Hacker News Reader

Comment by fxtentacle | Hacker News Reader

In my opinion, these changes are effectively supply-chain attacks in their execution. That would make them bad regardless of how correct their expressed positions are about the Ukraine war.

The fact that there has not been a strong push back confirms my suspicion that by now, everyone has gotten used to Node and NPM being insecure and silently accepted it as a way of life. Similarly, those Terraform scripts are apparently esoteric enough to only be used by a tiny minority of software developers, or else we would have heard about it in a different way.

Thank god nobody did similar shenanigans to open source projects that are actually in wide use :)

View on HN

We're building Socket to stop this exact type of attack. See https://socket.dev

Socket turns the whole npm security problem on its head and asks: what if we assume all open source may be malicious? Can we proactively detect indicators of compromised packages? What's the simplest way to mitigate this risk without hurting usability?

Socket seems interesting. I just installed it on some of my repos.

In your FAQ, it says "We're working to make Socket the best open source security tool.", this was confusing for me, as I got the impression that Socket's codebase is Open Source, and I went looking for it.

Maybe "We're working to make Socket the best security tool for open source packages" would be less confusing.

You are right. Thanks for the suggestion.

Great feedback. I initially understood socket was open source as well, which would have prevented me from using it to secure open source projects? circular argument :)

How do you detect compromised packages? What indicators of compromise do you use? Is Socket itself open source? Can I run it locally on the command-line?

We look at the behavior of packages, what APIs they use, and how that changes over time. The list of issues we currently look for is here: https://socket.dev/npm/issue

Socket’s not open source at this time, but we’re releasing a CLI in the coming week if the GitHub App doesn’t suit your purposes.

That's actually interesting, I will look into more details to see if we can integrate this into our systems. Do you have any avaiable technical documents so we can get a glimpse of how Socket is working, or is your Blog the best place to start?

Re the typosquat issue, maybe also add bitsquatting

https://www.youtube.com/watch?v=lZ8s1JwtNas https://github.com/artemdinaburg/bitsquat-script/

I absolutely love that you added a telemetry issue! I'm linking your page about it from the Debian privacy issues page.

https://socket.dev/npm/issue/telemetry https://wiki.debian.org/PrivacyIssues

Why should we trust closed-source software to audit open-source code? In the words of an infamous bounty hunter: "Does that seem right to you?"

In U.S

detects Chinese malware -> Threat Alert detects NSA malware -> Silent pass-through

I mean I guess I'm a pessimist, but also, I think I'm really a realist.

"if you make any kind of ruckus, your body is forfit"

There is so much wrong with this situation. Are developers who do something like delete-based-on-IP liable for some sort of civil or criminal penalty? Attempting to do active harm to a computer surely can't be legal.

They shouldn't be; they didn't install it on your machine.

Publishing malware is, and should remain, protected expression.

I agree, but I also believe communication should be consensual. That is, the recipient must give consent to install the malware. Otherwise the transmission is a commission of fraud against the recipient.

That said, such a law is difficult to enforce, in a justice system as moribund as ours, so instead we rely on (probably wrong) heuristics about what specific behavior makes us safe, and indeed, whether or not our resources have already been breached. Such behavior is what drives the overwhelming dominance of GMail, which is itself a remarkable tool with which to learn about any person group corporation government on the planet. So in terms of utility its hard to argue that malware is a good to society. Write a malware that installs a patch to prevent a 0-day in known use by a state actor, then I will be a malware fanboy. Not until then.

There's a big difference between publishing the source code of malware while clearly stating that it's malware, vs publishing trojan malware on NPM while knowing that it will be automatically installed by a bunch of package managers and cause damage. The former is fine; the latter is clearly malicious and is or should be a crime.

/s the real crime here is the way so few people seem to think it is important to pay attention to their dependency tree....

But in all seriousness, that was one of the most jarring things I found when switching from a Java/Maven stack to JS/NPM. Both Maven and NPM offer similar features for managing dependencies, but anecdotally I found the folks managing Java projects to be a lot more obsessive about carefully managing their dependencies while in the NPM world, it seems almost to be a "best practice" to just use open ranges for your dependencies and automatically update them...

