Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

821–827 of 827 posts

Re: I've Just Liberated My Modules

#821

Post by julie1 »

awolden wrote: post #734
julie1 wrote: post #465

The number of coders complaining about an author exercising the basic of intellectual property rights is too high. 1) all coders should understand authors right be the code free or closed; 2) there is no excuse for someone whose value is based on creativity to ignore how IP works (the good and the bad part) because our comfortable incomes come from the protection these rights gives to our work 3) if your code is brok…

> 3) if your code is broken for 11 sloc, maybe you depend too much on others work and you have no value yourselves. That is very out of touch with the reality of development on the modern JS stack. Babel is a key transpiler that allows people to target multiple browsers with consistent JS, and it was completely broken by this move. Are you suggesting that everyone rewrite their own babel? I guess if they don't they h…

I worked in ad industry. We had are own 3k lib with code inspired by jquery to deal with that problem of "fixing the browsers incompatibility", because vanilla JS does ,not exists when DOM/browser functionalities are added to the equation.

I learned to use CSS without framework, and it helps a lot both writing efficient CSS selector and fast loading HTML that is reactive ... and maintainable easy to fix/deploy CSS. Once you learned it.

Yes I suggest that it can be done. But I cannot do it anymore because no modern coders want to learn all that. Thus my CTO, and colleagues always complained that it should not be done this way.

Well ... I used to complain to much dependency is fragile, vulnerable and they say, let us follow the hurd.

I say, your code is expensive to write, maintain, support.

They said no. Else we find no one, and no one wants to learn this ol' shit.

Look where we are today?

The mass can be wrong I guess. Being right makes you jobless but at least when the bubble will explode I will be valuable again. And I will make people pay a lot for my skills of having no skills in babel, angular 2, react ...

Less is more. Especially for a backend coder.

Re: I've Just Liberated My Modules

#822

Post by alphapapa »

ngrilly wrote: post #578
throweway wrote: post #272

Earlier quoted context omitted.

Signing using private key?

There is no need to sign. Just keep a cryptographic hash (SHA256 is a good bet) of the package in the dependencies manifest, and check it after download. Using a git repository gives you that for free.

Attacker changes package, then changes hash in manifest to match. Checks pass, users are compromised.

Attacker clones git repo, creates new commit with trojan, pushes to repo with compromised credentials. New users clone compromised repo, others pull and fast-forward. All hashes are valid.

You need to read the Strong Distribution HOWTO: http://www.cryptnet.net/fdp/crypto/strong_distro.html

Re: I've Just Liberated My Modules

#823

Post by spinlock »

smt88 wrote: post #412
spinlock wrote: post #400

Earlier quoted context omitted.

facebook may be a bad example. they named themselves after a generic directory that many colleges have been giving out for decades.

See also: YellowPages.com, Salesforce.com, etc. Just because something exists in real life (and used to describe a non-digital version of the same thing) doesn't mean it can't then be trademarked.

Sum had to change the name of its yellow pages application to nis because yellow pages is copy righted.

You don't seem to be very well informed.

Re: I've Just Liberated My Modules

#824

Post by gengkev »

jwiley wrote: post #123

I think that unfortunately this was a foregone conclusion. Copyright law, like most other laws in our society, favor corporate interests. I support his stand on principal, however. Azer is a talented developer and has an impressive life story, and has certainly contributed more to society than a social network well know for invading children's privacy. https://medium.com/@azerbike/i-owe-my-career-to-an-iraqi-imm... h…

did you see how he responded to Kik's request? https://medium.com/@mproberts/a-discussion-about-the-breakin...

Re: I've Just Liberated My Modules

#825

Post by ngrilly »

alphapapa wrote: post #822
ngrilly wrote: post #578

Earlier quoted context omitted.

There is no need to sign. Just keep a cryptographic hash (SHA256 is a good bet) of the package in the dependencies manifest, and check it after download. Using a git repository gives you that for free.

Attacker changes package, then changes hash in manifest to match. Checks pass, users are compromised. Attacker clones git repo, creates new commit with trojan, pushes to repo with compromised credentials. New users clone compromised repo, others pull and fast-forward. All hashes are valid. You need to read the Strong Distribution HOWTO: http://www.cryptnet.net/fdp/crypto/strong_distro.html

I don't get it. If I keep a hash of every dependency in my project, and an attacker change a dependency, I will detect the attack by computing the dependency hash and comparing it with the one stored in my project (for example in the dependencies lock file), which cannot be changed by the attacker.

Re: I've Just Liberated My Modules

#826

Post by karmelapple »

esailija wrote: post #491
karmelapple wrote: post #471

Earlier quoted context omitted.

If someone already wrote the base code, we can always fork it and fix a bug or add a feature ourselves if it runs contrary to what the original authors desires.

Even getting a response just so you can know what the original author desires can take a long time and there is no warranties or guarantees that you will even get any response. To me, all the downsides that come with dependencies are not even close to worth it for saving 15 seconds.

Who cares what the original author desires?

If you fixed the bad behavior you're experiencing, and the original author's effort saved you hours or days of coding, what's the downside?

Perhaps I'm not arguing for 15 second long code changes. But other than typing a single if statement, what takes literally less than one minute to securely change in any partially-complex project?

Re: I've Just Liberated My Modules

#827

Post by alphapapa »

ngrilly wrote: post #825
alphapapa wrote: post #822

Earlier quoted context omitted.

Attacker changes package, then changes hash in manifest to match. Checks pass, users are compromised. Attacker clones git repo, creates new commit with trojan, pushes to repo with compromised credentials. New users clone compromised repo, others pull and fast-forward. All hashes are valid. You need to read the Strong Distribution HOWTO: http://www.cryptnet.net/fdp/crypto/strong_distro.html

I don't get it. If I keep a hash of every dependency in my project, and an attacker change a dependency, I will detect the attack by computing the dependency hash and comparing it with the one stored in my project (for example in the dependencies lock file), which cannot be changed by the attacker.

> ...which cannot be changed by the attacker.

That's fine on your personal system, where you manually update your package's dependencies and manually update the hashes of your package's dependencies.

Now, what happens if an attacker compromises the repo where people download your package from? Or what if he executes a MitM attack on the repo or a user who downloads from it? He can change the entire package, including all manifests, all hashes, etc. Users who download it will be none the wiser. By the time someone notices and corrects it, people will have downloaded the compromised versions and be infected.

The only thing that protects against this is strong crypto signatures. For example, if a Debian mirror were compromised and an attacker uploaded compromised packages, users would be safe, because apt would refuse to install the packages, because they would fail signature verification.

Please read the link I gave. It explains everything in detail.

Post reply on HN