Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

351–360 of 827 posts

Re: I've Just Liberated My Modules

#351

Post by detaro »

yazaddaruvala wrote: post #281
camwest wrote: post #232

Earlier quoted context omitted.

Well the code was open sourced. Isn't that sort of the point of open source?

Lol, so if I'm understanding you correctly: Someone was nice enough to write some software, that is clearly indispensable. They were nice enough to not charge money for it. They were nice enough to support it, again free of cost. They were also nice enough to open source it, such that if it ever became more convenient for you to fork/change/do whatever you want with, that you would be able to. And when that same pers…

The author offered to transfer the repo to anybody willing to take it.

https://github.com/azer/left-pad/issues/4#issuecomment-20006...

You really publishing his code again is "going against his wishes"?

He made his point and got a lot of attention to the situation, he isn't responsible for the packages anymore. I would not assume that he wants further disruption or objects to people using his code.

Re: I've Just Liberated My Modules

#352

Post by untog »

tdicola wrote: post #235
camwest wrote: post #230

Earlier quoted context omitted.

Yes you got it right. The third point was the special exception / grey area. For the record they made sure the exact same code was published to 0.0.3 so that I didn't maliciously inject anything. I control subsequent versions though.

Now that you own it what's to stop you from pushing out a new version with a slightly reworked string pad function under a commercial license (say a $100 per use fee)? Could make quite a pretty penny. Kind of crazy that this is possible at all.

What's to stop an original author doing the same thing? This isn't a new danger.

Re: I've Just Liberated My Modules

#353

Post by gosukiwi »

smsm42 wrote: post #348

Reading some of the comments reminds me old tale about a young man, that every morning on his way to work passed by a beggar and gave him a coin (that was back when coins actually had some value). One morning though the beggar notices the coin is smaller than usual, and he asks: - Why you gave me a different coin today? and the young man says: - I got married and now I'm starting a family, I need more money so I can…

Reminds me of this: https://www.youtube.com/watch?v=7rMpCud1IwQ

Re: I've Just Liberated My Modules

#354

Post by d0m »

vjeux wrote: post #97
callmevlad wrote: post #43

The fact that this is possible with NPM seems really dangerous. The author unpublished (erm, "liberated") over 250 NPM modules, making those global names (e.g. "map", "alert", "iframe", "subscription", etc) available for anyone to register and replace with any code they wish. Since these libs are now baked into various package.json configuration files (some with 10s of thousands of installs per month, "left-pad" with…

Ideas for improvement: - Add 2 factor authentication for npm publish - When you npm install, add a warning for all the versions that got published without 2 fac - pre-install/post-install scripts should require user to accept or refuse. The simple action of running npm install shouldn't run arbitrary code. - make shrinkwrap by default (and fix all the issues with it) so that running npm install doesn't use different…

Hmm, how does that help?

  User A: Publish package X1.0 (with 2 factor auth)
  User B: Download with npm package X1.0
  User A: Unpublish package.
  User C: Publish package X1.0, malware code (with a different 2 factor auth)
  User B: Somewhere else, download and install package X1.0
For that to work, every package should be signed in package.js so that when you download a different version, you know about it. Also, I don't think it should be possible to alter previous versions. Package X1.0 should always be X1.0.

EDIT:

Seems like it's impossible to re-upload X1.0, which fix this issue. I thought once a package was unpublished, it was possible to republish the exact same version.

Re: I've Just Liberated My Modules

#355

Post by greggman »

dwg wrote: post #177
larkinrichards wrote: post #31

I applaud this action and while I'd like to point the finger at NPM, there's no real other method to fix historical package versions that depend on this. It is worth pointing to the silly state of NPM packages: Who decided that an external dependency was necessary for a module that is 17 lines of code? module.exports = leftpad; function leftpad (str, len, ch) { str = String(str); var i = -1; if (!ch && ch !== 0) ch =…

Having a multitude of small utilities like this is a great thing with many advantages. It may seem simple to write leftpad, but if 1000 projects that need it all write their own version, there will be at least 2000 more software bugs out there in the wild because of it. If you think that's rediculous, you're not being realistic about the huge disparity in skill levels of industry programmers as well as the considerab…

It's not one less thing to think about which is exactly the point. If you install 1 dep and it has 100 deps you now have 101 things to think about.

