Batteries included vs Plugin based systems
A good platform is often batteries included. It has support for most of the frequent use cases for its users out of the box. But there are many systems which only support a robust but shallow core. It depends upon an ecosystem of third party plugins or libraries to support common use cases.
NodeJS is an example of such a shallow core system. Node standard library is smaller with support for basic core functionalities. But the npm ecosystem provides libraries for almost anything. In contrast C++, Java, Python or Go provide many functionalities out of the box via their standard libraries.
There are other examples like VSCode and Obsidian which also rely on external plugins.
Benefits of plugin ecosystems
There are benefits of plugin based systems. The main product team focuses on making the core robust. While the ecosystem supports many use cases without investment by the core product team. It also accelerates innovation as anybody can come up with a plugin and the users will decide if the plugin is great or not. Over time, if another alternative comes up and the plugin loses its relevance, then users migrate from the older one. In contrast, the developers of the standard library spend significant time deciding if a feature is worth investing into or not. They also need to ensure supporting obsolete features.
Security issues with plugin ecosystems
The problem comes with security and it is becoming more pronounced with the rise in supply chain attacks. Each plugin increases the surface area of attack. One or more new supply chains added for each addition of a new plugin or library. Recently a poisoned VSCode extension resulted in exfiltration of around 3800 internal Github repos. There are numerous examples of supply chain issues with npm packages.
Some common security issues are
- typosquatting packages
- dependency confusion
- maintainer account compromise
- malicious updates after acquisition
- protestware
- cryptojacking
- abandoned packages taken over by attackers
- compromised CI/CD pipelines
Avoiding security issues with plugin ecosystem
There is no easy solution to this problem. NodeJS, VSCode and Obsidian are popular and widely used products and platforms. Interestingly their popularity is also powered by the rich ecosystem of libraries and plugins. Ironically, the same openness that makes plugin ecosystems innovative and popular also makes them difficult to secure.
There are few solutions like avoiding installing freshly released plugins. Generally the security issues are caught in a few days and delaying updates is an easy work around.
The other solution is to fork the dependencies and maintain a trimmed one for your use case. The later option is very costly.
People are also working to make the supply chains more robust via multiple checks and balances.
Conclusion
Modern software systems are unlikely to move away from extensibility. But we need to build robust security guarantees around the plugins, dependencies and supply chains. Until we have robust security guarantees, we are effectively building on top of insecure plugins and packages. And we should be very cautious while adopting plug-ins and third-party packages.