$ sudo rm -rf / === NPM install

Re:$ sudo rm -rf / === NPM install by tlackemann on Tuesday November 09, 2021 @08:22AM (#29161364)

Some of this is solved with locked dependencies and an understanding of how "npm install" actually works, but I find this point really takes away any credibility for this article:

> This is just one of the reasons why I think by 2023 working with ephemeral cloud-based dev environments will be the standard. Just like CI/CD is today.

Over my dead body will I ever use a cloud environment to write code. tmate[0] might be the closest I ever get.

I get some developers don't care about what they throw aimlessly onto a cloud, but I don't know what's being logged, what's being stored, how long it's being stored, who has access to it, what third-parties have access to it, and so on. The business I own or the one I write code for might care if those files were exposed like that.

Use a local VM. Or a development proxy. The cloud isn't a solution for everything.

[0] https://tmate.io/

[ Parent | on HN ]

Re:$ sudo rm -rf / === NPM install by mxey on Tuesday November 09, 2021 @08:28AM (#29161416)

The cloud environment where the code runs might be ephemeral, but it would most likely have access to some not so ephemeral resources that should still be protected.

If one wants to go sandboxing, the right place for it would be in npm, where packages should not be able to modify anything but themselves.

[ Parent | on HN ]

Re:$ sudo rm -rf / === NPM install by ghuntley on Tuesday November 09, 2021 @08:37AM (#29161525)

Don’t think within a package manager is the right place. Fundamentally there needs to be an onion layer around the entire activity (ie. a virtual machine, qubeos, oci/container, gitpod, github codespaces, namespace jail).

Example of tasty file that a package manager should never be able to read: /Users/mxey/.ssh/ssh_rsa or /Users/mxey/.netrc

[ Parent | on HN ]

Re:$ sudo rm -rf / === NPM install by thingification on Tuesday November 09, 2021 @03:02PM (#29166723)

Fundamentally according to what theory?

https://medium.com/agoric/pola-would-have-prevented-the-even...

[ Parent | on HN ]

Re:$ sudo rm -rf / === NPM install by ghuntley on Tuesday November 09, 2021 @03:23PM (#29166958)

Lovely, I had not seen this post before. Thank you for sharing.

[ Parent | on HN ]

Re:$ sudo rm -rf / === NPM install by teptoria on Tuesday November 09, 2021 @07:27PM (#29169499)

Great read. Thanks for sharing

[ Parent | on HN ]

Re:$ sudo rm -rf / === NPM install by Ginden on Tuesday November 09, 2021 @08:55AM (#29161735)

ssh_rsa shouldn't be readable to browser, Spotify, Zoom or whatever is currently running. And browser files should be isolated from any other process etc.

Linux security model (and I suppose other OSes too, but I'm most familiar with) is fundamentally incompatible with desktop environments. Mobile OSes got it much better.

I love Snap because it confines processes to sandbox.

[ Parent | on HN ]

Re:$ sudo rm -rf / === NPM install by kevinmgranger on Tuesday November 09, 2021 @01:41PM (#29165575)

Linux _does_ have SELinux. It's just too confusing to use.

[ Parent | on HN ]

Re:$ sudo rm -rf / === NPM install by Ginden on Tuesday November 09, 2021 @07:35PM (#29169562)

It's unusable for anyone but few highly qualified sysadmins.

If good security isn't easily obtainable for tech-savvy person in one hour, there is basically no security.

[ Parent | on HN ]

Re:$ sudo rm -rf / === NPM install by mxey on Tuesday November 09, 2021 @11:31AM (#29163840)

It has to be on the level of the package manager, if you want to avoid package A interfering with package B

[ Parent | on HN ]