originalucifer@moist.catsweat.com 4 months ago
nah. over 100k sites ignored dependency risks, even after the original owners warned them this exact thing would happen.
the real story is 100k sites not being run appropriately.
That’s not how systemic problems work.
This is probably one of the most security ignorant takes on here.
People will ALWAYS fuck up. The world we craft for ourselves must take the “human factor” into account.
And the majority of industries that actually have immediate and potentially fatal consequences do exactly this, and have been for more than a generation now.
Ok, people will always fuck up, so what do you do?
The majority of industries that actually have immediate and potentially fatal consequences do exactly this, and have been for more than a generation now.
All the organizations (including public) getting ransomware and data stolen, it’s because the consequences are not that bad? It is not gross negligence?
I’m not sure if this is just a rhetorical question or a real one?
Because I didn’t claim it isn’t negligence. It is negligent, however, it is not a problem solvable by just pointing fingers. It’s a problem that solvable through more strict regulation and compliance.
Cyber security is almost exactly the same as safety in other industries. It takes the same mindset, it manifests in the same ways under the same conditions, it tends to only be resolved and enforced through regulations…etc
And we all know that safety is not something solvable by pointing fingers, and saying “Well Joe Smo shouldn’t have had his hand in there then”. You develop processes to avoid predictable outcomes.
That’s the key word here, predictable outcomes, these are predictable situations with predictable consequences.
These are abstract problems that affect “someone else”. This is the standard state of mind that most development teams and companies have when it comes to security.
By default everything you produce is going to be insecure and less you have professionals there to get in your way and ensure you are meeting compliance.
By default most companies and especially startups are going to write insecure software. Because the consequences don’t really matter at this point, all that matters is shipping the product and getting it to market for growth opportunity. And gambling on the BET that there won’t be any security breaches.
I’m not blaming the single person who did a mistake, I’m blaming the negligence of the companies that cut corners for profit, so most of them.
Your first comment read as if organizations were this happens couldn’t have bad consequences. Your new comment explains what you meant better, and I agree.
People will ALWAYS fuck up. The world we craft for ourselves must take the “human factor” into account, otherwise we amplify the consequences of what are predictable outcomes.
So what does it say about us diverting from purely server-side scripted message boards with pure HTML and tables, and not a line of JS? Yes, let’s get back there please. And no phone numbers.
The majority of industries that actually have immediate and potentially fatal consequences do exactly this, and have been for more than a generation now.
Boeing - we know where you’re goeing.
Damn near everything you interact with on a regular basis has been designed at some point in time with human psychology in mind. Built on the shoulders of decades of research and study results, that have matured to the point of becoming “standard practices”.
There’s one industry which kinda started like this, with proper HIG and standard key combinations and proven usability with screenreaders or by people with color blindness, autism, ADHD, whatever.
Then came in people talking with the tone similar to, sorry, yours in the “People will ALWAYS fuck up” part came saying that people want nice, dynamic, usable websites with lots of cool new features, people are social, they want girls with real photos, names and phone numbers on their forums which BTW should be called social nets.
By the way, we already had that with Flash and Java applets, some things of what I remember were still cooler than modern websites of the “web application” paradigm are now. And we had personal webpages with real names and contacts and photos. And there were tools allowing to make them easily.
These people just hated the existing culture with its individualism and depth, the web applications should be able to own you and not be just another kind of embedded content, the personal webpages should be all the same, and of course normies wouldn’t want to come as guests into the nerdspace - no, they had those new social nets as their space, looking down on those nerds and freaks of my kind.
Now - well, try using today’s web as a person impaired in any way.
And those normies can’t really use it too, and too feel impaired, they just won’t admit it.
So what does it say about us diverting from purely server-side scripted message boards with pure HTML and tables, and not a line of JS? Yes, let’s get back there please.
Ironically, proper SSR that has the server render the page as pure HTML & CSS is becoming more and more popular lately thanks to full-stack meta frameworks that make it super easy. Of course, wanting to go back to having no JS is crazy — websites would lose almost all ability to make pages interactive, and that would be a huge step backwards, no matter how much nostalgia you feel for a time before widespread JS. Also tables for layout fucking sucked in every possible way; for the dev, for the user, and for accessibility.
people want nice, dynamic, usable websites with lots of cool new features, people are social
That’s right, they do and they are.
By the way, we already had that with Flash and Java applets, some things of what I remember were still cooler than modern websites of the “web application” paradigm are now.
