Your one-stop shop for all Changelog podcasts. Weekly shows about software development, developer culture, open source, building startups, artificial intelligence, shipping code to production, and the people involved. Yes, we focus on the people. Everything else is an implementation detail.
The insider perspective on the event-stream compromise (The Changelog #326)
Adam and Jerod talk with Dominic Tarr, creator of event-stream, the IO library that made recent news as the latest malicious package in the npm registry. event-stream was turned malware, designed to target a very specific development environment and harvest account details and private keys from Bitcoin accounts.
They talk through Dominic’s backstory as a prolific contributor to open source, his stance on this package, his work in open source, the sequence of events around the hack, how we can and should handle maintainer-ship of open source infrastructure over the full life-cycle of the code’s usefulness, and what some best practices are for moving forward from this kind of attack.
Changelog++ members support our work, get closer to the metal, and make the ads disappear. Join today!
Sponsors
- Rollbar – We catch our errors before our users do because of Rollbar. Resolve errors in minutes, and deploy your code with confidence. Learn more at rollbar.com/changelog.
-
Linode – Our cloud server of choice. Deploy a fast, efficient, native SSD cloud server for only $5/month. Get 4 months free using the code
changelog2018. Start your server - head to linode.com/changelog - GoCD – GoCD is an on-premise open source continuous delivery server created by ThoughtWorks that lets you automate and streamline your build-test-release cycle for reliable, continuous delivery of your product.
- Command Line Heroes – A new podcast about the epic true tales of the developers, hackers, and open source rebels revolutionizing the tech landscape from the command line up. Presented by Red Hat.
Featuring
- Dominic Tarr – Twitter, GitHub, Website
- Adam Stacoviak – Twitter, GitHub, LinkedIn, Website
- Jerod Santo – Twitter, GitHub
Notes and Links
- The issue that kicked off everything
- We covered the incident on Changelog News
- Here’s Dominic’s statement that we reference repeatedly
- Felix Krause had some on-point commentary on Twitter
- TideLift says event-stream gets 2 million downloads per week
- SwiftOnSecurity also chimed in on Twitter
- Learn more about Project Xanadu
- We discussed Reproducible Builds with Chris Lamb back in the day
- Also check out A call for kindness in open source with Brett Cannon
Something missing or broken? PRs welcome!