Comment by parksy | Hacker News Reader

Comment by parksy | Hacker News Reader

Beyond the usual DIY security practices when dealing with NPM I wonder if there's viability in a service offering access to pre-audited repos like NPM, basically just a curated proxy with a process around certifying the security of packages and updates into the repo, including code reviews, dependency checking and various tests performed by security engineers.

I feel that the benefits in outsourcing some of that risk management could be a service worth paying for, at least for commercial purposes. It might lag behind and given the number of NPM packages most likely wouldn't offer the full range of packages, but I could see it bringing peace of mind for like the 90% of use-cases.

At the moment it would appear every NPM user is responsible for their own security, and the barrier of entry to the NPM repository is low which is fine and in keeping with the general principles of open source and distributed development, but on the flipside wouldn't it be more efficient to centralise the security auditing and management effort somewhere?

I don't know, just thinking out loud, perhaps there's good reasons why this hasn't happened.

There are projects like crev [0] which attempt to get around this by using a web of trust to audit dependencies. Rust has cargo-crev [1] as an implementation.

Here's the previous HN discussion [2].

[0] https://github.com/crev-dev/crev/

[1] https://github.com/crev-dev/cargo-crev

[2] https://news.ycombinator.com/item?id=18824923

Thanks, I hadn't come across crev. I have always worried that open review systems could create a false sense of security, if enough bad-faith actors poison the well.

But it looks like crev deals with this by allowing users to choose their circle of trust, which is an interesting concept, definitely following this project and will take a deeper dive into it. Cheers :)

This is exactly the dichotomy that people find with the App Store model that Apple runs. You minimize the ability for malicious actors to open backdoors and run bad scripts but you also minimize the variety of ways that people can solve problems. Neither is outright bad but there's a trade-off and a lot of people don't see the benefits to this type of product/service until it affects them personally.

I think a lot of the criticism against the App Store is because there is no alternative. I don't object to Apple having a store that they curate as they like, I object to them not allowing anything else on what has become a general computing platform.

What defines a "general computing platform"?

Good point, however unlike Apple's model, if a hypothetical certified NPM repository was set up, there is still the open public repository. The freeform and experimental problem solving still occurs there. Developers could even benefit by being able to add the certified stamp to their public repositories if they so wished.

From the user's POV, opting to use the certified package repo would be a conscious decision and the trade-offs vs benefits should be well advertised. The service could also offer a "self certified" package facility to users if they understand the risks.

Now that I think about the potential downsides, would developers eschew dependencies to reduce the risk of losing a coveted "certified" badge, thereby undermining one of the more useful aspects of nodejs? Would developers get upset their code is included in a paid service and demand takedown or a revenue share? Fast forward a bunch of years, does this certification service become a looming spectre hovering over the node ecosystem and end up hurting what it was supposed to protect? Is the risk of a zero-day making it into the "official" repository too big for a startup to handle? Is it too much to ask users to simply "trust the process"? Would it just be too annoying for in-house developers to constantly have to battle missing and outdated dependencies as the certification team struggles to keep up with the constant stream of updates and new packages?

It would definitely require a lot of resources to set up and maintain, not to mention financial and legal finesse.

Maybe this is why I haven't come across such a service yet, maybe it's just in the too-hard basket or something. Interesting to think about though.

>if they understand the risks

This is where I think this argument breaks down. The average person can follow directions well enough to copy/paste something in the terminal without understanding what it means or what they risk by doing so. Platforms like Apple's rely on the vectors for compromise being minimized to the average user.

That being said, NPM is obviously aimed at developers so that's less of an issue. I support this type of thing for developer tools because there's a barrier of entry. I don't support it for things like App Stores because I've dealt with people enough to know that they will do things without understanding the repercussions and I have a hard time blaming them for not completely understanding such a complex issue/topic.

Random thought. OS vendors provide curated and maintain libraries. In native languages you also have curated libraries. Problem is everyone wants to replace native languages and OS's with webshit running in a browser using freeware libraries.

VMware/pivotal has a curated Open Source Application Catalog product: https://tanzu.vmware.com/application-catalog

  https://tac.bitnami.com/

Do you have any idea on cost for this? It's somewhat ironic that you need to pay not for the software but to be protected from the free software these days...

> [..] there's viability in a service offering access to pre-audited repos like NPM, basically just a curated proxy with a process around certifying the security of packages and updates into the repo, [..]

This exists and is not uncommon in the enterprise world. sonatype is an example I have worked with in my Java days and I think they over npm too nowadays. It's just expensive and therefore not ubiquitous.

I actually started building this exact product earlier this year. Then I realized I won't have the funds to hire people to actually do these audits. So I stopped.

Maybe this could be a community effort.

Reply on news.ycombinator.com