Flash and Java Applets were a disaster and a horrible attempt at interactivity, and everything we have today is miles ahead of them. I don’t even want to get into making arguments as to why because it’s so widely documented.
And we had personal webpages with real names and contacts and photos. And there were tools allowing to make them easily.
There are vastly more usable and simple tools for making your own personal websites today!
Ironically, proper SSR that has the server render the page as pure HTML & CSS is becoming more and more popular lately thanks to full-stack meta frameworks that make it super easy.
I know. Just the “full-stack meta frameworks” part alone makes any ADHD person feel nausea.
Of course, wanting to go back to having no JS is crazy — websites would lose almost all ability to make pages interactive, and that would be a huge step backwards, no matter how much nostalgia you feel for a time before widespread JS.
I disagree. Geminispace is very usable without scripts.
That’s right, they do and they are.
Well, then it appears they don’t care for what I need, so I don’t care for what they need. If only one paradigm must remain, then naturally I pick mine. If not, then there’s no problem and I still shouldn’t care.
And those industry rules I was answering about are about making a thing work for both, even if being less functional.
Flash and Java Applets were a disaster and a horrible attempt at interactivity, and everything we have today is miles ahead of them. I don’t even want to get into making arguments as to why because it’s so widely documented.
Sorry, but either you still make an argument or this isn’t worth much.
For me it’s obvious that embeddable cross-platform applications as content inside hypertext are much better than turning a hypertext system into some overengineered crappy mess of a cross-platform application system.
The security issues with Flash and Java applets weren’t much different from those in the other parts of a web browser back then.
There are vastly more usable and simple tools for making your own personal websites today!
I ask you for links and how many clicks and fucks it would take to make one with these, as opposed to back then. These are measurable, scientific things. Ergonomics is not a religion.
One place I worked at recently was still using Node version 8. Running npm install would give me a mini heart attack... Like 400+ critical vulnerabilities, it was several thousand vulnerabilities all around.
Running
npm installwould give me a mini heart attack
It should; but more because it installs things right off the net with no validation. Consistency of code product is not the only thing you’re tossing.
How else would you get LPAD ? Expect me to write 2 lines of code when I could just import a 100 Mb library to do it for me?
You need to get up to date from three years ago. NodeJS 16.20, or thereabouts, enabled dependency auditing by default.
I’m still fighting my engineers go get current enough to use this (but we do have a proxy artifact server that also attempts to keep downloads clean, and a dependency scanner)
After the first 100, the other 300 kinda don’t matter.
If you’re on RHEL 8+, you can install the latest version of node with dnf.
dnf install nodejs will likely install node 8 :(. Use dnf module install nodejs:20 to install the latest version.
the real story is 100k sites not being run appropriately.
Same as it ever was. Same as it ever was. Same as it ever was.
Yeah this is just capitalistic business in general. Don’t do anything proactive if it might reduce the bottom line in the short term. Blame others and beg for help when you weren’t proactive. Succeed singularly, fail collectively
You just described my coworker…
Described every corporation ever incorporated.
This isn’t holding up, time isn’t after us.
100k sites ignored dependency risks
JS: typing is boring, warnings are boring, security is boring.
Sure, the package managers of other languages are super safe
You’re confused. It’s unrelated to package managers, it’s about basic security principles like this: developer.mozilla.org/…/Subresource_Integrity but JS devs don’t care.
Finding new ways webshits fuck up the most basic development principles boggles my mind. It’s like they intentionally stay ignorant.
But now where am I going to get my “china maleware” headline !?!
I don’t think we have to choose. “Maintain your websites so you don’t get taken advantage of”, and “Here’s an example of a major-world-power-affiliated group exploting that thing you didn’t do” are both pretty important stories.
I mean, both are true? It’s not a manipulative headline in my opinion.
The malware thing still deserves a headline. They just argue it’s stupid so many even have to use the library to begin with.
Have to use? No one has to use any library. It’s convenience, and in this case it’s literally so they don’t have to write code for older browser versions.
The issue here isn’t that anyone has to use it, it’s the way it was used that is the problem. Directly linking to the current version of the code hosted by a third party instead of hosting a copy yourself.
Probably at your local asian gay bar.
vzq@lemmy.blahaj.zone 4 months ago
The hackers just engaged in a little bit of technical debt collecting ;)
Feathercrown@lemmy.world 4 months ago
I’m stealing this phrase
vzq@lemmy.blahaj.zone 4 months ago
Please do! I’ve been trying to make it stick for almost a decade!