You're thinking about it from the wrong perspective. Yes, publishing software can be thought of as expression, and that's protected by the constitution. But publishing malware as benign software, without disclosing it is fraud/deception, and that shouldn't be allowed. The legal system protects freedom of expression, but still allows you to get punished for deceptive speech that's harmful (ie. fraud/libel).

This is when the "no warranty, expressed or implied" kicks in, no?

Those words are not some sort of magic spell. Licenses can't override law unless the law explicitly allows them to, and the law generally distinguishes or tries to distinguish between honest mistakes and malicious behaviour. IANAL and laws differ between countries so YMMV.

> no warranty, expressed or implied

This isn't enforceable in quite a few jurisdictions anyways. The best you can do is "No warranty to the extend permitted by law" at which point this specific use case is pretty much no longer relevant.

That protects against bugs, segfaults, incompatibilities, etc. Not intentional malware.

So... Sony's rootkit was a-okay in your opinion? Or have you just not given any thought to your position at all? Because that seems to be pretty common among utilitarians who are somehow perpetually surprised by blowback and "unintended consequences". It really strains credulity, the whole "unintended" defense, when you've got people pointing to the predictable outcome. Analogies are rarely helpful in technical discussions, but who knows - maybe this time will be different: boobytraps. Boobytraps are a major no-no, and have been for a very long time, regardless of whatever mitigating circumstances you can dream up (deep in your property, posted warnings, etc). This node dependency was a boobytrap. You can try and justify it by pointing to licenses, concepts of developer IP ownership, etc - it is still a boobytrap. There is no talking your way out of it, in the same way that you wouldn't be able to talk your way out of injuring a trespasser who scaled your fence and triggered a mousetrap rigged 12ga-shell while breaking into your storage shed. This case is even worse - its more like allowing the public to wander onto your property for years to access your free petting zoo, before one day deciding to bury landmines all over the place and post a sign informing people that you take no responsibility for the resulting carnage.

"Publishing malware is, and should remain, protected expression."

If it is advertised as malware, yes. But if it is advertised as a working open source project - but in reality is malware, then this just destroys trust into open source in general.

I guess it is good, that these things come up, to think about why we trust the dependencies and repositories and their maintainers.

Because it seems, no we cannot just trust them. And now I am more conscious about it.

OSS should be about technology and not politics.

It was not advertised as a "working open source project". In fact, quite the opposite. From the license:

> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.

Its fitness for any particular purpose was expressly disclaimed, in all caps.

I'm not sure what people think they did wrong here. You're allowed (and should be allowed) to publish malware, it is up to consumers to not install software they don't want to run.

What more warning could they have possibly posted beyond this one?

In many jurisdictions this is indeed a criminal offense.

Thank god the supply chain attacks are happening in software, not at a molecular biology level.

I hate to burst your bubble, but Anton Babenko's terraform modules are extremely popular. The difference here is that he added a input with a default value to a specific release version. Generally, if you're using terraform professionally you'd either fork or mirror the module and pin to a specific version. In such case this change would not affect you. If you had e.g. something in development calling 'latest' version of an impacted module you again would not see this. It's an optional argument that defaults to a value causing no outward change in behaviour.

I'd bet you that 95% of all programmers can't even explain from memory what exactly Terraform is.

Case in point, I have no idea. I know it's something related to the cloud but none of my clients are using it.

And their Wikipedia article is filled with buzzwords and no explanation of what it does, which doesn't exactly give me confidence that it'll be useful for regular companies. "Infrastructure as code"... so Ansible or docker compose? In any case, you don't need it if 2 HA bare metal servers do the job.

I’ll try: Terraform replaces all the actions you’d do in the AWS (or other cloud provider) console or API with declarative configuration code. This means you can parametrize it, version control it, compose it, etc. and generally treat it like code.

It would be overkill for many things that have a single, fairly static configuration, but for things like ensuring that a dev and prod cluster have the same configuration, it’s a lifesaver.

