Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We all dodged a bullet

xeiaso.net

Post reply on HN
Print view View original

421–430 of 498 posts

Re: We all dodged a bullet

#421

Post by trinix912 »

chrismorgan wrote: post #347
Zak wrote: post #231

> If you were targeted with such a phishing attack, you'd fall for it too and it's a matter of when not if. Anyone who claims they wouldn't is wrong. I like to think I wouldn't. I don't put credentials into links from emails that I didn't trigger right then (e.g. password reset emails). That's a security skill everyone should be practicing in 2025.

Yeah, I feel that bit is just wrong, in three ways for me: 1. Like you, I never put credentials into links from emails that I didn’t trigger/wasn’t expecting. This is a generally-sensible practise. 2. Updating 2FA credentials is nonsense. I don’t expect everyone to know this, this is the weakest of the three. 3. If my credentials don’t autofill due to origin mismatch, I am not filling it manually. Ever. I would inste…

> 2. Updating 2FA credentials is nonsense. I don’t expect everyone to know this, this is the weakest of the three.

The problem with this is that companies often send out legit emails saying things like "update your 2FA recovery methods". Most people don't know well enough how 2FA works to spot the difference.

Re: We all dodged a bullet

#422

Post by brushfoot »

bob1029 wrote: post #113

"Batteries included" ecosystems are the ultimate defense against the dark arts. Your F100 first party vendor might get it wrong every now and then, but they have so much more to lose than a random 3rd party asshole who decides to deploy malicious packages. The worst thing I can recall from the enterprisey ecosystems is the log4j exploit, which was easily one of the most attended to security problems I am aware of. Ev…

Agreed; the rich standard library from Microsoft is one of the many things I appreciate about C#.

The article's author seems to be under the misapprehension that standard libraries should or have to be community-driven like Node's and that falling for phishing attacks is inevitable over a long enough period of time. Neither notion is accurate.

Re: We all dodged a bullet

#423

Post by mdavid626 »

DecoySalamander wrote: post #417
mdavid626 wrote: post #411

Earlier quoted context omitted.

Does this mean you verify EVERY domain you use? How to even do that? Shouldn’t this be solved some other ways?

I do it by reading domain name and comparing it to what I expect it to be. It's not hard and when in doubt I can easily check WHOIS info or search online for references. This is also easily avaidable by using password manager which will not autofill credentials on a page with a wrong domain. Edit: And yes, I do this for every link emailed to me that does anythig more high stakes than point me to a newsletter article.

I think it’s unreasonable to expect that people will do this. Most people have no idea what domain is, they won’t be able to check WHOIS records.

Re: We all dodged a bullet

#424

Post by brushfoot »

whiplash451 wrote: post #415

Not a security expert but I don’t think that requesting a reset of your 2FA credentials is reasonable. I would be very worried about my 2FA provider if they asked me to do this. And so I would not rate this phishing email a 10/10 at all.

Yes, the article's insistence that anyone would have fallen for the phish, and that anyone who disagrees is simply "wrong," is unfortunate. My old corporate phishing training drilled it into my head pretty effectively that you don't follow links in emails if the emails aren't direct responses to actions you've just taken: registering an account, resetting a password, and so forth.

To this day, I don't follow links in other kinds of emails. I mouse over the link to view the domain as a first step in determining how seriously to take the email. If the domain appears to match the known-good one, I copy the link and examine the characters to see if any Unicode lookalikes have been employed.

If the domain seems legitimate, or if I don't recognize it but the email is so convincing that I suspect the company truly is using a different domain (my bank has done this, frustratingly), I still don't click the link. I log in to my account on the known-good domain -- by typing it by hand into the browser's address bar -- and look for notifications.

If there are no notifications, then I might contact the company about the email to verify its authenticity.

If anyone reading thinks that seems like a lot of work, I agree with you! It stinks. But I humbly submit that it's necessary on today's Internet. And it's especially necessary if you're in charge of globally used software libraries.

To adopt the tone of the article's author, if they aren't willing to do that, they're wrong, and they're going to keep getting phished.

Re: We all dodged a bullet

#425

Post by Sophira »

kardianos wrote: post #277
anon7000 wrote: post #31

The nx supply chain attack via npm was the bullet many companies did not doge. I mean, all you needed was to have the VS Code nx plugin installed — which always checked for the latest published nx version on npm. And if you had a local session with GitHub (eg logged into your company’s account via the GH CLI), or some important creds in a .env file… that was exfiltrated. This happened even if you had pinned dependenc…

> We need some deeper changes in the ecosystem. I avoid anything to do with NPM, except for the typescript compiler, and I'm looking forward to the rewrite in Go where I can remove even that. For this reason. As a comparison, in Go, you have minimum version spec, and it takes great pains to never execute anything you download, even during compilation stage. NPM will often have different source then the github repo so…

Honestly, the same is true in a lot of other areas of computing.

