Hacker News Reader

Comment by feross | Hacker News Reader

We're building Socket to stop this exact type of attack. See https://socket.dev

Socket turns the whole npm security problem on its head and asks: what if we assume all open source may be malicious? Can we proactively detect indicators of compromised packages? What's the simplest way to mitigate this risk without hurting usability?

View on HN

Socket seems interesting. I just installed it on some of my repos.

In your FAQ, it says "We're working to make Socket the best open source security tool.", this was confusing for me, as I got the impression that Socket's codebase is Open Source, and I went looking for it.

Maybe "We're working to make Socket the best security tool for open source packages" would be less confusing.

You are right. Thanks for the suggestion.

Great feedback. I initially understood socket was open source as well, which would have prevented me from using it to secure open source projects? circular argument :)

Why should we trust closed-source software to audit open-source code? In the words of an infamous bounty hunter: "Does that seem right to you?"

In U.S

detects Chinese malware -> Threat Alert detects NSA malware -> Silent pass-through

I mean I guess I'm a pessimist, but also, I think I'm really a realist.

"if you make any kind of ruckus, your body is forfit"

How do you detect compromised packages? What indicators of compromise do you use? Is Socket itself open source? Can I run it locally on the command-line?

We look at the behavior of packages, what APIs they use, and how that changes over time. The list of issues we currently look for is here: https://socket.dev/npm/issue

Socket’s not open source at this time, but we’re releasing a CLI in the coming week if the GitHub App doesn’t suit your purposes.

That's actually interesting, I will look into more details to see if we can integrate this into our systems. Do you have any avaiable technical documents so we can get a glimpse of how Socket is working, or is your Blog the best place to start?

Re the typosquat issue, maybe also add bitsquatting

https://www.youtube.com/watch?v=lZ8s1JwtNas https://github.com/artemdinaburg/bitsquat-script/

I absolutely love that you added a telemetry issue! I'm linking your page about it from the Debian privacy issues page.

https://socket.dev/npm/issue/telemetry https://wiki.debian.org/PrivacyIssues

Reply on news.ycombinator.com