Hacker News Reader

Comment by irishcoffee | Hacker News Reader

> unless you work for a government contractor where they have strict security policies

... So you're saying there is a blueprint for mitigating this already, and it just isn't followed?

It's more work and more restrictive I suppose. Any business is free to set up jfrog Artifactory and only allow the installation of approved dependencies. And anyone can pull Ironbank images I believe.

Eschewing with lockfile-based package management schemes actually takes less work.

<https://news.ycombinator.com/item?id=46008744>

Yes, but it requires people. Typically, you identify a package you want (or a new version of a package you want) and you send off a request to a separate security team. They analyze and approve, and the package becomes available in your internal package manager. But this means 1) you need that team of people to do that work, and 2) there's a lot of hurry-up-and-wait involved.

Doesn't even require that many people. The analysis can mostly be automated, and the request process can be handled via peer review. Having one or two people for every 100-200 developers who can give sensible advice, provide some general oversight of what's going on, and step in to say 'no' occasionally does help though.

Also means you can put an end to a popular antipattern that has grown in recent years: letting your production infrastructure talk to whatever it likes to download whatever it likes from the Internet.

I'd be curious how many of today's automatic package validation tools or peer review processes would have caught the lotusbail package discussed in the article. The malicious aspects were heavily obfuscated, and it worked as advertised.

> Yes, but it requires people.

I've heard rumor of a few 100k people laid off in tech over the past few years that might be interested.

Whose gonna pay for it? The companies that laid off those people? They'll just continue on without worrying.

Reply on news.ycombinator.com