Whenever you download an open-source program and you don't have to compile it first, you're at risk of running code that is not necessarily what's in the publicly-available source code.

This can even apply to source code itself when distributed through two different channels, as we saw in the xz backdoor attempt. (The release tarball contained different code to the repository.)

Re: We all dodged a bullet

#426

Post by 1oooqooq »

mlinksva wrote: post #187

As the post mentions wallets like MetaMask being the targets, AFAIK MetaMask in particular might be one of the best protected (isolated) applications from this kind of attack due to their use of LavaMoat https://x.com/MetaMask/status/1965147403713196304 -- though I'd love to read a detailed analysis of whether they actually are protected. No affiliation with MetaMask, just curious about effectiveness of seemingly lit…

all that is inside the extension. meaningless if the extension got the changed address.

Re: We all dodged a bullet

#427

Post by chha »

raffraffraff wrote: post #373
WD-42 wrote: post #368

Earlier quoted context omitted.

I would say Javascript's lack of a standard library is at least in part responsible for encouraging npm use, things just spiraled out of control from there.

[not a dev] why isn't there the equivalent of "Linux distributions" for npm? I know I know: because developers all need a different set of libs. But if there were thousands of packages required to provide basic "stdlib-like functionality" couldn't there be an npm distribution that you can safely use as a starting point, avoiding importing asinine stuff like 'istrue' (yea I'm kinda joking there). Or is that just what…

There could, this would essentially be in the form of a standard library. That would work until someone decides they don't like the form/naming conventions/architecture/ideology/lack of ideology/whatever else and then reinvent everything to do the same, but in a slightly different way.

And before you know it, you have a multitude of distributions to choose from, each with their own issues...

Re: We all dodged a bullet

#428

Post by hylaride »

berkes wrote: post #402
jFriedensreich wrote: post #397

That post fails to address the main issue, its not that we don't have time to vet dependencies, its that nodejs s security and default package model is absurd and how we use it even more. Even most deno posts i see use “allow all” for laziness which i assume will be copy pasted by everyone because its a major pain of UX to get to the right minimal permissions. The only programming model i am aware if that makes it pa…

Another main issue is how large (deep and wide) this "supply chain" is in some communities. JavaScript and python notable for their giant reliance on libs. If I compare a typical Rust project, with a same JavaScript one, JavaScript project itself often has magnitudes more direct dependencies (wide supply chain?). The rust tool will have three or four, the JavaScript over ten, sometimes ten alone to help with just bui…

> If I compare a typical Rust project, with a same JavaScript one, JavaScript project itself often has magnitudes more direct dependencies (wide supply chain?).

This has more to do with the popularity of a language than anything else, I think. Though the fact that Python and JS are used as "entry level" languages probably encourages some of these "lazy" libraries cough cough left-pad cough cough.

Re: We all dodged a bullet

#429

Post by hylaride »

benoau wrote: post #142
pluto_modadic wrote: post #89

Earlier quoted context omitted.

"found out right away"... by people with time to review security bulletins. There's loads of places I could see this slipping through the cracks for months.

There's probably already hundreds of thousands of Jira tickets to fix it with no sprint assigned....

Ugh, have some respect. Some of us have PTSD dealing with security issues where the powers that be prevented us dealing with them due to them deprioritizing them during backlog grooming. My last company literally refused to do any security work except CVE turndowns - because it was contractually promised via a customer contract.

Re: We all dodged a bullet

#430

Post by mark_l_watson »

anon7000 wrote: post #31

The nx supply chain attack via npm was the bullet many companies did not doge. I mean, all you needed was to have the VS Code nx plugin installed — which always checked for the latest published nx version on npm. And if you had a local session with GitHub (eg logged into your company’s account via the GH CLI), or some important creds in a .env file… that was exfiltrated. This happened even if you had pinned dependenc…

The VS Code ecosystem has too much complexity for my tastes. I do keep a copy around with a few code formatting plugins installed but I feel more comfortable with Emacs (or Vim for my friends who are on that side of the fence).

I am a consumer of apps using npm, not a developer, and I simply don’t like the auto updates and seeing a zillion things updated. I use uv and Python a lot, and I get a similar uneasy feeling there also, but (perhaps incorrectly) I feel more in control.

Post reply on HN