I've Just Liberated My Modules • Hacker News Board

Re: I've Just Liberated My Modules

#751

Post by ikeboy » Wed, Mar 23, 2016, 5:46 PM UTC

sveiss wrote: post #595

appleflaxen wrote: post #574

Earlier quoted context omitted.

If they receive a court order, and there is no technical way to do that, then the court is out of luck. "A court might order it in the future" is not a design constraint on your decisions today.

Sure there's a technical way to do it: you unplug the server hosting it (or more likely, your hosting provider does that for you). No court is going to shed any tears over fact this has wider consequences than if you'd been able to comply with a narrower takedown request.

There have been links to child porn in the Bitcoin blockchain. To date, this has not resulted in any courts preventing full nodes from running in the US.

Re: I've Just Liberated My Modules

#752

Post by trumbitta2 » Wed, Mar 23, 2016, 5:52 PM UTC

Trying to help with damage control: https://news.ycombinator.com/item?id=11346633

Re: I've Just Liberated My Modules

#753

Post by brazzledazzle » Wed, Mar 23, 2016, 5:55 PM UTC

acjohnson55 wrote: post #715

brazzledazzle wrote: post #492

Earlier quoted context omitted.

I'm curious since it strikes me as a hard problem to solve: How do you resolve having to deal with security issues with tens or hundreds of dependencies (and their dependencies)? How do you even know whether they have a security issue or a version bump is just a bug fix without digging into each one on a regular basis?

How do you know that you, as a lone developer, aren't writing insecure, unperformant, buggy code?

That's a fair point. But what would concern me, as a lone developer, is liability if you get hacked due to a known vulnerability in an npm module. If the company is looking for a head to roll and someone points out it was a known and resolved issue in later versions that could be a problem for me.

Does npm let you tag releases as security fixes? That would make automation to discover it possible.

Re: I've Just Liberated My Modules

#754

Post by jessaustin » Wed, Mar 23, 2016, 5:56 PM UTC

krakensden wrote: post #688

rboyd wrote: post #667

Earlier quoted context omitted.

This combined with the cost of hosting (I remember the ruby community freaking out over rubygems costs a couple years ago) makes me think maybe we're evolving towards decentralized dependency hosting. Something like Storj where users offset hosting fees with blockchain payments when dependencies are fetched.

The go solution seems more reasonable and achievable- the host is part of the namespace. Instant decentralization.

There's nothing preventing decentralization with npm now; it's a matter of configuration. Tying the namespace to a host seems more like instant excessive coupling.

Re: I've Just Liberated My Modules

#755

Post by monknomo » Wed, Mar 23, 2016, 6:00 PM UTC

drumstyx wrote: post #711

mc808 wrote: post #646

Earlier quoted context omitted.

> Now people will start wondering if a module with millions of installs in the last month is still going to exist tomorrow. That's a smart thing for people to wonder when there is a very real possibility that it won't. I'm not going to applaud the author's action here, which I consider reckless, but it did bring attention to how fragile this "essential" infrastructure really is.

It's not reasonable to be skeptical of every package. When you do that you get a mess of locally stored packages that end up out of date. Should really just be a 'publish is forever' mentality

It is absolutely reasonable to be skeptical of every package. You probably shouldn't be on the bleeding edge of packages and likely ought to have locally stored packages.

You of course need to audit and improve your local store, but you need to do that with your dependencies anyway

Re: I've Just Liberated My Modules

#756

Post by [deleted] » Wed, Mar 23, 2016, 6:06 PM UTC

ars wrote: post #719

akie wrote: post #550

Earlier quoted context omitted.

No offense, but that code is much more difficult to understand. If your goal is to minimize the amount of lines, then you succeeded. If the goal is to produce both correct and readable code, then there's room for improvement.

> No offense, but that code is much more difficult to understand. I strongly disagree. My code has no magic initializers (the -1 in the original) and a simple linear code path, with no branching. It's very easy to read and understand. The ternary operator at the top is simply read from left to right, it's not complicated. > If your goal is to minimize the amount of lines, then you succeeded. My goal was to maximize e…

[deleted]

Re: I've Just Liberated My Modules

#757

Post by kikcomms » Wed, Mar 23, 2016, 6:12 PM UTC

Hi everyone, please read this explanation from Kik's head of messenger about how this played out: https://medium.com/@mproberts/a-discussion-about-the-breakin...

We're sorry for our part in creating the impression that this was anything more than a polite request to use the Kik package name for an upcoming open source project.

Re: I've Just Liberated My Modules

#758

Post by brazzledazzle » Wed, Mar 23, 2016, 6:15 PM UTC

slang800 wrote: post #581

brazzledazzle wrote: post #489

Earlier quoted context omitted.

Would simply copying something into your project as small as 17 lines make for a good compromise?

No - then you won't get updates easily and everyone reading your project would have to make sure that your copy of the module hasn't diverged from the original module before working with it, especially if it's a larger module that has full documentation and a community of people who know how to work on it.

That's what I thought, but what concerns me with 100's or even 1000's of dependencies is managing them. Things like figuring out which ones have security issues without reading the issue tracker for each.

Re: I've Just Liberated My Modules

#759

Post by zackboe » Wed, Mar 23, 2016, 6:18 PM UTC

TimJRobinson wrote: post #670

Quick script to test if your project is using any of the modules he unpublished: for module in $(curl -s https://gist.githubusercontent.com/azer/db27417ee84b5f34a6ea/raw/50ab7ef26dbde2d4ea52318a3590af78b2a21162/gistfile1.txt); do grep "\"$module\"" package.json; done If any names appear you should replace them or force that specific version always (remove ~ or ^ before it). If nothing appears you're probably good.

Snyk added a 'test-unpublished' command to check all dependencies, but "is currently limited only to the packages Azer just unpublished, as opposed to all unpublished packages."

https://snyk.io/blog/testing-for-unpublished-packages/

Re: I've Just Liberated My Modules

#760

Post by gnaritas » Wed, Mar 23, 2016, 6:22 PM UTC

detaro wrote: post #110

gariany wrote: post #90

Earlier quoted context omitted.

+1 also US Trademark != the whole world. NPM should have handle this better!

US trademark is what's dangerous to NPM Inc., the US company running NPM. We don't know anything about how they "handled" it before it came to this, except that they did decide against the article author. What should they have done differently? It's not good that NPM-the-piece-of-infrastructure is vulnerable to this, maybe a registry like this shouldn't be under control of a single company, but we don't know enough t…

> What should they have done differently?

Not given them control over his code just because it had their name on it. They could have taken it down, but they didn't, they just gave some company ownership of his module, not cool.