-2

I've found this PHP library for detecting/guessing the language of a given string: https://github.com/patrickschur/language-detection

I would have massive use of this. I would really like to use it.

But I cannot.

All I can think is this:

What if, tomorrow, that developer is either compromised or goes rogue and updates his code with Bitcoin-stealing malware? What if that code is already in the library, waiting for the right moment? Since not even the most used FOSS projects in the world seem to get audited at all by anyone, what are the odds that this super small and obscure one will be safe? Very slim.

I know nothing about the author. I cannot possibly, even if I really tried, assess their competence and reliability. Hell, I don't even really trust Github itself, especially not after it was sold out to Microsoft.

This is handicapping. The only way I could "trust" it would be to ignore all concepts of security and "just believe". I cannot look through all that code, even though it's a very small library. There's tons of files and they can change at any moment. Composer will fetch the new version some day and I won't be sitting there checking all the changes. I know I won't. I even set up and streamlined such a system in the past and I quickly stopped checking the updates. Even with just a few changes, it was just exhausting. I couldn't keep it up.

Is this ever going to get some sort of sensible solution? Some sort of built-in sandbox so that each library runs in its own little vacuum and is only able to send out the "answer" back to the main script or something? I don't understand how others are able to trust all these random strangers in a world absolutely full of scams and evil people lurking behind every corner.

2
  • 3
    You might want to consider using an abacus for all of your computing needs.
    – mti2935
    Jun 3 '21 at 11:59
  • 1
    If you pull your own copy, what would force updates upon you? Jun 3 '21 at 16:31
4

Use audited and approved libraries. That's the answer.

There are paid product/services (e.g. Sonatype, Black Duck) that will run automated tests on random libraries that you submit before using. And there are analysers that inspect code as it runs to make sure that it is not doing unexpected things.

If you want the freedom to use any random person's code, then you take on the risks associated with that.

Else, you have to take on the task of writing everything yourself. You need to weigh the benefits of using strangers' code against needing to write and test everything yourself. The world has decided to "trust but verify" in order to develop at speed.

Welcome to DevSecOps.

2
  • "Use audited and approved libraries."? So you're actually saying: "Don't use anything except these 2-3 libraries in the entire world that somebody has actually audited."? You might as well say that I can only drive on these two main roads but nowhere else.
    – Oman
    Jun 3 '21 at 9:46
  • 1
    You are far too cynical. There are millions of libraries that have been audited. There are services that audit popular libraries. If this is your response, I suspect that you are not asking an honest question but just want to rant.
    – schroeder
    Jun 3 '21 at 10:29
2

There is no solution. The problem is that you need to trust something to get anything done.

The problem translates itself to the real world too. If you buy food in a supermarket, you trust quite a number of underlying parties, food producers, transporters, supermarkets. Each of those parties have had major incidents. But still, you eat the food you bought there.

In Information security, we try to rationalize the process with risk analysis. The probability of a developer going rogue and the impact that it has. The probability is of course hard to estimate.

A possible set of questions that you may ask yourself are:

  • is it open source or closed source? (f.e. Openssl)
  • how long does the software exist?
  • is it maintained (what is the latest update)?
  • how many people use it? (see the Windows exploits lists)
  • does the developer use it (eat his own dogfood)
  • Is it backed by a large company (like Solarwinds)?
  • do you know the developer (did you have contact with him) If you make a library the core of all your products, you may want to invest some time in f.e. contacting the developer.
  • How complex will it be to create something comparable (perhaps with less functionality)?
  • How difficult is it to audit it yourself? I routinely check on scripts before executing them. Not a full audit, and I may miss things, but I have thrown-out certain software for doing inexplicable things.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.