top | item 46062939

(no title)

cheesekunator | 3 months ago

Why does elapsed time mean a library is safe? This is so ridiculous. It doesn't protect you against anything. I'm sure there are 1000s of old libraries out there with hidden vulnerabilities or malicious code.

discuss

order

Waterluvian|3 months ago

Literally nothing can mean a “library is safe.”

The idea of “safe” in terms of risk and security has misled a lot of people into this wrong idea that there’s a binary state of safe and unsafe.

It’s all about risk management. You want to reduce risk as inexpensively as possible. One of many inexpensive approaches is “don’t install dependencies that are new.” Along with “don’t install dependencies that nobody else uses.” You might also apply the rule, “don’t install dependencies that aren't shipped with the OS.” Or “don’t use dependencies that haven’t been formally proven.” Etc.

Indeed, calling it “Safe-NPM” can be misleading. As if using it achieves some binary state of safety.

femiagbabiaka|3 months ago

Most supply chain attacks have a very limited window in which they’re exploitable. This is not a panacea, but it is a good idea.

PunchyHamster|3 months ago

hedging bets of zero day vs compromise (that have big chance to be found in thos e 90 days). But yeah, not a good idea