Re:On node-ipc and the importance of trusting trust
by vladvasiliu on Friday March 25, 2022 @02:12AM
(#30799155)
> Playing this game of cat and mouse will add so much red tape that nobody will want to use that package manager anymore.
Of course. But your comment still reads as "we can't make it perfect, so might as well not try at all". I think there can still be value in limiting the blast radius.
Your while(1), if present, is likely to be intentionally malicious. But I've seen many naïve libraries implement "accidentally quadratic" algorithms, which is basically a disguised while(1), but unintentional.
The point is that the end result of `rm -rf /` is painful. It doesn't matter if someone managed to maliciously sneak that into your supply chain, or if it rises from some funky corner case of some package whose only goal is to bring world peace. So being able to prevent some leftpad lib from accessing the file system at all makes a lot of sense.
Of course. But your comment still reads as "we can't make it perfect, so might as well not try at all". I think there can still be value in limiting the blast radius.
Your while(1), if present, is likely to be intentionally malicious. But I've seen many naïve libraries implement "accidentally quadratic" algorithms, which is basically a disguised while(1), but unintentional.
The point is that the end result of `rm -rf /` is painful. It doesn't matter if someone managed to maliciously sneak that into your supply chain, or if it rises from some funky corner case of some package whose only goal is to bring world peace. So being able to prevent some leftpad lib from accessing the file system at all makes a lot of sense.