Re: I've Just Liberated My Modules

#356

Post by steveklabnik »

sbuttgereit wrote: post #245

I've been reading in the comments regarding 1) the practical effect of breaking builds and 2) the security issues of how package names can be reused on npm once they are unpublished (versioning aside for a moment). I wonder what other, similar, packaging distribution platforms are vulnerable to this sort of thing? I am not speaking from knowledge of any of the procedures of any of those I'm about to mention, but I ha…

With crates.io, users cannot delete their packages. They can 'yank' a version, which means that no new packages can depend on it, but existing packages can.

So in this specific case, there are two packages: kik, the subject of the legal threat, and left-pad, another module by the same author. If we were compelled through legal means to remove a package, as administorators, we could, which is what happened with kik. However, if said author got mad at us, they couldn't _delete_ their other packages, only yank them, and so people's builds would not break, like they did here.

Does that make sense?

(IIRC Rubygems acts in the same way)

Re: I've Just Liberated My Modules

#357

Post by nikolay »

smaddox wrote: post #200
cookrn wrote: post #169

Earlier quoted context omitted.

What if such a system was implemented using IPFS[0] (or similar) for storage? [0] https://github.com/ipfs/ipfs

I'm surprised all package managers don't use an IPFS-like system that uses immutable state with mutable labels and namespaces. Now that IPFS exists, and provides distributed hosting, it's even easier.

No signatures, no (at least!) an IPFS mirror as a backup option - how can one trust NPM or the likes?!

Re: I've Just Liberated My Modules

#358

Post by STRML »

d0m wrote: post #354
vjeux wrote: post #97

Earlier quoted context omitted.

Ideas for improvement: - Add 2 factor authentication for npm publish - When you npm install, add a warning for all the versions that got published without 2 fac - pre-install/post-install scripts should require user to accept or refuse. The simple action of running npm install shouldn't run arbitrary code. - make shrinkwrap by default (and fix all the issues with it) so that running npm install doesn't use different…

Hmm, how does that help? User A: Publish package X1.0 (with 2 factor auth) User B: Download with npm package X1.0 User A: Unpublish package. User C: Publish package X1.0, malware code (with a different 2 factor auth) User B: Somewhere else, download and install package X1.0 For that to work, every package should be signed in package.js so that when you download a different version, you know about it. Also, I don't th…

When a package transfers ownership or is removed/re-added, it's not possible to republish the same version as one that has previously existed.

Of course, this doesn't save you if you're installing `^1.0.0`, the maintainer deletes the package, and someone else uploads a malicous `1.0.1`.

The package.json should allow pinning publisher usernames and optionally public keys, and shrinkwrap should pin hashes, not just versions.

Re: I've Just Liberated My Modules

#359

Post by btown »

zachrose wrote: post #76

So what keeps Kik from going after Github? https://github.com/starters/kik

Well, nothing - in fact, you should remove your comment, because if leadership from Kik sees it, they'd technically be obligated to initiate legal action to defend their trademark. The likelihood that they see it is very low, but...

Re: I've Just Liberated My Modules

#360

Post by sbuttgereit »

steveklabnik wrote: post #356
sbuttgereit wrote: post #245

I've been reading in the comments regarding 1) the practical effect of breaking builds and 2) the security issues of how package names can be reused on npm once they are unpublished (versioning aside for a moment). I wonder what other, similar, packaging distribution platforms are vulnerable to this sort of thing? I am not speaking from knowledge of any of the procedures of any of those I'm about to mention, but I ha…

With crates.io, users cannot delete their packages. They can 'yank' a version, which means that no new packages can depend on it, but existing packages can. So in this specific case, there are two packages: kik, the subject of the legal threat, and left-pad, another module by the same author. If we were compelled through legal means to remove a package, as administorators, we could, which is what happened with kik. H…

It does. Given that I've started a project in Rust which will have such dependencies, I feel even better that clearly there has been some good thinking put into this.
Post reply on HN