Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

501–510 of 827 posts

Re: I've Just Liberated My Modules

#501

Post by jacobr »

spinlock wrote: post #290
callmevlad wrote: post #43

The fact that this is possible with NPM seems really dangerous. The author unpublished (erm, "liberated") over 250 NPM modules, making those global names (e.g. "map", "alert", "iframe", "subscription", etc) available for anyone to register and replace with any code they wish. Since these libs are now baked into various package.json configuration files (some with 10s of thousands of installs per month, "left-pad" with…

You can use github and get namespacing under the author. IMO, this could end npmjs of they don't fix the issue.

You don't get any prepublish hook when pushing to a git repository though, so you can't do things like preprocess with babel, typescript, etc, unless you check in the compiled source.

Re: I've Just Liberated My Modules

#502

Post by brazzledazzle »

laughinghan wrote: post #473
jsprogrammer wrote: post #48

Earlier quoted context omitted.

Didn't NPM break builds by completely swapping out the contents of a known module ? Obviously NPM should not be relied on, but this really makes the case. NPM will arbitrarily modify packages without notice -- this could be the unwinding of NPM.

> For the record they made sure the exact same code was published to 0.0.3 so that I didn't maliciously inject anything. (elsewhere in this thread)

I assume they're talking about the kik module.

Re: I've Just Liberated My Modules

#503

Post by mschuster91 »

spriggan3 wrote: post #156
mschuster91 wrote: post #55

brouhaha, this is why you should not put node_modules into .gitignore (same for PHP's composer.lock and vendor/ folder). To be honest, I have waited for something like this to happen so that people finally wake up and realize how deeply and truly compromised the JS ecosystem really is. 11 SLOC not available any more and all over the internet builds are breaking etc.?! And please, why isn't essential stuff like this i…

> brouhaha, this is why you should not put node_modules into .gitignore (same for PHP's composer.lock and vendor/ folder). You should obviously not do that if you are writing a library. You shouldn't publish vendored modules on npm. If everybody did this everybody would end up fetching 100MB packages.

For a library yes, but if you're writing software you absolutely must. npm actually deduplicates and flattens your dependencies to reduce clutter.

Re: I've Just Liberated My Modules

#504

Post by bryanrasmussen »

ubernostrum wrote: post #423
indiv0 wrote: post #397

Earlier quoted context omitted.

How about a blockchain-based NPM? Can't take all the computers down. Legal, shmegal.

You can still be jailed for contempt of the order, though. "I've found a clever workaround for court orders" doesn't work around that bit.

that's why we'll kurtzweill ourselves into the computers that can't be shut down!

Re: I've Just Liberated My Modules

#505

Post by alpb »

felixrieseberg wrote: post #152
alpb wrote: post #100

Earlier quoted context omitted.

How does a 30-day notice work unless you have a way of reaching out to people using your modules? It just seemed so unrealistic that even 1% of people would actually see such a notice before things start to fall apart.

You bake deprecation notices into npm, to be displayed during install. He has more than 3m installs a month, if he really wanted to, he could have easily display a giant "npm sucks" banner during every single install. Same message, but it wouldn't immediately hurt people who trusted his modules.

I highly doubt if most continuous build/delivery systems actually have a person looking at the build output to take some action. That’s why, centralized build systems should not just let the packages disappear but unfortunately that’s not the reality. This is also the reason why there are languages like Go out there that do not rely on centralized package management.

Re: I've Just Liberated My Modules

#506

Post by amboar »

gbaygon wrote: post #320
overgard wrote: post #298

Earlier quoted context omitted.

Not only is there a solution, but it's pretty well known computer science. Use public key cryptography to create a digital signature. It's not even a novel use of this -- .NET has been using this to sign assemblies and packages from day one.

I think he means a solution to the current problem of the packages being replaced with malicious ones, not the problem with npm not supporting package signatures.

Package signing by the package's author /is/ the solution, right? This way the only entity that can publish a valid update is the the package author. This still has the problem of bootstrapping the trust relationship, and leaves the door open to the author publishing a malicious but signed package or the signing key being stolen and used to do the same. However if you don't trust the package author to be responsible or take precautions against the keys being stolen then you're essentially taking on the burden of implementing of your required functionality.

Re: I've Just Liberated My Modules

#507

Post by brazzledazzle »

voltagex_ wrote: post #222
Klathmon wrote: post #33

Earlier quoted context omitted.

I agree. I use and love NPM and others like it, but when it comes down to it, i check-in my dependencies when my applications get "released". Committing the updates is only one more step, and in my experience it's not even another step since we already have a rule that new installs or dep updates need their own commit.

It becomes even more important in an "enterprise" environment. I have machines here which are blocked from executing node.exe (at the time, the binary I had wasn't signed). I have machines here that have to authenticate via SSPI/NTLMv2 to a proxy to get out to the net. And don't even get me started on the SSL MITM we have here. I can't run your startup's app here. I can't run your new build tool here.

And the endless list of risk reducing stuff like this (and not just in IT either) is exactly why big companies are slow. Big corps need figure out how to create small disconnected divisions instead of consolidating common services for cost savings. If one of your tiny divisions gets hacked it doesn't take down the rest unless your all on the same systems burdened by the same laundry list of security and policies.

Re: I've Just Liberated My Modules

#508

Post by nileshtrivedi »

overgard wrote: post #240
wyuenho wrote: post #108

Earlier quoted context omitted.

I for one wholeheartedly support him. The more collateral damage he causes, the more people are awareness he raises. While the solution to his problem is unclear at this point, it'll at least get us talking, and find out what all of the stakeholders can do better next time, and we as a community to prevent this from ever happening again. I entirely supports his actions.

"awareness". Awareness of what? His trademark infringement? Imagine this from the perspective of a hypothetical user. He's cranky and on a tight deadline, and suddenly his project is broken because some dumb dependency three layers away that he's never even heard of broke because some guy decided to throw a tantrum, and now his software is broken and he has to emergency rewrite part of it. All because this guy didn't…

What if left-pad was trademarked? It's not the developer who decided to throw a tantrum, the lawyers of this company did.

Re: I've Just Liberated My Modules

#509

Post by stbtrax »

zongitsrinzler wrote: post #483

Extremely dick move on behalf of the developer. Why would you remove modules that other people are using in production? Did you think a small team like NPM would go head to head with a company having full time lawyers? And for what?

you should ask for your money back

Re: I've Just Liberated My Modules

#510

Post by repomies691 »

mdpopescu wrote: post #431
indiv0 wrote: post #397

Earlier quoted context omitted.

How about a blockchain-based NPM? Can't take all the computers down. Legal, shmegal.

Or something like http://ipfs.io/

IFPS is cool, however pretty far away from being usable as a package management system... Some package management system could use it as a backend, though.
Post reply on HN