How to take over the computer of a Maven Central user

Re:How to take over the computer of a Maven Central user by jnbiche on Monday July 28, 2014 @08:56PM (#8100156)

npm has the same problem of sending packages over http, but it's even worse since on average each node package uses about a billion other packages and because injecting malicious code in JavaScript is incredibly easy.

And to be clear, just http here is not the issue. It's http combined with lack of package signing. apt runs over http, but it's a pretty secure system because of its efficient package signing. Package signing is even better than https alone since it prevents both MITM attacks and compromise of the apt repository.

In fact, apt and yum were pretty ahead of their time with package signing. It's a shame others haven't followed their path.

[ Parent | on HN ]

Re:How to take over the computer of a Maven Central user by seldo on Monday July 28, 2014 @09:31PM (#8100272)

npm by default uses HTTPS, and has for more than 3 years. It's a little confusing because the loglines all say "http" in green, but if you actually look at the URLs being downloaded they are all to https://registry.npmjs.org/

[ Parent | on HN ]