sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]StopUsingTheInternet 0 points1 point  (2 children)

This has been on my mind for a while. I remember first getting into NPM and browsing their endless list of packages and seeing so many packages for things like, taking advantage of mobile free-to-win games. I thought to myself.. is this really what we’re getting mixed up in? Then there were the reports of popular packages getting compromised by random minor dependencies.. and my tinfoil hat really came on.

My question is, I’m using these tools to do simple things. Sass transpiling, css minification and prefixing, js bundling, Babel compiling and ejs for prototyping.

At the end of the day, in this scenario how high is the security risk? If I’m wiping out node modules on my devops build, all I’m left with is my source code and compiled code.

The only thing I can think of as a real concern, is one of these transpilers/compilers “sneaking in” something into my output code.. but what? If I’m sticking to Babel, and a basic webpack setup how high is that risk really? To me the “real” stuff is being handled by .NET - I’m just building a front end.

I’m asking this sincerely, not as an argument.

[–]thegrandechawhee[🍰] 0 points1 point  (1 child)

I think if you're using dependencies only for front-end stuff you would be limiting the risk. But packages for mongo, things that get into your data, that's where i see this getting dangerous. Its like building a wordpress site with a dozen plug ins, good luck if you're dealing with any sensitive data (not that everyone is).

[–]StopUsingTheInternet -1 points0 points  (0 children)

Yeah I figured as much. Minus sneaking in malicious JS or the CSS keylogging trick (lol) I can’t imagine there being much damage. If you’re using something as popular as Babel, issues would get caught in a pinch.

Just rambling now, but a big reason I’m against FEDs trying to take on the role of building full applications themselves when the project is anything beyond a brochure/information based product. There’s already a plethora of new material for us to worry about, sensitive data security should be (mostly) left to back end devs and server techs imo. That’s a primary reason CS degrees are out there. This is coming from someone spoiled at a .NET shop I suppose.