51–60 of 78 posts
Earlier quoted context omitted.
Finding vulns in popular OSS and disclosing is probably good for your reputation as a security researcher, even if it's not immediately profitable.
How is that sustainable? Are security researchers going to be doing free labor for you indefinitely for exposure?
I’d never heard of socket until they found and reported shai hulud hiding in pytorch lightning. It pays off.
> If everyone sets a cooldown, there will be no early adopter. This ignores all the security companies & researchers screening packages.
Also ignores the common vector of the maintainer getting compromised and their credentials immediately being used to push malware. Most maintainer are going to notice that themselves.
It will make credential attacks much harder to pull off successfully and the returns from using them will drop pretty dramatically.
Earlier quoted context omitted.
I think it's great if people actually use LLM for the analysis. I did mention it in the solution part in the post: > Run LLM-assisted audit on vendored code.
What do you call the time period between "new package is released" and "automated security scanners have analyzed the package"? That sure sounds like a release cooldown to me.
This post is based on an assumption from what I see (I would be very happy if it's wrong) that most companies do not event bother to do these scans. They are merely waiting for the free kindness.
We're so close to a full circle moment. Next up is "npm stable", a curated set of packages (a "distribution", say) known to work well that are supported for a couple of years with security patches.
> If everyone sets a cooldown, there will be no early adopter. This ignores all the security companies & researchers screening packages.
Isn't this what alpha/beta/RC releases are for, ensuring that there are no issues before a general release? I just don't get ecosystem has decided to use client-side configurations for this rather than just marking the releases in the ways that already exist.
How do posts like this make it to the top of HN? Nearly all the comments here are saying the same thing I thought: 1. Security researchers and companies are incentivized to install packages early. 2. Even without security patches, people and teams can still set the cooldown period that is appropriate to their risk tolerance. Even if someone in the wild does "get bit", it's better that a smaller number of people get b…
How do posts like this make it to the top of HN? Nearly all the comments here are saying the same thing I thought: 1. Security researchers and companies are incentivized to install packages early. 2. Even without security patches, people and teams can still set the cooldown period that is appropriate to their risk tolerance. Even if someone in the wild does "get bit", it's better that a smaller number of people get b…
And, the complainers are free to set the wait timer to 0 and go back to the way it was. I'll be glad to let them be the first penguin to jump in the water.
> If everyone sets a cooldown, there will be no early adopter. This ignores all the security companies & researchers screening packages.
Isn't this what alpha/beta/RC releases are for, ensuring that there are no issues before a general release? I just don't get ecosystem has decided to use client-side configurations for this rather than just marking the releases in the ways that already exist.
I wonder if the author has ever worked in IT. The idea of not moving quickly to new software versions has been around for decades. There are always early adopters and researchers looking at new, publicly available software. Critical industries have long waited for software releases to be stable and "recommended" by the vendor before upgrading, letting those early adopters who can afford some availability risk take ti…
> The idea of not moving quickly to new software versions has been around for decades. There are COBOL users and CentOS 6 users. They aren't affected by this issue. They might need to face another set of issues like vulnerability backporting and so on. People not worrying about cooldowns might still need to patch their log4j libraries, but that's another thing. This post is not for them. > There are always early adop…
The nature of some of these attacks, it does. If your developers machine with publishing rights gets rooted a cool down makes credential gathering attacks via script in npm so very much harder it's not even funny.
In some of the recent supply chain attacks the entire fiasco was only a few hours long, but in that time tens of hundreds of thousands of credentials may have been stolen.
One day timers have the weakness of weekends and holidays reducing the number of eyes/systems seeing the issue.