That is a great summary :) and it highlights the value proposition that I was missing:

Version Control for Cloud Configurations

It is also awesome, easy to use and very convenient. If you are configuring anything through AWS web GUI, you should give Terraform a go, you won't regret it.

(not affiliated in any way, just a happy user)

> 95% of all programmers can't

That's a lot of people who can.

about as much as ferrari owners.

i don't know any, but they sure do exist

Working with NPM every day, that’s kind of how I look at it. Maybe my computer will be randomly wiped one day, but it’s not something you can worry about if you want to retain your sanity.

> it's not something you can worry about if you want to retain your sanity.

I build my nodejs/npm stuff in containers. Actually I build almost everything that way.

There are a lot of advantages in addition to the security gains, such as that I don't need to rely on every javascript programmer in the world understanding semver (they don't, and I have wasted more of my "sanity" on tracking down API changes and sloppy type contracts than I ever have spent cleaning up after malice.

That's a nice idea, thank you! No more worrying about node versions either.

> In my opinion, these changes are effectively supply-chain attacks in their execution. That would make them bad regardless of how correct their expressed positions are about the Ukraine war.

What’s the logic here? Why are supply-chain attacks inherently bad?

So, are the sanctions which attack other kinds of supply chains in Russia also bad?

Or is software an exception? Why?

What rights are you inaliably afforded from open source?

Hmmmm… ok, what if somebody is handing out free food, but it’s poisoned. Is he still liable for harming you?

Did they inform you that the food was poisoned? Does it come with a bright red wrapper saying "warning poison?

If they just hand you food without a word then (at least in quite a few jurisdictions, but maybe not all) they are liable.

Did the packages in question have a bright red warning that said “your files will be deleted if you’re in Russia?”

It did have this:

> as of v11 this module uses the peacenotwar module.

Over on its NPM site: https://www.npmjs.com/package/node-ipc

And as far as i can tell they bumped up the major version by a digit. Whether or not that counts as a "Bright red warning" i don't know but personally i believe that a warning notice + a major version bump should be enough. Those who don't care about that would most likely not care about a bright red warning on the repo page either.

It's clearly a questionable thing to do, but is it illegal?

Deleting random people's files sounds more like the warnotpeace module.

No normal person would see "peacenotwar" for the first time and assume it does something bad.

This counts as "no warning whatsoever", and no competent lawyer would say it's a warning message.

Definitely, with prison for life in many places.

iirc npm has support for pinning dependencies, you just have to remove the “^” at the start of the dependency version. Is there a global option in npm or yarn or pnpm? Why don’t they make this the default?

https://github.com/npm/rfcs/issues/509

it more or less just makes it difficult for updates to propogate, which is arguably a good thing.

> In my opinion, these changes are effectively supply-chain attacks in their execution. That would make them bad regardless of how correct their expressed positions are about the Ukraine war.

Well, yeah. War is bad. On the spectrum of war badness, obviously, these pranks are pretty mild. But they're bad. It's a bad situation. When at war, people are forced to do bad things to prevent worse things. That's why starting wars is very bad.

Now, sure, you can argue about the semantics about "who" is at war, or whether these npm authors are "really" at war, or why they "think" they're at war, or whether they "should" be at war. You could also get into a discussion about whether or not this tactic is effective (and I'd agree it's hurting more than helping, btw). Go nuts.

But that doesn't change the fact that this is an action in support of a war effort. In wars, principled stands don't win. If you want a particular outcome, you have to pick a side.

"principled stands don't win."

Fighting against bad actors is definitely a 'principled decision'.

Ignoring the situation and not taking action is an 'unprincipled decision'. Though it might disguised as principled action, on the basis of supporting some other principle, such 'open source', but ignoring one at the expense of another implies serious lack of self awareness.

This war, plus COVID, and the recently released documents indicating a planned invasion of Taiwan (though we don't know for sure) - represent major geopolitical shift of the order of WW1/WW2/End of Cold War, the stakes and consequences are enormous.

