Socket will block it with free malicious package firewall

Software security biz Socket has released a free command line tool to defend developers against supply chain attacks. Socket Firewall Free builds upon the company's safe npm tool by extending scanning capabilities beyond the JavaScript/TypeScript ecosystem to Python and Rust. It integrates with the package management tools for …

[Taliesinawen]

Whois Feross Aboukhadijeh ..

“Feross is founder and CEO at Socket (https://socket.dev), a developer-first security platform. Feross has worked in open source software for 10+ years writing some of the most-downloaded JavaScript packages. Feross is a lecturer at Stanford where he teaches CS 253 Web Security. Socket makes a developer-first security platform that prevents vulnerable and malicious open source dependencies from infiltrating your software supply chain. Thousands of organizations in every industry use Socket to safely discover, audit, and manage OSS at scale.”

CS 253 Web Security

“Topics include: Principles of web security, attacks and countermeasures, the browser security model, web app vulnerabilities, injection, denial-of-service, TLS attacks, privacy, fingerprinting, same-origin policy, cross site scripting, authentication, JavaScript security, emerging threats, defense-in-depth, and techniques for writing secure code. Course projects include writing security exploits, defending insecure web apps, and implementing emerging web standards.”

[IGotOut]

Re: Whois Feross Aboukhadijeh ..

Is that the paid or free version of ChatGPT?

[spuck]

An unfortunate name

"Socket Firewall"; both words are already used for so many other things in IT.

[PRR]

Re: An unfortunate name

> An unfortunate name "Socket Firewall"; both words are already used for so many other things in IT.

Don't use chromed sockets with impact wrenches.

[stiine]

Re: An unfortunate name

I've heard they're perfectly fine to use with Milwaukee power tools.

[IGotOut]

Re: An unfortunate name

"Don't use chromed sockets with impact wrenches."

And don't use impact wrenches on locking wheel nuts.

[Anonymous Coward]

Seems like a url black list.

I would guess it checks the package url. If the host part matches a known bad fqdn or ip address – no go. If the file path which would specify the package name is known bad, inconsistent wrt the source, or unknown – no go. Presumably also checks package hashes and signatures.

I imagine it is possible to use a Squid proxy with a bit of firewall redirection to achieve the same result.

[GNU Enjoyer]

>Free.

>Look inside.

>Proprietary software

Almost got me there - it seemed that the license could be a free one until I scrolled down to the "Noncompete" part (it seems that's intentional, as most people won't make it to that part).

[t0m5k1]

I like this and it is better than nothing but...

What happens if some script that ends up on your machine and just runs pip to install something ?

If this can only protect if called with 'sfw' then it's only protecting the user/admin from mistakes, I'd like a way for this to be an automated system wide things that doesn't require you to use the 'sfw' command

[Roland6]

I presume, just like the early PC AV and firewalls, this product will evolve rapidly into something more sophisticated and potentially getting incorporated into the established security suite vendor offerings.