Incident Report: CVE-2024-YIKES

(nesbitt.io)

145 points | by miniBill 2 hours ago

13 comments

  • lynndotpy 1 hour ago
    For anyone confused, this is (very good imo) fiction about supply-chain incidents. It had me very worried during a brief scan that it was real though, which made me read it more attentively :)
  • david_shaw 1 hour ago
    It's easy to be cynical because, yes, both the problems and solutions seem dead obvious in hindsight. But for a long time (and maybe even still), a hacker creed was "move fast and break things."

    It's great that there's so much momentum in fixing the glaring problems with supply chain systems like npm, but I'm concerned that we're entering a new era of security-related problems caused in large part by agentic development.

    I'm not just talking about Mythos/Glasswing surfacing vulnerabilities in pretty much everything it touches; I think the way we're developing software, pulling in dependencies, and potentially losing human thought modeling of complex systems is going to lead to a lot of hacked together software and infrastructure that humans won't fully understand.

    I hope in a few years we don't look back at today and wonder how we could have been so naive -- how we failed to actually plan for the long-tail of AI development in a way that doesn't solve problems by attempting to just use AI to rebuild complex systems.

    But the article was funny.

    • saint_yossarian 52 minutes ago
      > But for a long time (and maybe even still), a hacker creed was "move fast and break things."

      Was it? I thought Zuckerberg coined this horrible phrase.

      • david_shaw 40 minutes ago
        He certainly popularized it (maybe coined it), but I've seen a lot of organizations and developers repeat that mantra.

        Even without the specific words, look to product teams debating tradeoffs of going to market vs. waiting for better security controls. They're pushing for faster product release every time, at pretty much every org.

        • cassianoleal 24 minutes ago
          In any case, not really a hacker's creed. This has always been withinin the realm of corporations, especially Silicon Valley or adjacent.
          • asah 7 minutes ago
            MFABT is about survival. Don't hate the player, hate the game.
  • red_admiral 1 hour ago
    This is the most SCP thing I've read in a while that's not actually an SCP.
  • vsgherzi 1 hour ago
    Supply chain incidents suck and we need to do better. Personally for rust I’m a proponent of the foundation supporting a few core crates that go under the same audit procedure as the main rust language and give funding to the project to limit supply chain vulns. I don’t think the right answer is to remove systems like crates or npm. Crate and npm are a boon for many developers.
    • vsgherzi 1 hour ago
      Crates has also been making efforts to include rust sec, but in addition to the above I would like the community to shy away from many small dependencies to a few larger ones just as tokio has
      • fleventynine 1 hour ago
        Many small crates published by large, trustworthy projects are fine and preferable to one large crate that "does everything".
        • zbentley 48 minutes ago
          Why?

          Honest question. Commons, Guava, Spring, and more seem to take this approach successfully (as in, the drawbacks are outweighed by the benefits in convenience, quality, and security) in Java. Are benefits in binary size really worth that complexity?

          And before someone says “just have a better standard library”, think about why that is considered a solution here. Languages with a large and capable standard library remain more secure than the supply-chain fiascos on NPM because they have a) very large communities reviewing and participating in changes and b) have extremely regulated and careful release processes. Those things aren’t likely to be possible in most small community libraries.

        • vsgherzi 1 hour ago
          Yeah I’d agree that multiple crates under one project is basically the same as 1 large crate. The real problem is how many people you’re trusting and it’s all coming from the same person.
    • hacker_homie 1 hour ago
      Move high value crates into the standard library?
      • vsgherzi 1 hour ago
        This bloats the std library and forces lots more work and stress on the rust dev team. Not to mention it’ll add more churn to the std lib.
      • hacker_homie 54 minutes ago
        Maybe give crates a gold star if they have no external dependencies?
      • orf 1 hour ago
        Please no, that’s a terrible outcome.
        • pixl97 11 minutes ago
          What else would you suggest that also does not have terrible outcomes. The situation as is, is untenable.
    • PunchyHamster 1 hour ago
      nah, remove NPM, nothing good comes out of that.
    • suprfsat 1 hour ago
      do we really need both npm and nmp though
    • dijit 30 minutes ago
      honestly I thought this was the end goal of blessed.rs
    • 2ndorderthought 1 hour ago
      [dead]
  • swiftcoder 27 minutes ago
    Very enjoyable read, entirely too close to the mark
  • danielfalbo 1 hour ago
    absolutely hilarious, made me laugh a lot. thank you for writing this, whether human or AI.
  • danilocesar 58 minutes ago
    This week has been tough. Is it the begging of CVEgeddon?
  • TZubiri 19 minutes ago
    This would have been completely avoided if you were using bun dependency vector locking in Nix.
  • nikanj 1 hour ago
    Customers give us heat for not shipping the latest vulpine-lz4. Their AI-based heuristic antivirus total defence solution automatically flags all software not running latest versions of everything

    Kindly advice

    • pixl97 10 minutes ago
      Ya, latest is a mess. I don't care about latest, I want the version with no known security flaws.
  • cryo32 33 minutes ago
    Recently I've been wondering why I really need MFA tokens for everything.

    The initial thought was this is security culture but a few cocktails later and a discussion with a friend rather high up in the intelligence services in my country lead to a different conclusion, which aws indirectly:

    I rely on too-much-shit from god-knows-where written by fuck-knows and a lot of what-the-hell running in some awful-cloud-shit.

    Our supply chain problems are because the whole idea above. As is the fact I need to auth to a million things which I shouldn't have to.

    Give me a boxed copy of Visual Basic with manuals and lock me in a fucking basement with an airgapped NT4 box until this all over please.