Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We all dodged a bullet

xeiaso.net

Post reply on HN
Print view View original

431–440 of 498 posts

Re: We all dodged a bullet

#431

Post by Jensson »

aspenmayer wrote: post #325
alehlopeh wrote: post #315

Earlier quoted context omitted.

“It’s not difficult to fix, just change the entire culture” The difficulty comes in trying to change the entire culture.

“Doctor, it hurts when I do this!” “Stop doing that!” “But I wanna!”

That is valid though, if someone says "It hurts when I walk" its not reasonable to tell them to not walk, you try to figure out why it hurts and if it can be fixed.

Other languages has similar package managers as npm, but with much less issues, so it can be fixed without changing the package manager completely.

Re: We all dodged a bullet

#432

Post by Apfel »

fclairamb wrote: post #365
booi wrote: post #324

Earlier quoted context omitted.

Is there some sort of easy operational way to do this? There are well known tech companies that do this internally but afaik this isn't a feature of OSS registries like verdaccio

Renovate is a great (and free) tool to update your dependencies. By default it will update packages in the hours (often minutes) of their release but you can change that behavior with the minimumReleaseAge parameter. https://docs.renovatebot.com/configuration-options/#minimumr...

The one big problem Renovate brings is when it automerges and breaks everything with e.g. a TypeScript upgrade. It's simple enough to handle and prevent but has required quite a lot of developer education for those who are not particularly frontend-focused in my experience.

Re: We all dodged a bullet

#433

Post by maleldil »

strogonoff wrote: post #396
kardianos wrote: post #277

Earlier quoted context omitted.

> We need some deeper changes in the ecosystem. I avoid anything to do with NPM, except for the typescript compiler, and I'm looking forward to the rewrite in Go where I can remove even that. For this reason. As a comparison, in Go, you have minimum version spec, and it takes great pains to never execute anything you download, even during compilation stage. NPM will often have different source then the github repo so…

Before we all conclude that supply chain attacks only happen on NPM, last time I used VS Code I discovered that it auto-installed, with no apparent opt-out, Python typing stubs for any package (e.g., Django in my case) from whatever third-party, unofficial PyPI accounts it saw fit. (Yes, this is why it was the last time I used VS Code.) The obscurity of languages other than JavaScript will only work as a security mea…

I've never seen Pylance automatically install anything. Are you talking about the stubs that come packaged with Pylance, which Microsoft maintains?

Re: We all dodged a bullet

#434

Post by rollcat »

berkes wrote: post #402
jFriedensreich wrote: post #397

That post fails to address the main issue, its not that we don't have time to vet dependencies, its that nodejs s security and default package model is absurd and how we use it even more. Even most deno posts i see use “allow all” for laziness which i assume will be copy pasted by everyone because its a major pain of UX to get to the right minimal permissions. The only programming model i am aware if that makes it pa…

Another main issue is how large (deep and wide) this "supply chain" is in some communities. JavaScript and python notable for their giant reliance on libs. If I compare a typical Rust project, with a same JavaScript one, JavaScript project itself often has magnitudes more direct dependencies (wide supply chain?). The rust tool will have three or four, the JavaScript over ten, sometimes ten alone to help with just bui…

> [...] python notable for their giant reliance on libs.

I object. You can get a full-blown web app rolling with Django alone. Here's it's list of external dependencies, including transitive: asgiref, sqlparse, tzdata. (I guess you can also count jQuery, if you're using the _builtin_ admin interface.)

The standard library is slowly swallowing the most important libraries & tools in the ecosystem, such as json or venv. What was once a giant yield-hack to get green threads / async, is now a part of the language. The language itself is conservative in what new features it accepts, 20yro Python code still reads like Python.

Sure, I've worked on a Django codebase with 130 transitive dependencies. But it's 7yro and powers an entire business. A "hello world" app in Express has 150, for Vue it's 550.

Re: We all dodged a bullet

#435

Post by saghm »

ohdeargodno wrote: post #165
saghm wrote: post #47

Earlier quoted context omitted.

OTOH, doesn't ICANN already sometimes restrict who has access to a given TLD? Would it really be that crazy for them to say "maybe we shouldn't let registrars sell npm. regardless of the TLD", and likewise for a couple dozen of the most obvious targets (google. , amazon. , etc.)? No one needs to pay for these domains if no one is selling them in the first place. I don't love the idea of special treatment for giant co…

>maybe we shouldn't let registrars sell npm. regardless of the TLD Cool, get big enough, become friends with the right people and you can squat an entire name on the internet. What, you're the Nepalese Party for Marxists, you've existed for 70 years and you want to buy npm.np ? Nope, tough luck, some random dude pushes shitty javascript packages over there. Sorry for the existing npm.org address too, we're going to e…

> Cool, get big enough, become friends with the right people and you can squat an entire name on the internet. What, you're the Nepalese Party for Marxists, you've existed for 70 years and you want to buy npm.np ?

