certificates and security

npm is the defacto package manager for the node.js javascript network programming environment thingee.

The folks who make npm have taken a security leap:

npm no longer supports its self-signed certificates

Ah, they build the bastions of light and goodness, protecting us from the sins of the masses by standing tall.

So… how do you install npm, anyway? Ah, yes, you look it up on their site... let’s see… why, it’s as simple as executing raw shell commands from a host, what could go wrong with that?

But let’s test it out, it’s simply (they thoughtfully tell you to put the -L option, which tells curl to go wherever they decide to redirect you in the webs):

Nothing happened? Ah, they tell you to use a stupid shell so they fail silently; try again with something with a brain, bash this time.

Yes, the same thing you always see… a crypto error, because they don’t use a valid certificate, and I don’t think they ever have. But hell, obviously these security minded folks want you to simply follow the 301s, wherever they go, execute arbitrary code from psuedo random sites stop asking pesky questions.

Fortunately you can tell curl to ignore the certificate with the –insecure option (obviously the curl people are exaggerating naming it that!) and run it again:

Well shoot. It looks like they run curl inside the script that runs curl that follows their redirects to sites with broken certificates. You folks just fill me with confidence – well, confidence that you don’t know your head from a hole in the ground WRT security.

I suppose it’s better than node.js was a year or two ago, when their official advice was to:

What does that do? Well, they even removed the pretense – this isn’t even a secure site, it’s using an obfuscater, and they tells curl to ignore any pesky errors or warnings.

Following that single line above with strace revealed 1.6GB of data being tossed around, 16 hosts being involved, and who knows (I lost the output, sorry, lol) how many hundreds of programs, files, and other things were involved.

And these are the people trying to tell me how to use certificates? They may be gods and networking, but they blow chunks with security. GTFO my lawn, whippersnappers, and stop chasing dreams you read in CSO magazine or wherever else you get your crappy security 411. And stop trying to demonize self-signed certs, which I guarantee you are far more numerous and far more useful that crap they try to sell you at Verisign et al*.

God, certificates suck.

* In this case nothing against Verisign, it’s just the entire rotten group of certificate authorities out there.