That's sort of a semantic argument. To be clear: I was contrasting "choosing a side" (in this case by senselessly pranking your npm customers) as being a "practical" choice, vs. the "principled" stand taken to avoid the conflict out of a general sense of open source decorum. Obviously in some sense all decisions are based on "principle".

And the point is that it's a war. We've crossed the "bad things are going to happen" Rubicon already. You can't make principled arguments like that against people who have chosen to engage in a war out of the hope or desire for one side to win. They already did that moral calculus. It's like telling someone they shouldn't defend their home because pacifism is more important. You might be right, but you won't change anyone's mind.

> But that doesn't change the fact that this is an action in support of a war effort. In wars, principled stands don't win. If you want a particular outcome, you have to pick a side.

I picked a side. I will take care that npm is not installed on my computers. Take your political sh*t out of my computer.

Perfect segue to that famous Clausewitz quote!

The premise behind your position is clearly that "politics" is some kind of meaningless distraction to the "real" business of shipping software. But... isn't that backwards? It's a war. People picked a side.

The idea that unilateral military invasion is merely "politics"[1] is... very strange to lots of people.

[1] In the sense of triviality you clearly intended, c.f. Clausewitz again.

> I will take care that npm is not installed on my computers

Easy to say if you are not a frontend engineer.

But none of these people picked a side in any of the other currently ongoing unjust occupations, or any of those in the recent past. So clearly you don't need to pick a side.

I think you have it completely backwards. You should not involve yourself in any war that you don’t personally want to fight and maybe die in. You do NOT have to take a side. You can oppose the war, or one or both sides, even vocally, without entangling yourself in the war.

If you choose to become an actor in a war, then you also open yourself up to being attacked. There is only one kind of actor in a war- combatant.

Consider the maintainer who did the “delete all files on servers with Russian IP addresses.” This could be construed as an act of war against Russia. Would Russia be wrong to commit acts of war against this person? If the server performed some life critical task like operating hospital equipment or air traffic control or whatever, this change could have resulted in loss of life (so many mistakes in using JavaScript in such cases but set that aside for a moment). If lives were lost as a result, would Russia be wrong to use lethal force against the maintainer?

Disclaimer (sad that you have to add this these days; it should go without saying): I only use this as an example. I think Putin is a thug and I think that it goes against most westerners’ values, mine included, for nation states to preemptively invade other nation states. I’m not apologizing for or justifying any act by Russia. I have deep sympathy for people in Ukraine who just want to live their lives and not be killed or have their stuff destroyed.

RF kills people for any or no reason. Why you worry about that? If you think that when you don't attack RF, then they don't attack you, you are wrong. You are member of rotten West, your country is a member of evil NATO, you are speaking non-russian language, and you are spreading anti-russian propaganda. You are danger to Russian Civilization. They will kill you, but their ressources are limited, so stay in line.

>Would Russia be wrong to commit acts of war against this person?

>If lives were lost as a result, would Russia be wrong to use lethal force against the maintainer?

Yeah, unless they want to admit that they’ve been waging war against the entire western world by allowing their homegrown ransomware groups to operate with impunity.

If we go by your logic, Western countries should have turned Moscow into a giant glass parking lot after NotPetya, a destructive wiper worm released by the Russian government targeting the entire world.

Luckily you’re alone with your thinking.

Apparently not, guy got swatted. [1]

And there are levels of warfare between "nothing" and "nuclear", in case you hadn't noticed. And North Korea and China are doing state-sponsored attacks against US targets, commercial and government and military. It's not clear to me that NoPetya was state sponsored, it's ransomware. The RF is not a bastion of law enforcement and justice; I agree that they do a terrible job of controlling organized crime activities, both cyber and non-cyber.

[1] https://www.vice.com/en/article/dypeek/open-source-sabotage-...

>Well, yeah. War is bad

You're implying that wars have no rules. This is very much not true, not legally and not morally. You should read the 4th Geneva Convention to disabuse yourself of this dangerous misconception: https://ihl-databases.icrc.org/applic/ihl/ihl.nsf/INTRO/380

>In wars, principled stands don't win

And excessively unprincipled stands can get you sent to The Hague to be prosecuted for war crimes.

