undefined | Better HN

0 pointsjraph3y ago0 comments

> obviously you wouldn't just run something from the internet without checking it first

This died a long time ago with the pervasive use of NPM and PIP and the likes.

Most developers probably run a lot of random unchecked shit all the time with local user privileges today without a blink.

Somehow people are ready for all this, but are still afraid to run a random shell script from the internet. I guess this fear is one of our chances to explain how NPM and PIP can be dangerous.

0 comments

5 comments · 3 top-level

ndsipa_pomu3y ago· 1 in thread

It's also fairly common to use a docker container that someone else built without having a look at it

hdjjhhvvhga3y ago

I don't know. I do that a lot on test servers when tinkering with new stuff but at work I'm very careful what I insert into my employer's infrastructure. If someone breaks in using a hole I should have taken care of, that's already bad. But if invite bad guys by installing a C&C for them, that's superbad.

krageon3y ago· 1 in thread

If you're committed to being an idiot no amount of rules of thumb will save you. Not understanding what you use is one facet of being committed to that.

jraphOP3y ago

But people don't live in a vacuum. They live in an ecosystem, are subjected to it and contribute to it.

If I contribute to Nextcloud or write an app for it, I need to run npm. If I want to run PeerTube, I need to run npm. They both pull a shitload of dependencies I can't possibly review.

I personally avoid building anything using NPM and advocate for fewer / no dependencies, or for using dependencies packaged by reputable entities like Debian, but what can I do? I can't build everything myself.

Am I committed to being an idiot?

kwertzzz3y ago

> This died a long time ago with the pervasive use of NPM and PIP and the likes.

When a malicious package is found on NPM or PIP, it will get removed. However, it is quite unlikely that a website will be taken town for a malicious script (or only after a long time).

I really doubt that most readers of HN would run a random script unless it comes from a source they trust (trusted enough to least to remove a malicious script in a timely fashion).

j / k navigate · click thread line to collapse