<div dir="ltr">As administrators we have a responsibility to vet. Even if it's to "deligate" the vetting, we have to vet the deligate.<div><br></div><div>Npm is a hot mess, and most people get that now.</div><div><br></div><div>Galaxy / puppetforge / helm stuff ? Take a number.</div><div><br></div><div>It sprouts faster than you can get on it sometimes.</div><div><br><div>Pays the mortgage :)</div></div><div><br></div><div>David</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, Jan 25, 2020 at 4:05 PM D. Hugh Redelmeier via talk <<a href="mailto:talk@gtalug.org">talk@gtalug.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">| From: Dhaval Giani via talk <<a href="mailto:talk@gtalug.org" target="_blank">talk@gtalug.org</a>><br>
<br>
| On Thu, Jan 23, 2020 at 11:08 AM D. Hugh Redelmeier via talk <<br>
| <a href="mailto:talk@gtalug.org" target="_blank">talk@gtalug.org</a>> wrote:<br>
| <br>
| > <<br>
| > <a href="https://www.zdnet.com/article/microsoft-spots-malicious-npm-package-stealing-data-from-unix-systems/" rel="noreferrer" target="_blank">https://www.zdnet.com/article/microsoft-spots-malicious-npm-package-stealing-data-from-unix-systems/</a><br>
| > ><br>
| ><br>
| > This article list six cases of malware contributed to npm (the repo for<br>
| > sharing node.js and JavaScript source).<br>
| ><br>
| > How many undetected cases exist?<br>
| ><br>
| > I've alway pretended that Linux distros vet their code.<br>
| <br>
| <br>
| They do, but npm is different. npm is indepdent of the distro itself. And<br>
| people want to use npm because it gives them the latest and the greatest.<br>
<br>
I'm sorry that I wasn't clearer.<br>
<br>
I was changing the subject a bit. Just like npm has problems because<br>
vetting contributions is a hard problem, so too Linux distros have<br>
problems because vetting contributions is a hard problem.<br>
<br>
I know npm (JavaScript), CPAN (perl), CTAN (TeX), CPAN (Python),<br>
github, probably <a href="http://crates.io" rel="noreferrer" target="_blank">crates.io</a> (Rust), etc. each bypass the disto.<br>
<br>
Any security flaws identified by a distro get fixed by updates but<br>
anything users sourced from these other repos will not be fixed by<br>
distro updates. A serious logistic problem for users, even if they<br>
are unaware of it.<br>
<br>
I try to avoid these repos for just that reason but it is kind of<br>
hard.<br>
<br>
| > I'm not sure how<br>
| > true that is. Probably the greatest protection is the time delay between<br>
| > contribution and distribution.<br>
| ><br>
| ><br>
| I would be wary of this approach. There are a bunch of security fixes,<br>
| where you probably don't want too long a delay. Part of responsibility also<br>
| lies on the user to validate the update. With it being open source, and a<br>
| "volunteer" model, some of that has to be accepted b the user.<br>
<br>
Sorry, I meant: the time delay between creating a piece of software<br>
and it being adopted by Linux distros. Not a delay because the user<br>
avoids distro updates.<br>
<br>
I imagine the barrier to contributing to npm is zero. But I don't<br>
actually know. See below.<br>
<br>
The barrier to contribution to any distro I know of is a bit higher.<br>
That involves time, effort, and creativity. But not enough to prevent<br>
a determined and skilled contributor of malware. The easiest way is<br>
probably to infiltrate a group that produces a piece of software<br>
already accepted by many distros. Then it depends on the vetting by<br>
that project.<br>
<br>
More on npm:<br>
<br>
<<a href="https://en.wikipedia.org/wiki/Npm_(software)" rel="noreferrer" target="_blank">https://en.wikipedia.org/wiki/Npm_(software)</a>><br>
<br>
npm is the "Node Package Manager". It accompanies node.js. It hooks<br>
up to a "registry", by default <a href="http://nodejs.com" rel="noreferrer" target="_blank">nodejs.com</a> (a commercial entity).<br>
Here's a bit from Wikipedia (all caps added by me):<br>
<br>
Over 477,000 packages are available on the main npm<br>
registry.[16] The registry has NO VETTING process for<br>
submission, which means that packages found there can be low<br>
quality, insecure, or malicious.[15] Instead, npm relies on<br>
user reports to take down packages if they violate policies by<br>
being low quality, insecure or malicious.[17] npm exposes<br>
statistics including number of downloads and number of<br>
depending packages to assist developers in judging the quality<br>
of packages.[18]<br>
---<br>
Post to this mailing list <a href="mailto:talk@gtalug.org" target="_blank">talk@gtalug.org</a><br>
Unsubscribe from this mailing list <a href="https://gtalug.org/mailman/listinfo/talk" rel="noreferrer" target="_blank">https://gtalug.org/mailman/listinfo/talk</a><br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div><font face="sans-serif" size="2"><span style="letter-spacing:normal">David Thornton</span></font></div><div><font face="sans-serif" size="2"><span style="letter-spacing:normal"><a href="https://wiki.quadratic.net" target="_blank">https://wiki.quadratic.net</a></span></font></div><div><font face="sans-serif" size="2"><span style="letter-spacing:normal"><a href="https://github.com/drthornt/" target="_blank">https://github.com/drthornt/</a></span></font></div><div><font face="sans-serif"><a href="https://twitter.com/northdot9/" target="_blank">https://twitter.com/northdot9/</a></font><br></div></div><div><font face="sans-serif"><br></font></div><div><br></div></div></div></div></div>