JFrog Blog

Does anyone recommend some pull-through registry to use? Docker Docs has some recommendations [0], but I wonder how feature complete it is. I'd like to find something that: - Can pull and serve private images - Has UI to show a list of downloaded images, and some statistics on how much storage and bandwidth they use - Can run periodic GC to delete unused images - (maybe) Can be set up to pre-download new tags IIRC Artifactory has some support for Docker images, but that seems like a big hammer for this problem. [1] [0] https://docs.docker.com/docker-hub/image-library/mirror/ [1] https://jfrog.com/artifactory/

At work we don't use PyPI any longer. We have our own set of curated packages, the security issues are just too great: https://developers.slashdot.org/story/24/09/15/0030229/fake-python-cod… https://jfrog.com/blog/revival-hijack-pypi-hijack-technique-exploited-… https://jfrog.com/blog/leaked-pypi-secret-token-revealed-in-binary-pre… We consider switching to Java, C++ or Rust because of general quality issues with Python.

Yes. That is why they thinned things down with the compute module form factors. https://www.raspberrypi.com/for-industry/ https://jfrog.com/connect/post/3-best-industrial-raspberry-pi-solution…

https://jfrog.com/blog/log4shell-0-day-vulnerability-all-you-need-to-k… "If using log4j 2.10.0 or any later version, we recommend disabling message lookups globally by setting the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true by executing this command before Java applications are loaded in one of the system’s init scripts"

He really had a terrific impact. I knew him a little bit personally and he didn't carry himself like it, but his career was amazing. Another beautiful tribute to Carl: https://jfrog.com/blog/in-memory-of-a-superfrog-carl-quinn-jfrog/

While it may not be the right time to _start_, incidents like this are an excellent reason to consider an internal read-through proxy package repository. The last couple of organisations I've worked with have used Artifactory: https://jfrog.com/artifactory/

Artifactory is a great alternative https://www.jfrog.com/open-source/#os-arti

> Does anyone have any other practices they can recommend for managing these type of projects? Honestly, the only way around these sorts of issues is to utilize automation in some form. I've found that setting up repositories (like devpi[0], Artifactory[1], or Docker Registry[2]) on a shared network location (for your project, could be local if you work alone) and using CI/CD tools (like Jenkins[3]) are the key. The goal is that you end up working on one portion of the code base at a time, and those need to go through the standard validation processes so that you can pull in the updated package version when you work on something down-stream. You making sure that the CI/CD environment _doesn't_ have access to other packages's non-versioned code is key for making sure things actually work as expected. For example, if you have FooLib, and you need an update in that for BarApp, then even if you branch FooLib 1.2.3 to 1.2.3-1-gabc1234d (the `git describe` of the commit) on `feat/new-thingy` , then even if BarApp v2.3.4-1-gaf901234 depends on that new branch, it shouldn't be in any way able to reference that branch on the CI/CD build process. How do you get around this? Good development -- finish the FooLib branch, get that working, merge it in with the updated version, and push the package (with the new version) to the CI/CD-accessible repository. At that point, when you push your BarApp change, it can actually build and not die. But until FooLib has got a versioned update,…

Someone asked "Would this have made sense for a company like GitLab if they didn't have the corporate backing of something like MS?" and deleted their comment while I was writing the answer below: Being the canonical registry for a language (Rubygems) or technology (DockerHub) tends to be a huge expense. The main expenses are cloud costs (bandwidth and storage) and security (defense and curation). I've not seen examples of organizations turning this into a great business by itself. For example Rubygems is sponsored by RubyCentral http://rubycentral.org/ who organize the annual RubyConf and RailsConf software conferences. Please note that running a non-canonical registry is a good business. JFrog does well with Artifactory https://jfrog.com/artifactory/ and we have the GitLab Package Registry https://docs.gitlab.com/ee/user/packages/ that includes a dependency proxy and we're working on a dependency firewall.

Clickbait. At least propose what it is that you think needs to be done to address this so-called chaos. Worth noting that ES2017 added String.prototype.padStart and String.prototype.padEnd. The whole left-pad thing is blown out of proportion. Second, you shouldn't be relying on npm for deployments. You dig your own grave. If package deletion is a concern, then host a mirror with something like Nexus [0], or pay for a service [1] [2] to do it for you. Over the years there have been a few local npm mirror tools [3], but I don't think any of em have really caught much traction. There's also the option of bundling each release. For that you can use a tool such as Webpack [4], or take it one step further and generate a single binary using something like pkg [5]. Developers also have the option of forking their dependency graph and updating references in package.json. Sooner or later you'll start to find bugs in your dependencies and have to fix them. It's your responsibility, you own all that code. Don't be afraid of maintaining your own fork. If you find a critical issue you'll probably need to be able to deploy your update without depending on a third-party anyway. This is fairly common in other ecosystems. Heck, you can also just check in your node_modules folder into version control. Don't get me wrong, npm certainly has its fair share of problems, and historically they haven't had the best defaults... But there's usually ways to work around the issues, and they're…

I can't say for sure, but intuitively this type of vulnerability seems like it could be handy for an attacker trying to move through a target network? In any case, JFrog seems to be taking the situation quite seriously https://jfrog.com/blog/jfrog-and-openai-collaboration-on-zero-day-secu…

So that is the package caching proxy from the OpenAI/Huggingface fiasco! However, many questions remain. JFrog positions itself as a vibe coding and AI security (!) company: https://cybersecurityasia.net/jfrog-nvidia-secure-agentic-ai-developme… JFrog's own vibe code scanner failed: https://jfrog.com/blog/jfrog-introduces-ai-generated-code-validation/ Given the feature explosion and chaos in the Artifactory cache, it is likely vibe coded and hence full of primitive security vulnerabilities. JFrog is spinning this as an AI victory together with OpenAI. To the contrary, it is a hype and vibe coding failure. But the AI bloggers will omit the vulnerability generation part.

