Disrupting supply chain attacks on NPM and GitHub Actions

alpineman 2 hours ago | parent | next [-]

>> high-impact npm accounts are now put into a read-only mode for 72 hours when they change their email or use a 2FA recovery code. This delay allows maintainers time to respond and recover the account before their account can be used to start an attack.

'what time shall we put here?'

'what's the longest hangover you ever had?'

'let's put 72 hours'

▲

Waterluvian an hour ago | parent [-]

A weekend plus a day to deal with things seems like a decent minimum duration when it’s somewhat arbitrary what the right number is.

▲

datakan 44 minutes ago | parent [-]

I don't think so at all. People go on vacation all the time. This should be 30 days not 3.

▲

Waterluvian 39 minutes ago | parent | next [-]

That's the usual runaway problem, right? Why not 60 then? People go on sabbaticals! etc etc.

I feel like the only way to be wrong for this class of problem is to believe that there's a singular right answer. Just pick something reasonable (like how weekends are a fairly common thing, so don't make it shorter than 48 hours). Start there, then see how much of an issue persists. No matter what, at scale you'll find someone complaining that the number is too little, and people complaining that it's too much. Eventually you just have to tell the complainers to deal with it.

	▲	datakan 12 minutes ago \| parent [-]
		There is a big difference between 3 days when someone may be sick or traveling and not looking and 30 which aligns better with 99% of scenarios this may be an issue with. 3 days is absurd. Even password apps with kill switches will default to 7 days. Cyber attacks will frequently happen on a Friday just for this scenario, they anticipate no ones looking over the weekend.

▲

normie3000 30 minutes ago | parent | prev [-]

It's often not the maintainer that removes a poisoned release, it's the npm security team/tools. So unless the whole team takes a month off, we're all safe.

▲

skipants 11 minutes ago | parent | prev | next [-]

One thing I don't quite get is how trusted publishing is supposed to be more secure. It still allows publishing if they pwn your workflow.

Is it purely more secure because they can't exfiltrate your secret keys to publish again?

I feel like if your workflow gets pwned you'd be rotating your keys anyways, so I'm not sure if the vendor lock-in is worth it.

▲

summarybot 13 minutes ago | parent | prev | next [-]

Github owns NPM. Github has unprecedented access to code analysis tools. Github can run static analysis on nearly everything. Introducing a cooldown period seems like the lowest tech solution to a technological problem I have seen in a longwhile.

▲

hncsiocp9x 2 hours ago | parent | prev | next [-]

Been quietly thinking this for years

▲

pluto_modadic an hour ago | parent | prev [-]

the bare minimum award, for the only language and only registry where this regularly happens.