May 2023 Summaries

Socket Mikola Lysenko's article delves into the limitations of code signing as a security measure, using the SolarWinds Orion hack as a case study. The hack, which affected major institutions like the U.S. Department of Justice, exploited a code-signed update, highlighting the insufficiency of relying solely on code signing for security assurance. While code signing helps identify the provenance of software, it does not guarantee the software's safety or integrity. Socket Security advocates for a deeper understanding of software dependencies and the use of software bill of materials (SBOM) as part of a multi-faceted security strategy. The article emphasizes that security professionals must not merely rely on code signing but should also scrutinize software dependencies to ensure comprehensive protection against threats.

In the context of JavaScript and TypeScript development, managing the complexity of import paths as projects grow can be challenging due to the accumulation of files and conventions like separate test files or single-component files. While tools such as TypeScript's tsconfig.json paths field, Webpack resolve plugins, and Yarn's link protocol offer solutions, they often face interoperability issues across different environments. A more universally supported method involves using the "imports" field in package.json, which is part of the default Node.js resolver standard and supported since Node version 12. This approach allows developers to create local path aliases with dynamic conditions, such as varying the import destination based on the environment, which can simplify the import process and facilitate co-locating server and client code within the same repository. A key consideration is that the "imports" field is order-dependent, functioning like a conditional if/else structure, where each alias condition is validated sequentially.

The Socket blog has introduced full content Atom and JSON feeds, allowing readers to subscribe and stay informed about future blog posts, including updates, changes, and discoveries related to Socket. This enhancement aims to keep readers up-to-date with the latest security blog posts and other relevant content, providing an efficient way to access new information as it becomes available.

The Socket GitHub app has updated its functionality to run Project Health Reports on the default branch of repositories rather than solely in the context of pull requests. This change was implemented after analyzing user feedback and gaining a deeper understanding of how these reports are utilized. Previously, these reports were conducted alongside pull request alert scanning, but the new approach ensures that they now run on all new commits made to the default branch, enhancing the overall monitoring and maintenance of project health.