I think you and I have drastically different ideas about how dramatic a response is warranted by the scenario of needing to buy a domain with a different three letters or maybe even four or more letters before the TLD.

> Dare I remind you that the whole left-pad situation was because Kik, the company, stole (with NPM's assistance because they were big enough and friends with the right people) the kik package ?

...and then the package was entirely removed, which would have been preventable by sane policies around making removal just not allow new dependencies to use it. You're also conflating a resource that's ostensibly free and perpetual for people to claim with one that's only rented for fixed periods of time for money.

Re: We all dodged a bullet

#437

Post by rollcat »

mesofile wrote: post #230
mikewarot wrote: post #28

>Saved by procrastination! Seriously, this is one of my key survival mechanisms. By the time I became system administrator for a small services company, I had learned to let other people beta test things. We ran Microsoft Office 2000 for 12 years, and saved soooo many upgrade headaches. We had a decade without the need to retrain. That, and like other have said... never clicking links in emails.

This is how I feel about my Honda, and to some extent, Kubernetes. In the former case I kept a 2006 model in good order for so long I skipped at least two (automobile) generation's worth of car-to-phone teething problems, and after years of hearing people complain about their woes I've found the experience of connecting my iphone to my '23 car pretty hassle-free. In the latter, I am finally moving a bunch of workload…

This.

At $PAST_DAYJOB we've adopted Docker "only" around 2016, and importantly, we've used it almost identically to how we used to deploy "plain" uWSGI or Apache apps: a bunch of VMs, run some Ansible roles, pull the code (now image), restart, done.

The time to move to k8s is when you have a k8s-sized problem. [Looks at Github: 760 releases, 3866 contributors.] Yeah, not now.

Re: We all dodged a bullet

#438

Post by mdavid626 »

giveita wrote: post #371
creesch wrote: post #370

Earlier quoted context omitted.

To state the obvious, one ends with "help" on with "com". It effectively is phishing awareness 101 that domains need to match. You still don't know then of course. When in doubt you shouldn't do the action that is asked through clicking on links in the mail. Instead go to the domain you know to be legit and execute the action there. Having said all that, even the most aware people are only human. So it is always poss…

Corollary: dont click on any emails links. (Most use some dumb domain name that could be phishing)

There are many sites, which provide ONLY links, eg. with token in URL. What with those?

Re: We all dodged a bullet

#440

Post by hennell »

brushfoot wrote: post #424
whiplash451 wrote: post #415

Not a security expert but I don’t think that requesting a reset of your 2FA credentials is reasonable. I would be very worried about my 2FA provider if they asked me to do this. And so I would not rate this phishing email a 10/10 at all.

Yes, the article's insistence that anyone would have fallen for the phish, and that anyone who disagrees is simply "wrong," is unfortunate. My old corporate phishing training drilled it into my head pretty effectively that you don't follow links in emails if the emails aren't direct responses to actions you've just taken: registering an account, resetting a password, and so forth. To this day, I don't follow links in…

Anyone is a literal stretch, but "almost anyone" seems pretty true. How many people do you think follow your very security minded, but quite long-winded practice? 1 in 1000?, 1 in 10,000? 1 in 100,000? Less?

I think the vast vast majority of people would have fallen for it, it's a decent looking message, it has a sense of urgency and the domain doesn't look wildly wrong. Devs in theory might be more security aware, but also we work with a lot of different apps, systems and sites - mixed domains, weird deep-links, redirects we've all used (and possibly even deployed) such setups.

Add in most of my email is now through a corporate outlook, so domains aren't very visible it's all nestled behind "safelinks", and personal email is often on a phone so mousing over a link just isn't muscle memory anymore.

I think I'd be suspicious at the request, but possibly have clicked to see more, especially with the threat things might stop working soon. Maybe NPM/package platforms should be pushing security training to their biggest maintainers like your old corporation did, but for now they don't and the idea that people should be more aware of the risk is sort of the point.

Almost anyone would have fallen for that, thats why almost all of us need to be reminded to think of this stuff more.

Post reply on HN