News for hackers. Stuff that matters.

A comment on Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps. Parent comment

Re:Dev corrupts NPM libs 'colors' and 'faker', breaking thou... by marcus_holmes on Monday January 10, 2022 @05:42AM (#29872848)
This is a false equivalence brought up every time anyone mentions how vulnerable the npm/gems/pip ecosystems are to supply chain attacks.

Linux code is always reviewed before deployment, goes through many eyeballs, people are careful about this. The same is not true of npm, or any of the other services (as this event clearly shows).

[ Parent | on HN ]
Re:Dev corrupts NPM libs 'colors' and 'faker', breaking thou... by 0x0nyandesu on Monday January 10, 2022 @05:47AM (#29872890)
Eh that's not true. I use Gentoo so trust me most things are run by little dictators of their own little fiefdoms.

I'm talking about not just the kernel but all the various other things from libraries to servers to tools and everything in between.

[ Parent | on HN ]
Re:Dev corrupts NPM libs 'colors' and 'faker', breaking thou... by marcus_holmes on Monday January 10, 2022 @05:55AM (#29872970)
OK, but none of those little fiefdoms are "Linux".
[ Parent | on HN ]
Re:Dev corrupts NPM libs 'colors' and 'faker', breaking thou... by 0x0nyandesu on Monday January 10, 2022 @06:14AM (#29873096)
I literally said the Linux stack which includes everything from the kernel to init to libs. You can't run just the kernel.
[ Parent | on HN ]
Re:Dev corrupts NPM libs 'colors' and 'faker', breaking thou... by marcus_holmes on Monday January 10, 2022 @06:21AM (#29873151)
It's still a false equivalence. You'll agree that all the important bits of the Linux Stack are audited and reviewed by multiple people, right?
[ Parent | on HN ]
Re:Dev corrupts NPM libs 'colors' and 'faker', breaking thou... by smorgusofborg on Monday January 10, 2022 @07:41AM (#29873883)
Parts of the Linux stack equivalent to colors and faker are carefully audited and reviewed by multiple people? That sounds to me like elevating them to important bits in a false equivalence.
[ Parent | on HN ]
Re:Dev corrupts NPM libs 'colors' and 'faker', breaking thou... by mannykannot on Monday January 10, 2022 @08:33AM (#29874490)
When it comes to security (among other things), one simply cannot say that all the important bits are in the kernel. If that were the case, there would not be an issue to discuss here.
[ Parent | on HN ]
Re:Dev corrupts NPM libs 'colors' and 'faker', breaking thou... by 0x0nyandesu on Monday January 10, 2022 @06:41AM (#29873299)
Lol hell no. You're joking right?
[ Parent | on HN ]