Socket turns the whole npm security problem on its head and asks: what if we assume all open source may be malicious? Can we proactively detect indicators of compromised packages? What's the simplest way to mitigate this risk without hurting usability?

In your FAQ, it says "We're working to make Socket the best open source security tool.", this was confusing for me, as I got the impression that Socket's codebase is Open Source, and I went looking for it.

Maybe "We're working to make Socket the best security tool for open source packages" would be less confusing.

detects Chinese malware -> Threat Alert detects NSA malware -> Silent pass-through

I mean I guess I'm a pessimist, but also, I think I'm really a realist.

Socket’s not open source at this time, but we’re releasing a CLI in the coming week if the GitHub App doesn’t suit your purposes.

https://socket.dev/npm/issue/telemetry https://wiki.debian.org/PrivacyIssues

https://www.youtube.com/watch?v=lZ8s1JwtNas https://github.com/artemdinaburg/bitsquat-script/

Publishing malware is, and should remain, protected expression.

This isn't enforceable in quite a few jurisdictions anyways. The best you can do is "No warranty to the extend permitted by law" at which point this specific use case is pretty much no longer relevant.

But in all seriousness, that was one of the most jarring things I found when switching from a Java/Maven stack to JS/NPM. Both Maven and NPM offer similar features for managing dependencies, but anecdotally I found the folks managing Java projects to be a lot more obsessive about carefully managing their dependencies while in the NPM world, it seems almost to be a "best practice" to just use open ranges for your dependencies and automatically update them...

That said, such a law is difficult to enforce, in a justice system as moribund as ours, so instead we rely on (probably wrong) heuristics about what specific behavior makes us safe, and indeed, whether or not our resources have already been breached. Such behavior is what drives the overwhelming dominance of GMail, which is itself a remarkable tool with which to learn about any person group corporation government on the planet. So in terms of utility its hard to argue that malware is a good to society. Write a malware that installs a patch to prevent a 0-day in known use by a state actor, then I will be a malware fanboy. Not until then.

If it is advertised as malware, yes. But if it is advertised as a working open source project - but in reality is malware, then this just destroys trust into open source in general.

I guess it is good, that these things come up, to think about why we trust the dependencies and repositories and their maintainers.

Because it seems, no we cannot just trust them. And now I am more conscious about it.

OSS should be about technology and not politics.

> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.

Its fitness for any particular purpose was expressly disclaimed, in all caps.

I'm not sure what people think they did wrong here. You're allowed (and should be allowed) to publish malware, it is up to consumers to not install software they don't want to run.

What more warning could they have possibly posted beyond this one?

Case in point, I have no idea. I know it's something related to the cloud but none of my clients are using it.

And their Wikipedia article is filled with buzzwords and no explanation of what it does, which doesn't exactly give me confidence that it'll be useful for regular companies. "Infrastructure as code"... so Ansible or docker compose? In any case, you don't need it if 2 HA bare metal servers do the job.

It would be overkill for many things that have a single, fairly static configuration, but for things like ensuring that a dev and prod cluster have the same configuration, it’s a lifesaver.

Version Control for Cloud Configurations

(not affiliated in any way, just a happy user)

That's a lot of people who can.

i don't know any, but they sure do exist

I build my nodejs/npm stuff in containers. Actually I build almost everything that way.

There are a lot of advantages in addition to the security gains, such as that I don't need to rely on every javascript programmer in the world understanding semver (they don't, and I have wasted more of my "sanity" on tracking down API changes and sloppy type contracts than I ever have spent cleaning up after malice.

What’s the logic here? Why are supply-chain attacks inherently bad?

So, are the sanctions which attack other kinds of supply chains in Russia also bad?

Or is software an exception? Why?

If they just hand you food without a word then (at least in quite a few jurisdictions, but maybe not all) they are liable.

> as of v11 this module uses the peacenotwar module.

Over on its NPM site: https://www.npmjs.com/package/node-ipc

And as far as i can tell they bumped up the major version by a digit. Whether or not that counts as a "Bright red warning" i don't know but personally i believe that a warning notice + a major version bump should be enough. Those who don't care about that would most likely not care about a bright red warning on the repo page either.

It's clearly a questionable thing to do, but is it illegal?

No normal person would see "peacenotwar" for the first time and assume it does something bad.

This counts as "no warning whatsoever", and no competent lawyer would say it's a warning message.

I might one day have an IP that is accidentally mis-classified as Russia. I mean those Geo-IP services are only like 95% accurate and they go out of date pretty quickly and updates are expensive. Plus .RU VPN services used to rent subnets in the US all the time. But then all of my files get deleted because someone wanted to make a point. So then I'm collateral damage in someone's remote fight in a war that neither of us were actually involved in.

Your argument is a bit like saying "It's OK to use chemical weapons because we're the good guys." They are not banned to protect soldiers, they are banned to protect civilians. And most likely, node-ipc's patch will hurt much more innocent civilians than it'll hurt Russian soldiers. It's the software equivalent of indiscriminate bombing.

Who's interests do corporations represent?

What are the costs of their actions?

What are the costs of their inactions?

it more or less just makes it difficult for updates to propogate, which is arguably a good thing.

Well, yeah. War is bad. On the spectrum of war badness, obviously, these pranks are pretty mild. But they're bad. It's a bad situation. When at war, people are forced to do bad things to prevent worse things. That's why starting wars is very bad.

Now, sure, you can argue about the semantics about "who" is at war, or whether these npm authors are "really" at war, or why they "think" they're at war, or whether they "should" be at war. You could also get into a discussion about whether or not this tactic is effective (and I'd agree it's hurting more than helping, btw). Go nuts.

