Welcome to Friendica.Eskimo.Com

Home of Censorship Free Hosting

 Eskimo North Linux Shells, E-mail, Virtual Machines, Web Hosting.

E-mail, Web Hosting, Linux Shell Accounts terminal or full remote desktops.

Sign Up For A Free Trial Here

Please tell your friends about federated social media site that speaks several fediverse protocols thus serving as a hub uniting them, hubzilla.eskimo.com, also check out friendica.eskimo.com, federated macroblogging social media site, mastodon.eskimo.com a federated microblogging site, and yacy.eskimo.com an uncensored federated search engine. All Free!
in reply to Kevin Beaumont

mastodon - Link to source

Kevin Beaumont

Weekly download stats for impacted packages prior to incident

ansi-styles (371.41m)
debug (357.6m)
backslash (0.26m)
chalk-template (3.9m)
supports-hyperlinks (19.2m)
has-ansi (12.1m)
simple-swizzle (26.26m)
color-string (27.48m)
error-ex (47.17m)
color-name (191.71m)
is-arrayish (73.8m)
slice-ansi (59.8m)
color-convert (193.5m)
wrap-ansi (197.99m)
ansi-regex (243.64m)
supports-color (287.1m)
strip-ansi (261.17m)
chalk (299.99m)

Total 2674m

in reply to Kevin Beaumont

mastodon - Link to source

Brian Campbell

Holy hell, these are some widely used packages. I've found tons of them in dependencies in our source code.

Looks like the bad versions are already being yanked. Can't find the compromised is-arrayish any more (was looking at it just a few minutes ago). supports-hyperlinks now has a new version published that reverts the change, though the bad version is still in the history. Likewise with chalk-template, wrap-ansi, etc.

Unknown parent

mastodon - Link to source

esa

See also the discussions on Git ML about adding Rust, where apparently all of one guy is maintaining git availability on HPE Nonstop servers (rare but allegedly critical), on his own time, and he can't port rustc as well
Unknown parent

mastodon - Link to source

tautology

the trend in npm to use trivial libraries, i.e.ones you can replace in one expression, really doesn't help.

When we do training on this I point the finger at is-even which is dependent on is-odd and is-number and can be replaced by (x % 2) == 0

in reply to Kevin Beaumont

mastodon - Link to source

codehorse

the typical β€œI want the benefit but I don’t want to deal with the risk” issue. I’m telling the software companies when I give security training for their developers that they need to maintain their own repo with an allowlist of packages and versions and that they have to be rigid in keeping it small and properly governed.
One would think that rimrafall and others should have done the job to raise awareness 😩
Unknown parent

mastodon - Link to source

rx13

The worst part is like half the libraries that get phished these days are just the absolute laziest shit. It's an import to tell you if a string is a URL or if a string is a boolean-like value, which sure it's annoying to have to deal with these little edge cases, but these aren't problems you need to outsource maintenance of (When you run a million/billion dollar platform)
Unknown parent

mastodon - Link to source

Stefan Gast

This feels obvious, yet it seems that in light of the current events a little reminder is needed:
In programming, you need some good understanding on what you are doing.
Brute-force prompting an AI until it spits out something that appears to be working does not qualify for this.
Building some Frankenstein's application from hundreds of unchecked, mostly trivial third-party libraries does not qualify, either.
This entry was edited (1 week ago)
Unknown parent

mastodon - Link to source

Doug Wade

those early node and npm folks were trying their best, but if somehow we'd managed to get those like 24 people that work on the biggest npm packages to hack on node instead we'd be in a much simpler place.
This entry was edited (1 week ago)
Unknown parent

mastodon - Link to source

Phil Burg (he/him)

Help a dumb security guy out? I haven't been a developer since the 90s and I'm out of touch.

Has-ansi was downloaded 12 million times this week - does that mean 12 million applications currently under development added it to their codebase this week?

Or applications using it were deployed to 12 million endpoints this week?

Or 12 million web sessions pulled this JavaScript code this week?

Or....something else entirely?

I've tried to find an answer to this via Google but no joy.

Unknown parent

mastodon - Link to source

Emory

in case anyone is interested in this sort of thing i've been hacking together some patterns and helpers for Fabric AI that you can use to parse `git log`s to spot tagged releases without a corresponding commit. i would accept and consider any feedback if anyone tries it out and has suggestions.

github.com/org-axiopisty/overn…


GitHub - org-axiopisty/overnight-manager: a toolkit intended to be used to identify potentially tainted package releases

a toolkit intended to be used to identify potentially tainted package releases - org-axiopisty/overnight-manager
GitHub
⇧