421–430 of 458 posts
Earlier quoted context omitted.
Why are browser extensions not sane in your opinion?
Browser password manager extensions are like putting a dog door on your reinforced vault door. Giant increase in attack surface.
I've dramatically decreased my reliance on third-party packages and tools in my workflow. I switched from Bitwarden to Apple Passwords a few months ago, despite its worse feature set (though the impetus was Bitwarden crashing on login on my new iPad). I've also been preferring to roll things on my own in my side projects rather than pulling a package. I'll still use big, standalone libraries, but no more third-party…
Earlier quoted context omitted.
Why not stick to simple/heavily vetted password managers (like keepassx)? is there some advanced feature you use?
I hope you're not using KeePassX, it's been unmaintained for years. KeePassXC is only available for Linux, which means I'd need to use a third-party app for Mac and iOS, so I'd be trusting three vendors instead of one. Aside from passwords, I store passkeys, secure notes, and MFA tokens.
Earlier quoted context omitted.
KeePassXC is cross-platform, unsure about iOS.
Sorry, you're right, I missed the tabs on top. No iOS support though.
Once again, it is in the NPM ecosystem. OneCLI [0] does not save you either. Happens less with languages that have better standard libraries such as Go. If you see any package that has hundreds of libraries , that increases the risk of a supply chain attack. A password manager does not need a CLI tool. [0] https://news.ycombinator.com/item?id=47585838
Earlier quoted context omitted.
The problem with cooldowns is that the more people use them, the less effective they become.
The hypothesis you're referring to is something like "if everyone uses a 7-day cooldown, then the malware just doesn't get discovered for 7 days?", right? An alternative hypothesis: what if 7-day cooldowns incentivize security scanners, researchers, and downstream packagers to race to uncover problems within an 7-day window after each release? Without some actual evidence, I'm not sure which of these is correct, but…
Either way there will be fewer eyes on it.
I don’t even trust GitHub’s own actions. I used to use only the one to checkout a repository, limited to a specific tag, but then realised that even a tagged version, if it has dependencies which are not themselves tagged, could be compromised, so I stopped and now do the checkout myself. It’s not even that many lines of code, the fact GitHub has a huge npm package with dependencies to do something this basic is insane.
Earlier quoted context omitted.
That's true. But it does seem like a logic result of having no real standard library. That lone fact has kept me away from Rust for real projects, because I don't want to pull in a bunch of defacto-standard-but-not-officially dependencies for simple tasks. That's probably a large contributor to the current state of dependency bloat.
So you only use languages that have a built-in HTTP client, JSON / CSV / XML parsers, and such?
Earlier quoted context omitted.
So you only use languages that have a built-in HTTP client, JSON / CSV / XML parsers, and such?
I’m not the person you asked, but given the choice I avoid a language without JSON parsing officially supported because I need that frequently. It’s the reason I never picked up Lua, despite being interested in it.
I am openly admitting I don't care. Such libraries are in a huge demand and every programming language ecosystem gains them quite early. So to me the risk of malicious code in them is negligibly small.