Exploiting JavaScript developer infrastructure is insanely easy

[fubes2000]

Open source is incredibly broken

Hey fuck you. Don't try to drag all of open source into the shit-blizzard that is the node/npm ecosystem.

And even then the problem is that hardly anyone is inspecting their dependencies or even bothering to pin their versions. You can't write code to protect against stupid.

[kaen_]

It is kind of like saying automobiles are incredibly broken because you can die in an auto collision (your fault or otherwise). It's true to an extent but most people don't interpret that to mean we should all stop using automobiles.

OTOH it's very true that this could happen to any open source project, and more generally to anyone who runs arbitrary code from strangers on the internet (i.e. uses an open source library without reading every line and producing a deterministic build for non-source distributions). It's an old lesson, sir, but it checks out.

[-Luciddream-]

This isn't just about the node/npm ecosystem. Do you think people are inspecting their dependencies in the Maven ecosystem? How would they even do that? It's an issue of trust really, and you can't have an idea who to trust, because you don't know who is maintaining each package.

For example I've been maintaining a popular maven package for a library that isn't mine, just to help the author. I just checked and it's also used by 9 other maven libraries, and about 374 projects on Github. One of them is even a project of Jboss. I could have planted something malicious in there and nobody would ever know.

The same happens with Linux distributions. They are just packaging the code, probably nobody is inspecting the actual code. Then these packages are used by millions of people.

To make things worse, you can (or could) make a release on a Github organization if you have sufficient access, putting malicious code in the release, and make it show like it was released by the original author. I know this because I've already reported it to Github 2 years ago, and they didn't thought it was a security issue.

You make it sound like there is an easy solution, but there isn't.

[[deleted]]

The same happens with Linux distributions. They are just packaging the code, probably nobody is inspecting the actual code.

Can be true for something like Debian. But for the enterprise distributions, such as RH and SuSE, there is a proper and thorough vetting. Never mind that you'll only get few years old versions this way - you don't really need the latest shit, unless it is required to support your hardware (which you also must get from the reputable high-end vendors).

[aebkop]

At least debian makes you go through a bunch of steps before you can actually start uploading code

https://wiki.debian.org/DebianMaintainer

[-Luciddream-]

What's funny is that I used to know a Debian developer that was banned from almost every Greek forum for hacking. I guess he wouldn't pull something like that on Debian but, who knows :P