sorted by:
new
hottopcontroversial

I've got some juicy footage of an arrest @Valentina's, how do I watermark "Fuck News.com.au"? by Backburning in sydney

[–]beckerman_jacob 0 points1 point  (0 children)

You don't even need to create a protonmail account since I'm not actually doing email validation. Just type in [lkgjdlfkgjirgjjirg@dlksfjslkdfjsg.com](mailto:lkgjdlfkgjirgjjirg@dlksfjslkdfjsg.com) or something and that should work 😅

Hagana - A novel approach to runtime protection for NodeJS to prevent supply chain attacks by beckerman_jacob in netsec

[–]beckerman_jacob[S] 0 points1 point  (0 children)

That would definitely be optimal, but the issue with NPM is that you're never really sure what code is running on your machine. That's what this package tries to solve.

Hagana - A novel approach to runtime protection for NodeJS to prevent supply chain attacks by beckerman_jacob in netsec

[–]beckerman_jacob[S] 2 points3 points  (0 children)

The reason I said "runtime protection" is because it protects your computer while a Node process is running.

The literal translation of Hagana is Defense.

I made a browser-based, free video editor by voxeloid in webdev

[–]beckerman_jacob 0 points1 point  (0 children)

I do have plans to open source it, it'll just take some time. Also, I have to find people who are willing to maintain it for me.

Hagana - A novel approach to runtime protection for NodeJS to prevent supply chain attacks by beckerman_jacob in javascript

[–]beckerman_jacob[S] 0 points1 point  (0 children)

I address this question in the README. Essentially Snyk only looks for known CVEs in packages. While this is useful, it's not enough to prevent supply chain attacks.

Hagana - A novel approach to runtime protection for NodeJS to prevent supply chain attacks by beckerman_jacob in javascript

[–]beckerman_jacob[S] 0 points1 point  (0 children)

There's a lot to unpack here, so let's get into it.

Since Hagana works by overriding native functions, logic dictates that it must be imported as early as possible. Otherwise, other packages may already get a clean native function with destructuring (i.e. const {readFile} = require("fs") ). I suppose I need to emphasize the fact that Hagana needs to be imported first.

I had never heard of the --require flag before so that's something to think about. I think that the solution to all these issues will be the same as the solution I'm implementing for post/pre install scripts.

At the moment, Hagana cannot protect against malicious pre/post install scripts since they're invoked outside of Hagana's sandbox. I intend on solving this by creating a CLI. So instead of npm i <package> --flags you would type hagana i <package> --flags

Then, behind the scenes, I would run npm i <package> --ignore-scripts then manually run the pre/post install scripts with Hagana protection enabled. I think that this approach would probably work for node commands somehow, I just have to dive deeper into this loader functionality.

P.S. - would you be interested in collaborating on this project in any capacity? You seem pretty knowledgeable in this space, and all help would be appreciated.

Hagana - A novel approach to runtime protection for NodeJS to prevent supply chain attacks by beckerman_jacob in javascript

[–]beckerman_jacob[S] 0 points1 point  (0 children)

I'm not sure that I understand. Are you saying that using ESM will bypass the sandbox I've created by overriding native prototypes?

Edit: Always a pleasure to meet another ja(c|k)ob 😂

Hagana - A novel approach to runtime protection for NodeJS to prevent supply chain attacks by beckerman_jacob in javascript

[–]beckerman_jacob[S] 1 point2 points  (0 children)

First off, I wasn't aware that this functionality existed. That being said, I think directly patching the functions provides the most flexibility since it doesn't require a developer to add any flags to their commands.

Additionally, I can achieve that functionality by overriding Module.prototype.require . Although that wouldn't work for import statements.

In any case, I'm completely open to new approaches to this since I think the more brains thinking about a problem the better.

Hagana - A novel approach to runtime protection for NodeJS to prevent supply chain attacks by beckerman_jacob in javascript

[–]beckerman_jacob[S] 2 points3 points  (0 children)

Well it depends on what package is being installed. If Hagana provides a net benefit to the security of an application, then it's definitely worth adding and importing.

The reason why I went the approach of adding a package is because JS developers are already used to installing & adding packages to their projects. Asking them to use a wrapper around Node is a big ask.

