Slash Boxes

SoylentNews is people

posted by hubie on Friday March 10 2023, @05:29AM   Printer-friendly

There's never enough time or staff to scan code repositories:

Software dependencies, or a piece of software that an application requires to function, are notoriously difficult to manage and constitute a major software supply chain risk. If you're not aware of what's in your software supply chain, an upstream vulnerability in one of your dependencies can be fatal.

A simple React-based Web application can have upward of 1,700 transitive NodeJS "npm" dependencies, and after a few months "npm audit" will reveal that a relatively large number of those dependencies have security vulnerabilities. The case is similar for Python, Rust, and every other programming language with a package manager.

I like to think of dependencies as decaying fruit in the unrefrigerated section of the code grocer, especially npm packages, which are often written by unpaid developers who have little motivation to put in more than the bare minimum of effort. They're often written for personal use and they're open sourced by chance, not by choice. They're not written to last.

[...] Not all hope is lost. For known (reported and accepted) vulnerabilities, tools exist, such as pip-audit, which scans a developer's Python working environment for vulnerabilities. Npm-audit does the same for nodeJS packages. Similar tools exist for every major programming language and, in fact, Google recently released OSV-Scanner, which attempts to be a Swiss Army knife for software dependency vulnerabilities. Whether developers are encouraged (or forced) to run these audits regularly is beyond the scope of this analysis, as is whether they actually take action to remediate these known vulnerabilities.

However, luckily for all of us, automated CI/CD tools like Dependabot exist to make these fixes as painless as possible. These tools will continually scan your code repositories for out-of-date packages and automatically submit a pull request (PR) to fix them. Searching for "dependabot[bot]" or "renovate[bot]" on GitHub and filtering to active PRs yields millions of results! However, 3 million dependency fixes versus hundreds of millions of active PRs at any given time is an impossible quantification to attempt to make outside of an in-depth analysis.

[...] Did you install your packages from the command line? If so, did you type them in properly? Now that you've installed your dependencies "correctly," did you verify that the code for each dependency does exactly what you think it does? Did you verify that each dependency was installed from the expected package repository? Did you ....

Probably not, and that's OK! It's inhumane to expect developers to do this for every single dependency. The best bet for software developers, software companies, and even individual tinkerers is to have some form of runtime protection/detection. Luckily for us all, there are detection and response tools that have relatively recently been created which are now part of a healthy and competitive ecosystem! Many of them, like Falco, Sysdig Open Source, and Osquery, even have free and open source components. Most even come with a default set of rules/protections.

Original Submission

This discussion was created by hubie (1068) for logged-in users only, but now has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 4, Insightful) by Mojibake Tengu on Friday March 10 2023, @04:55PM (4 children)

    by Mojibake Tengu (8598) on Friday March 10 2023, @04:55PM (#1295525) Journal

    Well, it's quite simple: Every time you use a foreign library or module for a critical project, you shall fork it and keep your own repository at hand, on your own infrastructure.
    If you are corporation, assign an employee to maintain it and interact with upstream.

    Doing otherwise is crazy unprofessional, for essentially you implicitly trust people you don't know and, most importantly, do not control.
    Added costs are necessary. Every street bar out there has a brute bouncer, and it's for safety, not for parade. Hard experience of many generations.

    Code responsibly. With epic skills comes epic responsibility.

    Rust programming language offends both my Intelligence and my Spirit.
    Starting Score:    1  point
    Moderation   +2  
       Insightful=1, Underrated=1, Total=2
    Extra 'Insightful' Modifier   0  
    Karma-Bonus Modifier   +1  

    Total Score:   4  
  • (Score: 3, Interesting) by guest reader on Friday March 10 2023, @06:34PM

    by guest reader (26132) on Friday March 10 2023, @06:34PM (#1295571)

    Exactly. We copy the source code of each foreign library into 3rdparty directory of our project. The licenses are compatible. We then either use header only versions or build these 3rdparty libraries from our build environment. This approach proved to be very useful particularly with Boost library. The minimum effort is to at least store the last known working version of of each foreign library into our 3rdparty directory as a tarball. We are doing this for more than 10 years.

  • (Score: 2) by turgid on Friday March 10 2023, @06:35PM

    by turgid (4318) Subscriber Badge on Friday March 10 2023, @06:35PM (#1295572) Journal

    Indeed. Take responsibility for the code you are writing and delivering. Own it, requirements, quality, testing, documentation, security and all.

  • (Score: 3, Interesting) by istartedi on Friday March 10 2023, @11:43PM (1 child)

    by istartedi (123) on Friday March 10 2023, @11:43PM (#1295616) Journal

    I'm pretty sure it was like that at every professional project I worked on. The only thing to add is to make sure that you really can restore from backup. I know that was an exercise I saw at least once--pull backup tape, image raw box, build entire product. No connection to an external repository required. "A company you can hold in your hand", that's how it should be.

    Merging in public changes is a PiTA, a busy-work chore, but the people responsible for it didn't seem to mind too much. There was usually enough "dev" in their "ops" to keep it interesting.

    Appended to the end of comments you post. Max: 120 chars.