But that doesn't change the fact that this is an action in support of a war effort. In wars, principled stands don't win. If you want a particular outcome, you have to pick a side.

I picked a side. I will take care that npm is not installed on my computers. Take your political sh*t out of my computer.

The premise behind your position is clearly that "politics" is some kind of meaningless distraction to the "real" business of shipping software. But... isn't that backwards? It's a war. People picked a side.

The idea that unilateral military invasion is merely "politics"[1] is... very strange to lots of people.

[1] In the sense of triviality you clearly intended, c.f. Clausewitz again.

Easy to say if you are not a frontend engineer.

You're implying that wars have no rules. This is very much not true, not legally and not morally. You should read the 4th Geneva Convention to disabuse yourself of this dangerous misconception: https://ihl-databases.icrc.org/applic/ihl/ihl.nsf/INTRO/380

>In wars, principled stands don't win

And excessively unprincipled stands can get you sent to The Hague to be prosecuted for war crimes.

Now, I'm not saying that deleting some files is a war crime. What I'm saying is that your reasoning for why it is legitimate is flawed.

I even doubt that you would agree with your own reasoning given some other examples. E.g., would you not agree that while we can ask McDonalds to stop doing business in Russia, it would be a crime for them to start poisoning their Russian customers?

Unless you're from the US, in which case the US will invade Netherlands to get you out of there. Apparently, there is a law (from 2002 IIRC) which allows the US to do this legally.

Same goes for Russia, China, Iran, Saudi Arabia, and a lot more countries that did not sign (or ratify) the Rome Statute.

> One of the principles of international law is that a treaty does not create either obligations or rights for third states without their consent, and this is also enshrined in the 1969 Vienna Convention on the Law of Treaties.[149] The co-operation of the non-party states with the ICC is envisioned by the Rome Statute of the International Criminal Court to be of voluntary nature.[150]

For Russia, China, and the US there's literally nothing that can be done: while the "members of UN Security Council" are "compelled to co-operate" with the ICC, these members can veto anything that comes up.

In other words, if you're from one of non-signatories, you can willfully kill, torture, subject to inhumane treatment, perform biological experiments, steal and destroy property, take hostages, unlawfully confine, transfer, and deport, and even willfully cause great suffering without fear of any kind of prosecution.

Does Geneva Convention make a difference? I only learned about ICC and Rome Statute, and it was disheartening enough for me to stop reading, so it's a genuine question.

Yes I think it does. Whatever the limits of enforcement, it means something that all the countries you mention are signatories to the Geneva Conventions I - IV.

Even if these countries refuse to extradite their citizens to The Hague, it doesn't necessarily protect war criminals from prosecution in their own countries. They are still breaking the law.

Of course the practical problem is getting hold of the suspected war criminals.

https://en.wikipedia.org/wiki/Universal_jurisdiction

https://www.justiceinfo.net/en/39791-international-crimes-sp...

In the current climate I am not sure anymore that people would disagree with poisoning Russians. Here in Germany they started to purge everything Russian (except people) and also agitating against Russians in general. It feels like we learned nothing from WW2.

From what I've seen there seem to be worldwide movements in that regard, that are even overboard for cold war propaganda.

edit: added "except people"

[1] https://www.axios.com/russian-businesses-us-vandalism-threat...

If you choose to become an actor in a war, then you also open yourself up to being attacked. There is only one kind of actor in a war- combatant.

Consider the maintainer who did the “delete all files on servers with Russian IP addresses.” This could be construed as an act of war against Russia. Would Russia be wrong to commit acts of war against this person? If the server performed some life critical task like operating hospital equipment or air traffic control or whatever, this change could have resulted in loss of life (so many mistakes in using JavaScript in such cases but set that aside for a moment). If lives were lost as a result, would Russia be wrong to use lethal force against the maintainer?

Disclaimer (sad that you have to add this these days; it should go without saying): I only use this as an example. I think Putin is a thug and I think that it goes against most westerners’ values, mine included, for nation states to preemptively invade other nation states. I’m not apologizing for or justifying any act by Russia. I have deep sympathy for people in Ukraine who just want to live their lives and not be killed or have their stuff destroyed.

>If lives were lost as a result, would Russia be wrong to use lethal force against the maintainer?

Yeah, unless they want to admit that they’ve been waging war against the entire western world by allowing their homegrown ransomware groups to operate with impunity.

If we go by your logic, Western countries should have turned Moscow into a giant glass parking lot after NotPetya, a destructive wiper worm released by the Russian government targeting the entire world.

Luckily you’re alone with your thinking.

And there are levels of warfare between "nothing" and "nuclear", in case you hadn't noticed. And North Korea and China are doing state-sponsored attacks against US targets, commercial and government and military. It's not clear to me that NoPetya was state sponsored, it's ransomware. The RF is not a bastion of law enforcement and justice; I agree that they do a terrible job of controlling organized crime activities, both cyber and non-cyber.

[1] https://www.vice.com/en/article/dypeek/open-source-sabotage-...

Fighting against bad actors is definitely a 'principled decision'.

Ignoring the situation and not taking action is an 'unprincipled decision'. Though it might disguised as principled action, on the basis of supporting some other principle, such 'open source', but ignoring one at the expense of another implies serious lack of self awareness.

This war, plus COVID, and the recently released documents indicating a planned invasion of Taiwan (though we don't know for sure) - represent major geopolitical shift of the order of WW1/WW2/End of Cold War, the stakes and consequences are enormous.

And the point is that it's a war. We've crossed the "bad things are going to happen" Rubicon already. You can't make principled arguments like that against people who have chosen to engage in a war out of the hope or desire for one side to win. They already did that moral calculus. It's like telling someone they shouldn't defend their home because pacifism is more important. You might be right, but you won't change anyone's mind.