Now, I'm not saying that deleting some files is a war crime. What I'm saying is that your reasoning for why it is legitimate is flawed.

I even doubt that you would agree with your own reasoning given some other examples. E.g., would you not agree that while we can ask McDonalds to stop doing business in Russia, it would be a crime for them to start poisoning their Russian customers?

> E.g., would you not agree that while we can ask McDonalds to stop doing business in Russia, it would be a crime for them to start poisoning their Russian customers?

In the current climate I am not sure anymore that people would disagree with poisoning Russians. Here in Germany they started to purge everything Russian (except people) and also agitating against Russians in general. It feels like we learned nothing from WW2.

From what I've seen there seem to be worldwide movements in that regard, that are even overboard for cold war propaganda.

edit: added "except people"

I've seen a few people in the media specify that the war's about Putin's aggression, rather than Russian aggression. But I doubt that they're the majority. Russophobia sells better. We've got people vandalizing businesses [1] and sending threats in the US as well. That doesn't help anyone in Ukraine, if that's really their goal. It certainly doesn't affect Russia's economy if a restaurant in another country takes a dive. The point of the sanctions is to hurt Russia's government (and therefore their military). There's a cost to sanctions as well for Russian citizens who have nothing to do with the war, but I've yet to see an alternative solution beyond escalating the conflict.

[1] https://www.axios.com/russian-businesses-us-vandalism-threat...

> And excessively unprincipled stands can get you sent to The Hague to be prosecuted for war crimes.

Unless you're from the US, in which case the US will invade Netherlands to get you out of there. Apparently, there is a law (from 2002 IIRC) which allows the US to do this legally.

Same goes for Russia, China, Iran, Saudi Arabia, and a lot more countries that did not sign (or ratify) the Rome Statute.

> One of the principles of international law is that a treaty does not create either obligations or rights for third states without their consent, and this is also enshrined in the 1969 Vienna Convention on the Law of Treaties.[149] The co-operation of the non-party states with the ICC is envisioned by the Rome Statute of the International Criminal Court to be of voluntary nature.[150]

For Russia, China, and the US there's literally nothing that can be done: while the "members of UN Security Council" are "compelled to co-operate" with the ICC, these members can veto anything that comes up.

In other words, if you're from one of non-signatories, you can willfully kill, torture, subject to inhumane treatment, perform biological experiments, steal and destroy property, take hostages, unlawfully confine, transfer, and deport, and even willfully cause great suffering without fear of any kind of prosecution.

Does Geneva Convention make a difference? I only learned about ICC and Rome Statute, and it was disheartening enough for me to stop reading, so it's a genuine question.

>Does Geneva Convention make a difference?

Yes I think it does. Whatever the limits of enforcement, it means something that all the countries you mention are signatories to the Geneva Conventions I - IV.

Even if these countries refuse to extradite their citizens to The Hague, it doesn't necessarily protect war criminals from prosecution in their own countries. They are still breaking the law.

Several countries have implemented some form of Universal jurisdiction for severe crimes like genocide, meaning their courts may prosecute regardless of nationality of the accused or country where the supposed crime happened.

Of course the practical problem is getting hold of the suspected war criminals.

https://en.wikipedia.org/wiki/Universal_jurisdiction

https://www.justiceinfo.net/en/39791-international-crimes-sp...

Right, and apparently all signatories to the Convention have an obligation to prosecute people who commit "grave breaches" of the conventions, no matter their nationality and the place the crime took place. So, if a commander from X commits the crime, and the X refuses to prosecute him, he can be legally captured and tried as soon as he visits another signatory country. This is better than just the ICC, definitely (if I understand it correctly).

Your argument creates dangerous implications. If a programmer creates targeted malware as an act of war - wouldn't that make him a valid military target? Would Russia be legitimised to carpet bomb wherever that programmer is supposed to live in retaliation? If not, would they be legitimised to capture and execute him - because he certainly isn't a legitimate combatant?

I surely wouldn’t bet my life that the targeted country would consider it a mere prank.

Reply on news.ycombinator.com