. They don't maintain binary compatibility.

Hardly an argument against random shell scripts execution, quite often elevated.

Not everyone installs only what is available in pkgsrc.

Re: Maybe you shouldn't install new software for a bit

#298

Post by moffkalast »

antonyh wrote: post #292

"Don't update your systems for a while" is exactly what an attacker would say. If you can't trust your update sources, you have bigger problems.

If I'm being really frank, are system updates not more disruptive, destructive and result in more data loss and downtime than all the attacks you'll experience in your lifetime? (unless you're a high value business target ofc, I'm talking for personal machines)

In my book, having unattended-upgrades or windows update run amok on your system is functionally worse than a rootkit.

Re: Maybe you shouldn't install new software for a bit

#299

Post by alecco »

JetSetIlly wrote: post #280
alecco wrote: post #264

Or disable algif_aead module as in https://news.ycombinator.com/item?id=47957409

That's not enough in this case. The suggested mitigation according to the Dirty.Frag github page is to blacklist esp4, esp6 and rxrpc

Thanks.

Discussion https://news.ycombinator.com/item?id=48054182

Re: Maybe you shouldn't install new software for a bit

#300

Post by teytra »

uecker wrote: post #257
marcus_holmes wrote: post #240

Earlier quoted context omitted.

There is a lot of opposition in the FOSS community for restrictive/protective licenses. And to be fair, this comes from a consistent and entirely logical worldview. There's a bunch of problems with getting companies to pay for this, too - that sense of entitlement (or even contractual obligation), the ability to control the project with cash, etc. I don't have any answers or solutions. But I don't think we can hand-w…

The problem is that they get away too easily with bugs in their products they ship to customers. If this would come with some penalties, there would be some incentive to invest in security and this would probably often flow back to upstream projects.

Like a money-back guarantee?

Like you get when you buy e.g. MS products?

/s

Post reply on HN