Hacker News Reader

Comment by efortis | Hacker News Reader

For NPMs you can mitigate executing malware with `--ignore-scripts`

https://blog.uirig.com/getting-rid-of-npm-scripts

instead the downloaded malicious code runs in prod. maybe, if you are lucky, it does something strange in CI and you can catch it.

the only real solution is a reputation system (like https://github.com/crev-dev/cargo-crev ), which of course is unfortunately barely used

Correct, the above mitigation is only for malware on the dev laptops and build servers. IOW, it doesn't prevent injecting the malware on your program when compiling it.

Prod is bad, but stealing signing keys or credentials is worse.

Shouldn't build servers have limited or zero network connectivity in the first place?

Modern languages make offline builds far more difficult then they have to be, unfortunately. Rust, for example, buries its off-line installer on another domain. Rust also doesn't advertise or encourage bundling dependencies. Lastly, unrestricted build scripts basically give every dependency full code execution.

Any equivalent for non-Rust projects? I see git-crev is abandoned...

unfortunately the Rust version seems abandoned too :(

Unfortunate but expected. You get tired after swimming against the current for so long. The rust community has for better or worse settled on wild unauditable dependency graphs. A real shame given how delightful the base language is (ignoring async, of course).

Most people who can't deal with this, including myself, simply switched to other languages.

can you please elaborate on which language(s) you switched to?

Perhaps an over-correction, but I've switched to Go.

Any language with a proper standard library would do, but I found Go's modern and useful standard library to be well-worth the inefficiency and clunkyness of that language.

The more expansive the standard library is, the better.

Should be the default from a security perspective. Note their note about the need for a Makefile.

Reply on news.ycombinator.com