Comment by ilaksh | Hacker News Reader

Comment by ilaksh | Hacker News Reader

Parent Full thread

Why do they have to apologize for that? Almost every piece of software has security vulnerabilities.

Do people now really believe that there are definitely no security vulnerabilities related to the npm registry? Or any other type of registry, or website or application for that matter?

People have completely unrealistic expectations about security. Every time you had a significant amount of new functionality, or even a very insignificant amount, you could have introduced a new security vulnerability.

Basically this other company Lift or whatever could have two full time engineers doing security audits for npm from here until npm is done, and you could still have some other hacker who was thinking differently come up with a vulnerability in some new feature that they missed.

Its great to have the attitude that you are going to make a serious effort, but totally unrealistic to think that you are going to do one security audit and then there will be no more vulnerabilities. And also really makes no sense to make a big deal about it or give them grief or for them to even feel bad. If you think that way then you don't understand security.

You see all of these large projects having security issues not because they are full of negligent or sloppy engineers, but because security takes a lot of resources and is very difficult. The security firms will certainly suggest that engineers are negligent, of course. That ensures that they will continue to get new clients. But the reality is even with a lot of resources dedicated to just security, projects can easily have new vulnerabilities.

So that's great that they are getting regular security audits now. They are ahead of the curve.

EDIT: I notice I have been buried without anyone bothering to even respond. If you disagree, say why you disagree.

"Almost every piece of software has security vulnerabilities"

While this is true, there are certain classes of software for which vulnerabilities are a bigger deal and thus should be treated much more seriously, which includes much better up-front analysis of potential attacks and decent disclosure systems for when an attack (yes, almost inevitably) occurs.

Software distribution systems are pretty high up on the list for which exploits are A Big Deal because of how an exploit within them can very quickly spiral out of control (eg. attacker injects malicious code into very widely used module that is distributed from your repository -- now you're responsible for a lot more security problems than just the original problem on your site).

IMO this response is a good one; not over the top at all but gets the point across that they take this situation very seriously, which they should.

(FWIW, I upvoted you, so just because I partly disagree don't lump me in with those 'burying' you; I think the question you raise is entirely valid, but I do think this was a serious situation and the response was warranted).

"Why do they have to apologize for that?"

It's just the sad state of the 'industry'. As soon as some armchair warrior finds something remotely wrong with whatever, they'll go nuts on you and you need this sort of touchy-feely PR nonsense to placate the comic book shop types. Hats off to these guys for being level-headed enough to be able to play the game this way - I couldn't do it any more, I'd go bonkers over overhead like this.

If anyone needs placating, it's those developers, managers and executives who pushed hard for the use of Node.js in business settings, not expecting a serious security incident like this one to happen.

For those who are especially serious about their careers, reputations, budgets and power, incidents like this involving the technologies they hyped and pushed through can be disastrous. Now they're seen as being very wrong about something very important, and this in turn makes them extremely angry.

They know that their competitors within the business will use this incident against them. Their next initiative will surely face comment like, "Why should we listen to you after the npm disaster?", and they will face a much harder battle if their decision involves any controversy or doubt at all.

Every technology is going to have an "incident" like this. Experienced developers expect security "incidents". There are quite a few managers and executives who do not understand security and don't. And many people who will use this sort of "incident" politically. Politics is the problem there, not the technology.

Just because they found one significant security issue with npm does not mean they were "very wrong" about using Node. Its just a reality of security with any technology.

This isn't a disaster, this is a demonstration of maturity, responsibility and transparency.

PROTIP: if you're so serious about your 'career' and 'power', maybe you should stop 'hyping' and 'pushing through' this weeks hot tech toy you read about on HN and Reddit, and start building something worthwhile yourself. That way, you won't have to bet your precious career on some dude on the internet you never met before to not screw up. What a concept!

There's a difference between, say, the local bank claiming to have a giant safe that's rated TL-30 but it turns out to actually be rated TL-15 while the bank across the street also claims to have a TL-30 rated safe when in actuality it turns out that during installation someone smashed a 4ft by 4ft hole through the safe then covered it over with aluminum foil.

There are the inevitable almost impossible to fully plan for security vulnerabilities (e.g. in code outside your control) and then there are vulnerabilities due to extremely poor process at a fundamental level (like sql and html injection).

I thought the apology was measured and appropriate.

They knew they needed to have an audit and have intrusion detection when they started, four years ago.

You are probably being buried because most people are less pessimistic. ;)

Don't worry. Some of us agree with you. Sadly I'm one so I can't explain as to why you got buried.

Reply on news.ycombinator.com