Re:VSCode remote code execution advisory
by pixl97 on Wednesday December 07, 2022 @03:24PM
(#33899748)
The same way any business deals with any need. The requestor must make a business case for the need that is then reviewed.
I need $x.exe is not just a security risk, it's a business continuity risk. What is the licensing of $X, do we need to pay licensing for it? Are we getting sued for using it? Are we doing to redistribute it, and can we? In general the average programmer, especially on a team should not be making that choice, and someone higher up should before really expensive surprises happen.
I work in software composition analysis/static analysis/SBOM and ya, the average piece of software coming can be terrifying. Its common to see companies distributing things like open source packages in violation of the license. Even worse is when they are pulling in something like 'One-Js' and '0ne-Js' (made up for example) that shows up in audit of our SCA output.
Dont get me wrong I’d love to say lolno to these types of requests, but basically everything requires npm these days, while also being basically impossible to audit every dependency you install. I’m a huge fan of good security shouldn’t impact too much on productivity, but dependency trees make me lose sleep at night (waterhole attacks, EOL packages that are painful to remove, etc).
Pentester by trade with a background in software dev.