For those lazy to search: CVE-2025-29927 – Authorization Bypass Vulnerability in Next.js: All You Need to Know https://jfrog.com/blog/cve-2025-29927-next-js-authorization-bypass/

My guess is that it's a joke about: https://jfrog.com/blog/leaked-pypi-secret-token-revealed-in-binary-pre…

> and then the amount of additional code associated with a given LLM should be tiny What about this reporting (which is a deserialization issue, it seems like)? - https://www.wiz.io/blog/wiz-and-hugging-face-address-risks-to-ai-infra… - https://jfrog.com/blog/data-scientists-targeted-by-malicious-hugging-f…

This site is hilariously fucked on mobile https://jfrog.com/artifactory

After reading the underlying report (https://jfrog.com/blog/leaked-pypi-secret-token-revealed-in-binary-pre… I can't help but think: "where is the defense in depth?" Since `.pyc` files are just a cache of compilation that's already generally pretty quick, this could have been prevented by systems that simply didn't allow for pushing them into the Docker image in the first place. Or by having `PYTHONDONTWRITEBYTECODE=1` set on the developer's machine. (Also, now I'm trying to wrap my head around the fact that there's such a thing as "Docker Hub" in the first place, and that people feel comfortable using it.)

> Such as? You can search the web, but as an appetiser here you go: https://jfrog.com/blog/malware-civil-war-malicious-npm-packages-target… > In what way? Well, you can't bundle GPL licensed software with less restrictive one such as BSD, which is a big deal, that's why BSD and GNU/Linux are so separated in many ways. That's just one problem. It'c clear that all-or-nothing approach doesn't work in free and open source software world.

See self-hosted pricing from this company's page https://jfrog.com/pricing/ It does have contact sales, but only after a 43k per year tier!

I have no idea what "bintray" is, so I did a search. Is this relevant? > JFrog has announced that they are shutting down the Bintray hosting service, which includes the popular JCenter hosting service for Java artifacts, as well as GoCenter (which hosted Go packages) and ChartCenter (which hosted Helm charts). https://www.infoq.com/news/2021/02/jfrog-jcenter-bintray-closure/ This link : https://www.bintray.com Redirects here : https://jfrog.com/distribution/?bintrayRD=1

They promised to keep a read-only instance running for ever, so I hope it will come online. Nevertheless I think switching to mavenCentral is a better choice it wasn't already done by now. Source: https://jfrog.com/blog/into-the-sunset-bintray-jcenter-gocenter-and-ch…

> UPDATE 4/27/2021: We listened to the community and will keep JCenter as a read-only repository indefinitely. Our customers and the community can continue to rely on JCenter as a reliable mirror for Java packages. https://jfrog.com/blog/into-the-sunset-bintray-jcenter-gocenter-and-ch…

Ahh, i feel like this is probably the case for most of the corporation backed software out there - apparently offering just support isn't always a viable strategy to remain in business, so many out there lock bits of more advanced functionality behind pay walls: like many of the features of GitLab (https://about.gitlab.com/pricing/gitlab-com/feature-comparison/) and something like Artifactory (https://www.jfrog.com/confluence/display/JFROG/Artifactory+Comparison+… I'm not sure whether that's a bad thing, though, since the alternative would be having no free plans/editions for those pieces of software at all, or maybe just using them for a few years and the company going bankrupt.

If you work in a large company, for security reasons you may already be required to use in-house mirrors of libraries or container images. There are commercial products for doing this, e.g. https://jfrog.com/artifactory/ All the command line package management tools then need to be configured to point at the custom in-house package mirror, rather than connecting to the default public package server over the internet.

The affected packages are: importantpackage important-package pptest ipboards owlmoon DiscordSafety trrfab 10Cent10 10Cent11 yandex-yt yiffparty The original writeup is at https://jfrog.com/blog/python-malware-imitates-signed-pypi-traffic-in-…

The article is really poor and not original, doesn't link to haproxy or jfrog web pages or haproxy git repo. Please link the original jfrog blog post with in depth analysis: https://jfrog.com/blog/critical-vulnerability-in-haproxy-cve-2021-4034…

Yea, JFrog announced the May 1st shutdown of Bintray on Feb 3rd: https://jfrog.com/blog/into-the-sunset-bintray-jcenter-gocenter-and-ch… 3 month warning that they'd blow up the ecosystem. I have no idea why a company that builds products for devs would take such an aggressively anti-dev approach to shutting down a core service.

> Difficult to publish to Maven No more than Java, but also why most Scala projects publish to Bintray as it much smoother. Oh wait... https://jfrog.com/blog/into-the-sunset-bintray-jcenter-gocenter-and-ch…

They have an open source just conan server [1] and artifactory has a community edition which is open source [2]. 1: https://docs.conan.io/en/latest/uploading_packages/running_your_server… 2: https://jfrog.com/open-source/