Our Software Dependency Problem
The security of package managers is something we&#x27;re going to have to fix.<p>Some years ago, in offices, computers were routinely infected or made unusable because the staff were downloading and installing random screen savers from the internet.  The IT staff would have to go around and scold people not to do this.<p>If you&#x27;ve looked at the transitive dependency graphs of modern packages, it&#x27;s hard to not feel we&#x27;re doing the same thing.<p>In the linked piece, Russ Cox notes that the cost of adding a bad dependency is the sum of the cost of each possible bad outcome times its probability.  But then he speculates that for personal projects that cost may be near zero.  That&#x27;s unlikely.  Unless developers entirely sandbox projects with untrusted dependencies from their personal data, company data, email, credentials, SSH&#x2F;PGP keys, cryptocurrency wallets, etc., the cost of a bad outcome is still enormous.  Even multiplied by a small probability, it has to be considered.<p>As dependency graphs get deeper, this probability, however small, only increases.<p>One effect of lower-cost dependencies that Russ Cox did not mention is the increasing tendency for a project&#x27;s transitive dependencies to contain two or more libraries that do the same thing.  When dependencies were more expensive and consequently larger, there was more pressure for an ecosystem to settle on one package for a task.  Now there might be a dozen popular packages for fancy error handling and your direct and transitive dependencies might have picked any set of them.  This further multiplies the task of reviewing all of the code important to your program.<p>Linux distributions had to deal with this problem of trust long ago.  It&#x27;s instructive to see how much more careful they were about it.  Becoming a Debian Developer involves a lengthy process of showing commitment to their values and requires meeting another member in person to show identification to be added to their cryptographic web of trust.  Of course, the distributions are at the end of the day distributing software written by others, and this explosion of dependencies makes it increasingly difficult for package maintainers to provide effective review.  And of course, the hassles of getting a library accepted into distributions is one reason for the popularity of tools such as Cargo, NPM, CPAN, etc.<p>It seems that package managers, like web browsers before them, are going to have to provide some form of sandboxing.  The problem is the same.  We&#x27;re downloading heaps of untrusted code from the internet.