Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitLab discovers widespread NPM supply chain attack

about.gitlab.com

Post reply on HN
Print view View original

91–100 of 263 posts

Re: GitLab discovers widespread NPM supply chain attack

#91

Post by ndsipa_pomu »

foobiekr wrote: post #21
KevinMS wrote: post #11

Earlier quoted context omitted.

> it' wasn't some magical property of windows no, it really was windows

It really wasn't. MacOS classic was full of vulnerabilities as was OS/2 and Linux up through 2004. Windows dominated because it was the biggest ecosystem.

What made Windows easy to exploit was that it enabled a bunch of network services by default. I don't know about MacOS, but Linux disabled network services by default and generally had a better grasp of network security such as requiring authentication for services (e.g. compare telnet and ssh).

Also, Windows had the ridiculous default of immediately running things when a user put in a CD or USB stick - that behaviour led to many infections and is obviously a stupid default option.

I'm not even going to mention the old Windows design of everyone running with admin privileges on their desktop.

Re: GitLab discovers widespread NPM supply chain attack

#92

Post by Yokohiii »

I have an friend that starts an project next month that will rely on npm. He is quite a noob and didn't code in ages. He will have almost no clue how to harden against this, he will probably not even notice if he becomes a victim until something really bad happens.

Pretty sad.

Re: GitLab discovers widespread NPM supply chain attack

#93

Post by dominicrose »

AmbroseBierce wrote: post #65

Microsoft should just bite the bullet and make a huge JS standard library and then send GitHub notifications to all the project maintainers who are using anything that could be replaced by something from there suggesting them to do such replacement. This would likely significantly reduce the number of supply chain attacks on the npm ecosystem.

JS also has a stability issue. The language evolved fast, the tools and the number of tools evolved fast and in different directions. The module system is a mess and trying to make it better caused more mess. There's Node.js, TypeScript and the browser. That's a lot to handle when trying to make something "std".

Meanwhile I have been using Ruby for 15 years and it has evolved in a stable way without breaking everything and without having to rewrite tons of libraries. It's not as powerful in terms of performance and I/O, it's not as far-reaching as JS is because it doesn't support the browser, it doesn't have a typescript equivalent, but it's mature and stable and its power is that it's human-friendly.

Re: GitLab discovers widespread NPM supply chain attack

#94

Post by latexr »

nottorp wrote: post #82
AmbroseBierce wrote: post #65

Microsoft should just bite the bullet and make a huge JS standard library and then send GitHub notifications to all the project maintainers who are using anything that could be replaced by something from there suggesting them to do such replacement. This would likely significantly reduce the number of supply chain attacks on the npm ecosystem.

There's an xckd for that :) The one with 12 competing standards going to 13 competing standards, or something like that.

https://xkcd.com/927/

Re: GitLab discovers widespread NPM supply chain attack

#96

Post by h4ck_th3_pl4n3t »

AmbroseBierce wrote: post #65

Microsoft should just bite the bullet and make a huge JS standard library and then send GitHub notifications to all the project maintainers who are using anything that could be replaced by something from there suggesting them to do such replacement. This would likely significantly reduce the number of supply chain attacks on the npm ecosystem.

That is literally how the CycloneDX SBOM packages work, well, after the fact and after the disclosure process.

Re: GitLab discovers widespread NPM supply chain attack

#97

Post by AmbroseBierce »

nottorp wrote: post #82
AmbroseBierce wrote: post #65

Microsoft should just bite the bullet and make a huge JS standard library and then send GitHub notifications to all the project maintainers who are using anything that could be replaced by something from there suggesting them to do such replacement. This would likely significantly reduce the number of supply chain attacks on the npm ecosystem.

There's an xckd for that :) The one with 12 competing standards going to 13 competing standards, or something like that.

Pretty sure Microsoft is exponentially bigger than 99% of the library authors out there, and add to that the giant communication channel that GitHub gives it over developers, so the analogy breaks pretty fast.

Re: GitLab discovers widespread NPM supply chain attack

#98

Post by Karliss »

wiradikusuma wrote: post #28

Does anyone know why NPM seems to be the only attractive target? Python and Java are very popular, but I haven't heard anything in those ecosystems for a while. Is it because something inherently "weak" about NPM, or simply because, like Windows or JavaScript, everyone uses it?

For the last 2 years PyPi (main Python package repository) requires mandatory 2FA.

Last time I did anything with Java, felt like use of multiple package repositories including private ones was a lot more popular.

Although higher branching factor for JavaScript and potential target count are probably very important factors as well.

Re: GitLab discovers widespread NPM supply chain attack

#99

Post by Aeolun »

jaggirs wrote: post #41
Aeolun wrote: post #37

I thought this was a really insightful post, until they used it to try and sell me on Gitlab’s security features.

Why would that make it any less insightfull?

It didn’t make it less insightful, but it recontextualized what was, in hindsight, a pretty strong bias towards fearmongering.
Post reply on HN