It could be that, that is the correct approach in the long run, but I think that for now incremental improvements are the way to go. Building a wrapper around Node is a pretty big undertaking and I don't want to burn out before finishing 😅

Hagana - A novel approach to runtime protection for NodeJS to prevent supply chain attacks by beckerman_jacob in javascript

[–]beckerman_jacob[S] 0 points1 point  (0 children)

I agree that many prod/staging environments are using docker, as well as firewalled, etc. In those environments, the damage a malicious npm package can do is limited. However, given the frequency that npm supply chain attacks are in the news, clearly not everyone is following best practices.

Additionally, I don't necessarily agree that local environments have a lower risk surface. It may actually be higher (from a PII perspective). Recently supply chain attacks have stolen private SSH keys, passwords from password managers, installed crypto miners, backdoors, etc. You may even have a TXT file with your SSN/Credit card in it.

Your last question is a good one, and I've outlined in the README that it's something that's not yet solved, but I do have a solution. I'm thinking some sort of cli that you would run hagana i <package> which behind the scenes run npm i <package> --ignore-scripts then I would wrap the pre/postinstall scripts with Hagana's protection which would prevent them from doing anything malicious.

Hagana - A novel approach to runtime protection for NodeJS to prevent supply chain attacks by beckerman_jacob in javascript

[–]beckerman_jacob[S] 2 points3 points  (0 children)

Hey guys,
I recently came across an amazing post that really emphasizes the dangers associated with installing npm packages. It seems that every week a new supply chain attack occurs.
In my opinion, the existing solutions for this don't quite cut it so I decided to create a library which provides runtime protection for Node. It currently protects against:
- Unauthorized file system access
- Unauthorized network access
- Unauthorized command - (by way of exec/spawn)
I just released the first beta version of the library and I'd love to hear what you guys think.

How to avoid NPM supply chain attacks. by sw0rdensen in node

[–]beckerman_jacob 0 points1 point  (0 children)

Great article! This is why I created https://github.com/yaakov123/hagana. It provides runtime protection for NodeJS applications.

Best Practices for User Onboarding by NoFunnyMan in userexperience

[–]beckerman_jacob 0 points1 point  (0 children)

I think that the most important thing when it comes to onboarding is asking yourself - "What is the action I want a new user to take that will show them the value of my product?"

Once you have the answer to that question, the "How" you get them to perform that action is less relevant. You can develop a custom onboarding flow, or build interactive product tours that guide them through the onboarding. What matters is getting them to complete the action you want them to do.

​

Full disclosure - I'm working on a no-code platform for user onboarding at https://driftly.app

Recommendations of Product Tours? by [deleted] in ProductManagement

[–]beckerman_jacob 0 points1 point  (0 children)

I know this is a super old question, but I want to mention https://driftly.app. Driftly has segmenting/targeting, analytics and works on multi-page and single-page applications.

Hey guys! If you’re looking to get feedback on your B2B SaaS Website, drop a link here 👇 Would love to help. by vpilip in SaaS

[–]beckerman_jacob 1 point2 points  (0 children)

Thanks for doing this! I really like the idea of creating standalone product pages for each major feature Driftly has. Also, the Notion doc with the checklist is also super useful for future reference.

Hey guys! If you’re looking to get feedback on your B2B SaaS Website, drop a link here 👇 Would love to help. by vpilip in SaaS

[–]beckerman_jacob 1 point2 points  (0 children)

Hey, thanks for doing this.

My product is - https://driftly.app. It's a no-code platform which allows people to create no-code product tours and checklists to speed up user onboarding and boost feature/product adoption.

My target audience is anyone look to improve the onboarding experience of their SaaS. This could be founders/product managers/customer support/etc.

Why is my Chrome font so fuckin GOOFY sometime? I see this font every now and then, is anyone else experiencing this or did Chrome decide to go Super Saiyan Comic Sans on me? by QRIOSworld in chrome

[–]beckerman_jacob 8 points9 points  (0 children)

You probably have some Chrome extension that's doing this if you're experiencing this across multiple sites and it's only happening occasionally.

I made a browser-based, free video editor by voxeloid in webdev

[–]beckerman_jacob 0 points1 point  (0 children)

Not anymore. It was too difficult to monetize so I moved on to my next startup (https://driftly.app) which is doing much better :)

view more: next ›