▲ 30 ▼ GitHub Actions Cache Poisoning is eating open source (neciudan.dev) submitted 5 months ago by codeinabox@programming.dev to c/security@programming.dev 7 comments fedilink hide all child comments
[–] cockmushroom@reddthat.com 5 points 5 months ago The 👏 death 👏 of 👏 github 👏 will 👏 never 👏 be 👏 the 👏 death 👏 of 👏 open 👏 source permalink fedilink source
[+] ultimate_worrier@lemmy.dbzer0.com 9 points 5 months ago* (last edited 5 months ago) (6 children) [deleted] permalink fedilink source hideshow 6 child comments replies: [–] Maxxie@piefed.blahaj.zone 6 points 5 months ago (4 children) Running actions on your own machine doesn't solve cache poisoning or supply chain attacks, your VM will download compromised npm package or github actions the same way GH runner does. Version pinning/script disabling makes a compromise slightly less likely, rolling your own package server helps a lot (but who got time to maintain version whitelist). Honestly the best solution is to have minimum amount of dependencies. You don't need a GH action to ping indexers or generic foreign key library for your backed, hammer one yourself. That and scope all your keys so the leak won't be as devastating 🤷♀️ permalink fedilink source parent hideshow 4 child comments replies: [–] lauha@lemmy.world 3 points 5 months ago (3 children) Honestly the best solution is to have minimum amount of dependencies. Isn't this a sane practice in programming anyway? Just don't go overboard with dependency minimalism. permalink fedilink source parent hideshow 3 child comments replies: [–] Piatro@programming.dev 2 points 5 months ago (1 child) Yes but the reality of JavaScript codebases is that you'll typically import hundreds if not thousands of dependencies fairly quickly. Last time I looked at the UI codebase at my job it was sitting at over 40k. permalink fedilink source parent hideshow 1 child comment replies: [–] lauha@lemmy.world 2 points 5 months ago That's one of the reasons) why JS development is the shitshow it is. permalink fedilink source parent [–] Maxxie@piefed.blahaj.zone 1 point 5 months ago IDK how other people are, but to me solving a problem with a single #include just feels right. Less code to maintain, responsibility is shifted to a dedicated person, obviously much faster.. But also constant anxiety and daily monitoring of security blogs, so I'm trying to cut back permalink fedilink source parent [–] onlinepersona@programming.dev 1 point 5 months ago How do you run it on a local machine? permalink fedilink source parent
[–] Maxxie@piefed.blahaj.zone 6 points 5 months ago (4 children) Running actions on your own machine doesn't solve cache poisoning or supply chain attacks, your VM will download compromised npm package or github actions the same way GH runner does. Version pinning/script disabling makes a compromise slightly less likely, rolling your own package server helps a lot (but who got time to maintain version whitelist). Honestly the best solution is to have minimum amount of dependencies. You don't need a GH action to ping indexers or generic foreign key library for your backed, hammer one yourself. That and scope all your keys so the leak won't be as devastating 🤷♀️ permalink fedilink source parent hideshow 4 child comments replies: [–] lauha@lemmy.world 3 points 5 months ago (3 children) Honestly the best solution is to have minimum amount of dependencies. Isn't this a sane practice in programming anyway? Just don't go overboard with dependency minimalism. permalink fedilink source parent hideshow 3 child comments replies: [–] Piatro@programming.dev 2 points 5 months ago (1 child) Yes but the reality of JavaScript codebases is that you'll typically import hundreds if not thousands of dependencies fairly quickly. Last time I looked at the UI codebase at my job it was sitting at over 40k. permalink fedilink source parent hideshow 1 child comment replies: [–] lauha@lemmy.world 2 points 5 months ago That's one of the reasons) why JS development is the shitshow it is. permalink fedilink source parent [–] Maxxie@piefed.blahaj.zone 1 point 5 months ago IDK how other people are, but to me solving a problem with a single #include just feels right. Less code to maintain, responsibility is shifted to a dedicated person, obviously much faster.. But also constant anxiety and daily monitoring of security blogs, so I'm trying to cut back permalink fedilink source parent
[–] lauha@lemmy.world 3 points 5 months ago (3 children) Honestly the best solution is to have minimum amount of dependencies. Isn't this a sane practice in programming anyway? Just don't go overboard with dependency minimalism. permalink fedilink source parent hideshow 3 child comments replies: [–] Piatro@programming.dev 2 points 5 months ago (1 child) Yes but the reality of JavaScript codebases is that you'll typically import hundreds if not thousands of dependencies fairly quickly. Last time I looked at the UI codebase at my job it was sitting at over 40k. permalink fedilink source parent hideshow 1 child comment replies: [–] lauha@lemmy.world 2 points 5 months ago That's one of the reasons) why JS development is the shitshow it is. permalink fedilink source parent [–] Maxxie@piefed.blahaj.zone 1 point 5 months ago IDK how other people are, but to me solving a problem with a single #include just feels right. Less code to maintain, responsibility is shifted to a dedicated person, obviously much faster.. But also constant anxiety and daily monitoring of security blogs, so I'm trying to cut back permalink fedilink source parent
[–] Piatro@programming.dev 2 points 5 months ago (1 child) Yes but the reality of JavaScript codebases is that you'll typically import hundreds if not thousands of dependencies fairly quickly. Last time I looked at the UI codebase at my job it was sitting at over 40k. permalink fedilink source parent hideshow 1 child comment replies: [–] lauha@lemmy.world 2 points 5 months ago That's one of the reasons) why JS development is the shitshow it is. permalink fedilink source parent
[–] lauha@lemmy.world 2 points 5 months ago That's one of the reasons) why JS development is the shitshow it is. permalink fedilink source parent
[–] Maxxie@piefed.blahaj.zone 1 point 5 months ago IDK how other people are, but to me solving a problem with a single #include just feels right. Less code to maintain, responsibility is shifted to a dedicated person, obviously much faster.. But also constant anxiety and daily monitoring of security blogs, so I'm trying to cut back permalink fedilink source parent
[–] onlinepersona@programming.dev 1 point 5 months ago How do you run it on a local machine? permalink fedilink source parent
all 8 comments