Comment by agentifysh

2 days ago

yeah i mean this is a tough problem. unless you work for a government contractor where they have strict security policies, most devs are just going to run npm install without a second thought as there are a lot of packages.

i dont know what the solution here is other than stop using npm

29 comments

agentifysh

Reply
josephg  2 days ago

> i dont know what the solution here is other than stop using npm

Personally I think we need to start adding capability based systems into our programming languages. Random code shouldn't have "ambient authority" to just do anything on my computer with the same privileges as me. Like, if a function has this signature:

    function add(a: int, b: int) -> int

Then it should only be able to read its input, and return any integer it wants. But it shouldn't get ambient authority to access anything else on my computer. No network access. No filesystem. Nothing.

Philosophically, I kind of think of it like function arguments and globals. If I call a function foo(someobj), then function foo is explicitly given access to someobj. And it also has access to any globals in my program. But we generally consider globals to be smelly. Passing data explicitly is better.

But the whole filesystem is essentially available as a global that any function, anywhere, can access. With full user permissions. I say no. I want languages where the filesystem itself (or a subset of it) can be passed as an argument. And if a function doesn't get passed a filesystem, it can't access a filesystem. If a function isn't passed a network socket, it can't just create one out of nothing.

I don't think it would be that onerous. The main function would get passed "the whole operating system" in a sense - like the filesystem and so on. And then it can pass files and sockets and whatnot to functions that need access to that stuff.

If we build something like that, we should be able to build something like npm but where you don't need to trust the developers of 3rd party software so much. The current system of trusting everyone with everything is insane.

  • ratmice  2 days ago

    I couldn't agree with you more, the thing is our underlying security models are protecting systems from their users, but do nothing for protecting user data from the programs they run. Capability based security model will fix that.

    • Gigachad  2 days ago

      Only on desktop. Mobile has this sorted. Programs have access to their own files unrestricted, and then can access the shared file space only through the users specifically selecting them.

      2 replies →

  • irishcoffee  2 days ago

    > No network access. No filesystem. Nothing.

    Ironically, any c++ app I've written on windows does exactly this. "Are you sure you want to allow this program to access networking?" At least the first time I run it.

    I also rarely write/run code for windows.

    • christophilus  2 days ago

      Yeah, but if that app was built using a malicious dependency that only relied on the same permissions the app already uses, you’d just click “Yes” and move on and be pwned.

      3 replies →

miroljub  2 days ago

The issue with npm is JS doesn't have a stdlib, so developers need to rely on npm and third party libs even for things stdlib provide in languages like Java, Python, Go, ...

  • josephg  2 days ago

    Sure it does. The JS standard library these days is huge. Its way bigger than C, Zig and Rust. It includes:

    - Random numbers

    - Timezones, date formatting

    - JSON parsing & serialization

    - Functional programming tools (map, filter, reduce, Object.fromEntries, etc)

    - TypedArrays

    And if you use bun or nodejs, you also have out of the box access to an HTTP server, filesystem APIs, gzip, TLS and more. And if you're working in a browser, almost everything in jquery has since been pulled into the browser too. Eg, document.querySelector.

    Of course, web frameworks like react aren't part of the standard library in JS. Nor should they be.

    What more do you want JS to include by default? What do java, python and go have in their standard libraries that JS is missing?

    • krapp  2 days ago

      When people say "js doesn't have a stdlib" they mean "js doesn't have a robust general purpose stdlib like C++ or ${LANGUAGE_ID_RATHER_BE_USING}."

      But of course it fucking doesn't because it's a scripting language for the web. It has what it needs, and to do that it doesn't need much.

      5 replies →

  • Eduard  2 days ago

    JS has a stdlib, so to say. See nodejs, and Web standard.

    And no programming language's stdlib includes e. g. WhatsApp API libraries

____tom____  2 days ago

Developing in a container might mitigate a lot of issues. Harder to compromise your development machine.

I guess if you ship it you are still passing along contagion

irishcoffee  2 days ago

> unless you work for a government contractor where they have strict security policies

... So you're saying there is a blueprint for mitigating this already, and it just isn't followed?

  • parliament32  2 days ago

    Yes, but it requires people. Typically, you identify a package you want (or a new version of a package you want) and you send off a request to a separate security team. They analyze and approve, and the package becomes available in your internal package manager. But this means 1) you need that team of people to do that work, and 2) there's a lot of hurry-up-and-wait involved.

    • bigfatkitten  1 day ago

      Doesn't even require that many people. The analysis can mostly be automated, and the request process can be handled via peer review. Having one or two people for every 100-200 developers who can give sensible advice, provide some general oversight of what's going on, and step in to say 'no' occasionally does help though.

      Also means you can put an end to a popular antipattern that has grown in recent years: letting your production infrastructure talk to whatever it likes to download whatever it likes from the Internet.

      1 reply →