We gotta support:
http://puu.sh/nQOLH/d225ff95d3.png
:D
I've Just Liberated My Modules
561–570 of 827 posts
Re: I've Just Liberated My Modules
#562Sadly there is a user @nj48, who already published empty modules and took the names [1].
Is this a joke or something coordinated with the community?
[1] https://www.npmjs.com/~nj48
EDIT : The hijacked modules look suspicious. http://www.drinchev.com/blog/alert-npm-modules-hijacked/
Re: I've Just Liberated My Modules
#563brouhaha, this is why you should not put node_modules into .gitignore (same for PHP's composer.lock and vendor/ folder). To be honest, I have waited for something like this to happen so that people finally wake up and realize how deeply and truly compromised the JS ecosystem really is. 11 SLOC not available any more and all over the internet builds are breaking etc.?! And please, why isn't essential stuff like this i…
some node modules compile platform specific binaries
Ew yes, haven't thought of that, but the code that compiles said binaries usually can be re-run to recreate the binary.
Re: I've Just Liberated My Modules
#564> This is not a knee-jerk action. The only thing knee-jerk and honestly irresponsible is not warning anyone first, especially knowing how much his modules were depended upon. Otherwise, there's nothing wrong with this.
Sounds like npm didn't give him advance warning for kik either, so way to prove a point.
Re: I've Just Liberated My Modules
#565I've never felt good any time I have to use node modules and see this gigantic stream of dependencies come flying down. It's even more painful when you need to assemble license information for your software and crawl through _every single dependency and all of their dependencies_ to find their licenses, etc. to check they are OK to use in your software. Just look at the View License info in the Atom text editor some…
Note: There's a cool tool that scans your dependencies and exports all their license info into a csv/json. I've used it before and it's a lifesaver.
Re: I've Just Liberated My Modules
#566Earlier quoted context omitted.
Or, you know, prefix with author's username, a la Github.
Like, can my github username be kik? And if I have created years before they founded kik?
How many years before github would that be?
(Edit: this was written under the assumption that the lawyers in question are working on behalf of kik, the cheap clothes company, not kik, the messenger company. The original article is unclear about that)
This really has to be attacked at the root: let's all stop pretending that a sequence of characters can be owned. Before the web came along, people were completely sane about the protection of brands. Nobody had delusions about string ownership, but deceptive abuse of brand names was suppressed just as well. Enter the web, and suddenly corporations start thinking they somehow deserve exclusivity for their stupid little three-letter-acronym, at first on the DNS, now, apparently, also in search engine hit lists ("oh noes, someone might google themselves onto github instead of our site, people will start wearing NPMs instead of our clothes!").
Re: I've Just Liberated My Modules
#567Why isn't GitHub the source of all node packages? npm supports it very nicely. I mean: why don't people write `npm install user/repo --save` instead of `npm install package --save` every time already?
Because there's no version control that way. If I depended upon babel/babel (or whatever it's called on Github), when it changed from v5.x to v6.x, it would have broken my build.
You can ask for a specific tag/branch using Github dependencies using babel/babel#v5.x
Re: I've Just Liberated My Modules
#568Earlier quoted context omitted.
Do they seriously not use any sort of public key cryptography to sign packages? Frankly, for a project that's been around as long as NPM, that's downright irresponsible if that's the case. That's like package management 101.
Most of the programming language Package managers that I've seen either don't have the facility or it's not widely used.
Maven central requires GPG signatures for every package, so all major libraries on the JVM have GPG signatures.
(Whether anyone's checking them is another question, but at least you can if you want to)
Re: I've Just Liberated My Modules
#569Sounds like NPM should move to pulling in the code from specific github tags or something? although I suppose, github is also "private land"...
Re: I've Just Liberated My Modules
#570Earlier quoted context omitted.
I think he means a solution to the current problem of the packages being replaced with malicious ones, not the problem with npm not supporting package signatures.
Package signing by the package's author /is/ the solution, right? This way the only entity that can publish a valid update is the the package author. This still has the problem of bootstrapping the trust relationship, and leaves the door open to the author publishing a malicious but signed package or the signing key being stolen and used to do the same. However if you don't trust the package author to be responsible…
We also need some way to link packages to authors. In the Java world packages are supposed to be in a namespace that's the reverse domain name, so you could (potentially, theoretically) connect that up with something like DNSSEC and enforce that people can only publish packages for domains that they control. (Though even that is really just punting the problem up to the DNS registries).