Backdoor in event-stream library dependency

Re:Backdoor in event-stream library dependency by Klathmon on Monday November 26, 2018 @12:15PM (#18534890)

Code review can't catch determined malicious actors. It just isn't a viable protection against that kind of attack.

Take a look at the underhanded c contest for plenty of proof where even very senior developers told up front that there is a backdoor in the code often can't find it! And they can't all be blamed on C being C, many of them would work the same in any language.

I don't know the solution, but shaming users and developers for not reviewing code enough sure as hell isn't it.

All that being said, reviewing changes in dependencies is still a good idea, as it can catch many other things.

[ Parent | on HN ]

Re:Backdoor in event-stream library dependency by floatingatoll on Monday November 26, 2018 @04:42PM (#18537066)

There’s no shame in refusing to study dependency diffs. If you consciously evaluate the risk and deem it acceptable, I agree with your judgement call.

What I find shameful is the lack of advisory warnings about this risk — by the repository, by the language’s community, by the teaching material.

This should have been a clearly-known risk. Instead, it was a surprise. The shame here falls on the NPM community as a whole failing to educate its users on the risks inherent in NPM, not the individual authors and users of NPM modules.

[ Parent | on HN ]

Re:Backdoor in event-stream library dependency by kurtisc on Monday November 26, 2018 @01:12PM (#18535469)

Most malicious actors aren't determined, they're lazy and will take the path of least resistance. Code review will catch out those.

[ Parent | on HN ]