Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We all dodged a bullet

xeiaso.net

Post reply on HN
Print view View original

381–390 of 498 posts

Re: We all dodged a bullet

#381

Post by cirelli94 »

mesofile wrote: post #230
mikewarot wrote: post #28

>Saved by procrastination! Seriously, this is one of my key survival mechanisms. By the time I became system administrator for a small services company, I had learned to let other people beta test things. We ran Microsoft Office 2000 for 12 years, and saved soooo many upgrade headaches. We had a decade without the need to retrain. That, and like other have said... never clicking links in emails.

This is how I feel about my Honda, and to some extent, Kubernetes. In the former case I kept a 2006 model in good order for so long I skipped at least two (automobile) generation's worth of car-to-phone teething problems, and after years of hearing people complain about their woes I've found the experience of connecting my iphone to my '23 car pretty hassle-free. In the latter, I am finally moving a bunch of workload…

In the meantime you had for years a car without connecting your iphone, so you completely didn't have that feature! There are pros and cons everywhere, but I'm more prone to change often and fix things that wait for feature to be stable and meantime do without them. Of course, when I can afford it, e.g. not in changing my car every two years :')

Re: We all dodged a bullet

#382

Post by Yoric »

RVuRnvbM2e wrote: post #290
kardianos wrote: post #277

Earlier quoted context omitted.

> We need some deeper changes in the ecosystem. I avoid anything to do with NPM, except for the typescript compiler, and I'm looking forward to the rewrite in Go where I can remove even that. For this reason. As a comparison, in Go, you have minimum version spec, and it takes great pains to never execute anything you download, even during compilation stage. NPM will often have different source then the github repo so…

Fucking this. I have seen so many takes lamenting how this kind of supply chain attack is such a difficult problem to fix. No it really isn't. It's an ecosystem and cultural problem that npm encourages huge dependency trees that make it impractical to review dependency updates so developers just don't.

The thing is, having access to such dependencies is also a huge productivity boost. It's not by accident that every single language whose name isn't C or C++ has pretty much moved to this model (or had it way before npm, in the case of Perl or Haskell).

The alternative is C++, where every project essentially starts by reinventing the wheel, which comes with its own set of vulnerabilities.

I'm saying this without a clear idea of how to fix this very real problem.

Re: We all dodged a bullet

#383

Post by sebstefan »

zingababba wrote: post #250
jeroenhd wrote: post #115

Earlier quoted context omitted.

Get in, steal a couple hundred grand, get out, do the exact same thing a few months later. Repeat a few times and you can live worry free until retirement if you know to evade the cops. Even if you steal other stuff, you're going to need to turn it all into cryptocurrency anyway, and how much is an AWS key really going to bring in. There are criminals that focus on extracting passwords and password manager databases…

This guy made 66$ - https://x.com/SolanaFloor/status/1965144417565900868

I think at this point just retire from cybercrime

Re: We all dodged a bullet

#384

Post by euLh7SM5HDFY »

ozim wrote: post #274
Havoc wrote: post #12

Really feels like these big open packages repos need a better security solution. Or at least a core subset of carefully vetted ones. Same issue with python, rust etc. It’s all very trust driven

Linux distributions packages are also very trust driven — but you have to earn trust to publish. Then there is whole system to verify trust. NPM is more like „everything goes”.

The sheer volume is the issue. Recent XZ backdoor shows it can happen to everyone. I am pretty sure JS has most packages, updates and contributors - and it makes it the best ecosystem to target. That anemic standard library doesn't help of course, but 2FA and package signing is required for all package repositories, here and now.

Re: We all dodged a bullet

#385

Post by fdsfdsfdsaasd »

Yoric wrote: post #382
RVuRnvbM2e wrote: post #290

Earlier quoted context omitted.

Fucking this. I have seen so many takes lamenting how this kind of supply chain attack is such a difficult problem to fix. No it really isn't. It's an ecosystem and cultural problem that npm encourages huge dependency trees that make it impractical to review dependency updates so developers just don't.

The thing is, having access to such dependencies is also a huge productivity boost. It's not by accident that every single language whose name isn't C or C++ has pretty much moved to this model (or had it way before npm, in the case of Perl or Haskell). The alternative is C++, where every project essentially starts by reinventing the wheel, which comes with its own set of vulnerabilities. I'm saying this without a cl…

It's more like capex vs opex. Some languages and frameworks - you have to maintain the same level of effort, just to keep your apps working.

Re: We all dodged a bullet

#386

Post by wallrat »

booi wrote: post #324
blamestross wrote: post #129

Earlier quoted context omitted.

"Just wait 2 weeks to use new versions by default" is an amazing defense method against supply chain attacks.

Is there some sort of easy operational way to do this? There are well known tech companies that do this internally but afaik this isn't a feature of OSS registries like verdaccio

There are dependency firewalls that let you enforce this (e.g. https://docs.bytesafe.dev/policies/delay-upstream/). Don't know any OSS solutions though.

Re: We all dodged a bullet

#387

Post by junon »

duffpkg wrote: post #331

For a very long time I have also used unique emails for each respective service that involves in email. When I sign up for npm it is something like email_npm@example.com . This makes it very easy to whitelist and also spot phishing emails because if an email for npm is coming to mail_cccoffee@example.com it screams that something is wrong. It is not bulletproof by any means but an additional layer that costs me almos…

That's exactly what I do, and have caught quite a lot of other phishing emails this way. They queried my npm email via the public API and sent it there.

Re: We all dodged a bullet

#388

Post by lynnharry »

oezi wrote: post #361
anon7000 wrote: post #31

The nx supply chain attack via npm was the bullet many companies did not doge. I mean, all you needed was to have the VS Code nx plugin installed — which always checked for the latest published nx version on npm. And if you had a local session with GitHub (eg logged into your company’s account via the GH CLI), or some important creds in a .env file… that was exfiltrated. This happened even if you had pinned dependenc…

The key thing needed is a standard library which includes 100000 of these tiny one function libraries (has-ansi, color-name).

I checked has-ansi. What's the reason that this library would exist and be popular? Most of the work is done by the library it imports, ansi-regex and then it just return ansi-regex.test(string), yet it has 5% of the weekly downloads of ansi-regex. ansi-regex also has fewer than 10 lines of code.

I don't know anything about the npm ecosystem, what's the benefit of importing these libraries compared to including these code in the project?

Re: We all dodged a bullet

#389

Post by junon »

frabjoused wrote: post #281

I wrote the first commit for slice-ansi in 2015 to solve a baby problem for a cli framework I was building, and worked with Qix a little on the chalk org after it. It's wild looking back and seeing how these things creep in influence over time.

Didn't expect things to grow how they have, that's for sure! Hope you've been well :)

Re: We all dodged a bullet

#390

Post by junon »

leoc wrote: post #36

> Even then, that wouldn't really stand out to me because I've seen companies use new generic top level domains to separate out things like the blog at .blog or the docs at .guide, not to mention the .new stack. This is very much a 'can we please not' situation, isn't it? (Obviously it's not something that the email recipients can (usually) control, so it's not a criticism of them.) It also has to meaningfully increa…

Anecdotally throughout all this, contacting npm got me a response from githubsupport.com. I had to double check if that was even real.
Post reply on HN