Hacker News Reader

Comment by rendx | Hacker News Reader

I don't know if you're being serious or not, but in case you are: There is a difference between (re)using other people's open sourced code, hopefully reviewed, and giving anyone in control of the third party repository the ability to run arbitrary code on your user's devices. Even if the "random GitHub repo" doesn't contain any malicious code right now, it may well contain some tomorrow.

View on HN

Completely agree. This is really unique. Can you imagine if it were standard practice to be open to supply chain attacks like that, by blindly relying on hotlinked or unpinned dependencies?

Why imagine? Let's take a quick look at what's actually happening right now. We can check some widely used libraries and see what their instructions are teaching new developers.

Boostrap (code snippet from their quick start instructions): ``` <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <title>Bootstrap demo</title> <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist/css/bootst..." rel="stylesheet" integrity="sha384-sRIl4kxILFvY47J16cr9ZwB07vP4J8+LH7qKQnuqkuIAvNWLzeN8tE5YBujZqJLB" crossorigin="anonymous"> </head>

Pay close attention, they are inviting the new developer to link not just to Bootstrap, but to Popper!

HTMX (code snippet from their quick start guide): ``` <script src="https://cdn.jsdelivr.net/npm/htmx.org@2.0.8/dist/htmx.min.js"></script>  <button hx-post="/clicked" hx-swap="outerHTML"> Click Me </button> ```

Fontawesome: A video quick start guide and instructions that recommends using the direct link to the kits via CDN for performance!

Look, I certainly don't think they should be used this way. But, to say that it's unique to the White House app? I definitely wouldn't say that. In fact, I think you've dangerously overestimated the status quo.

They have not. CDNs are specifically meant for demo/non-critical usage, to make it easy for amateurs to try out the library.

You don't do this in any non-trivial system.

According to FontAwesome you're wrong. Their instructions say that their CDN is the recommended way to use their kits.

So, it's nice that you don't do this. But there's nothing special about the White House app doing it. It's very common.

I was being sarcastic. Although hot linking is not particularly common, it's common enough; and unpinned dependencies are just as much if not more of a supply chain attack risk.

I'd bet something like 70+% of all JS apps are inadequately protected against the risk of a malicious actor gaining access to a dependency's repo.

Pearlclutching over this while ignoring the lessons of `left-pad` and `colors` is biased motivated reasoning at best.

Awesome. Now that I know you were being sarcastic it's hilarious. It's amazing how difficult it is to tell from text.

Huh? But there are integrity checks (none in htmx case, which is strange), to prevent exactly this attack.

I'm not sure I follow. How does an integrity check help when the source is compromised? The developer doesn't know that their repo is compromised. They continue posting legitimate hashes because the repo is legitimately compromised.

even open source is not that trustworthy.

there are several corpo open source ai apps that have rce built in.

to cut a long story short they pull their config from the developer's server on startup. that config has user level permissions giving rce.

some have no rce but get remote executed exfiltration of all the prompts. the app pulls its posthog config on startup and can just take all the keyboard inputs.

submit a disclosure and they do nothing or accuse of 'ai slop reports' despite being vibe coded themselves

Reply on news.ycombinator.com