Hacker News Reader

Comment by perlgeek | Hacker News Reader

I really wonder why supply chain security wasn't such a big issue before, and why there weren't really many supply-chain attacks on software before.

Too few attackers understood it well enough? Or were other attack vectors easier?

View on HN

Because C does not have package managers. We were copy pasting libraries as .h files in our projects and never updating them.

I still find it mind boggling that businesses have build processes for their core properties that rely on pulling hugs swathes off third party code in from the internet. How can that ever possibly be secure and robust?

It’s even scarier when you actually sit down and review some of the code you’ve been importing for years…

It has resulted in a major thinking shift for me. Mostly initiated by a malicious nodejs package being quietly pulled in.

Is there a language ecosystem you prefer now?

I mostly write stuff in Go with no imports at all now. It’s just that and stock vim on macOS is my entire stack.

I am fortunate that my own contributions only require that.

Had they written all the dependencies themselves, would they have been as secure and robust?

The tradeoff isn't simple, and will be different for each company. I think everyone can point at a couple of components that are complex and massively benefit from the work poured into them and the large install base finding all the edge cases. Equally everyone can name a couple of dependencies that anyone could rewrite in a couple hours, and maybe even improve on the way.

Maybe, maybe not, but they certainly wouldn’t have included as many widespread, well known vulnerabilities with exploits already in the wild. And even if the imported code was perfect at the time it was imported, pulling in changes automatically is still an attack vector that you could drive a fleet of buses through.

Note that I’m not saying “never use libraries”, which your points seem mainly aimed at. Code reuse is great! I’m just not sold on automatic, unmonitored updates to libraries.

Same with C++. Dependencies were boost, qt, gtk, and a few others and that was pretty much it. Since vcpkg, cmake, conan, and a few others, the C++ "ecosystem" has started growing far more in the last 10 years, than in the previous 20.

Is the modern tooling to blame for? It didn't use to be so simple that everything could be automatically updated or pulled. Had to actually go out and see what you were brining in and maybe even take a look in documentation or dates of last update.

I don't think there's one real reason but a combination, but I can list the features that C# and Java ecosystems had since the early 00s, and javascript/Rust have since they came around, but C++ hasn't had until recently.

1. one or more major package hubs

2. one package manager, or at least, a package standard

3. easy to consume/build (source code to binary)

4. easy to publish

5. easy to download (one liner in your build script, e.g. package.json, vcproj, cargo.toml, build.gradle etc.)

At the moment C++ only really has 5. - easy to download: cmake, conan, vcpkg, build2, can all download easily.

1-4 are a work in progress for C++, but are far better than 10 years ago.

Looking at https://wiki.alopex.li/LetsBeRealAboutDependencies

Perhaps the reason is package managers for C are called distro maintainers (for Linux/BSD)

There's a copycat effect at play too. Once something becomes well-known enough, it enters as an idea into more people's minds that it's a possible thing, and some will attempt it. Before it was smashing the stack, now it's supply chains etc. As for what you can do with an attack vector to motivate beyond a simple satisfaction in breaking something, an obvious popular choice now is ransomware. Ransomware attacks would still continue even if the world somehow got rid of cryptocurrencies, they would just use less convenient but more traditional forms of payment. Because ransomware became popular.

Attackers do what makes money. A lot of that is market driven - you buy what exploits are available, what tools are available, etc. You monetize in a fairly standard way. Attackers aren't all just random people thinking "oh I could hack that" - that's a tiny minority of them.

Eventually, due to a lot of factors, threat landscapes start shifting and attackers start moving their targets and tooling. One of the bigger shifts would be the huge, rapid improvement to both OS and browser security that occurred within a few years, radically increasing the cost of attacking desktop users via malicious websites. Another would be crypto, where 'account takeover' attacks that could lead to wallet access are now easier to monetize + crypto itself as a tool for transfers.

With regards to supply chain, enough of these changes occurred that some attackers took the leap and have started looking at this area. There are probably a lot of reasons why - prevalence of dependencies, increased interest in tech companies, etc.

If it continues to prove viable (it's obviously viable from an attack perspective, unclear if it's something attackers will rally around to monetize) we'll see it escalate and get better tooling around the attacks.

Programming style has changed over time to include more dependencies from 3rd party. Look at style of programming from 70s, they would do everything from OS , filesystem to application. Today there are many dependencies.

EDIT: It's much like building a tower. Upper floors depends on lower floors. Taller the construction more unstable it gets.

Probably because the CIA was doing tons of it and did not want to tell people :-D

Reply on news.ycombinator.com