In my org, we use Artifactory as a cache between us and external sources. They have a free version too. I'd encourage everyone to use it, or something like it. Stop pointing your package managers to the public registry.
Many packages suddenly disappeared
71–80 of 520 posts
Re: Many packages suddenly disappeared
#72Well, the packages seem to be all from floatdrop[0].
Re: Many packages suddenly disappeared
#73Earlier quoted context omitted.
You run a private NPM mirror where you copy dependencies that you rely on, after auditing them (for code quality and licensing).
Wouldn't just pinning the hash of a package be a better solution?
That’s probably fine from the security perspective, but the hash won’t make the package re-appear if it disappears out of nowhere. That’s the other benefit of a private/on-premesis mirror.
Re: Many packages suddenly disappeared
#74NPM is extremely vulnerable to typosquatting. Be cautious with what you install. The install scripts can execute arbitrary code. NPM's team response is that they hope that malicious actor won't exploit this behaviour. According to my tests, typosquatting 3 popular packages allows to take over around 200 computers in 2 weeks time it takes their moderators to notice it.
this is not a response? http://blog.npmjs.org/post/168978377570/new-package-moniker-...
Why assume they’ve already seen it? They probably just haven’t
Re: Many packages suddenly disappeared
#75Can't help but wonder if committing node_modules to your repo is now a good idea...
Re: Many packages suddenly disappeared
#76Gah. Moments like these always gives me a bit of panic, since I realize that so much of my software relies on external sources. Relying on npm, Atlassian/GitHub etc really hurts when stuff like this happens. Issues always gets resolved, but cases such as the GitLab incident should be enough to always keep some local copies around.
Why would you allow that to happen?
I don't think there is any part of my little software empire that is dependant on code for which I don't have the source or underlying .dll checked into source control.
It's part of your project. You absolutely need a copy of it.
Re: Many packages suddenly disappeared
#77Earlier quoted context omitted.
You can setup mirrors for dockerhub... Or any docker registry. You also can require image signing such that if an image is signed by an untrusted party it will fail.
> You can setup mirrors for dockerhub... Or any docker registry. But you can't make dockerd talk to this mirror by default, unless you're running the fossil Redhat fork. That is the problem: if you want to use Docker, you must open up your server to the Internet, and the entire Internet at it as the Docker infrastructure is loadbalanced and there are no guarantees the IPs will stay stable.
Yes you can, that's the purpose of the mirror. To do this you set the "--registry-mirror" option on the daemon.
The RH fork doesn't let you do mirrors, it let's you change the default registry, this is very different.
Re: Many packages suddenly disappeared
#78How are these going, by the way?
- https://github.com/elsehow/gx-js
- https://github.com/ipmjs/ipmjs
Re: Many packages suddenly disappeared
#79Earlier quoted context omitted.
didn't npm make some changes where a published package name cannot be republished, at least not without npm intervention?
Yes, but the packages disappeared . That people can dupe these suggests that the database was modified.
yeah it looks like one user's packages just disappeared from their database.
Re: Many packages suddenly disappeared
#80I never understood the love for package managers that directly hook and import things into your codebase or repo or even worse servers. I guess the benefit is that "it just works", but the fact that you do not know where a package is coming from can't be worrying just me. In my company we take the stable version of the library we want to use and we self-host it. We basically have added a cache that we manage and cont…
> "I never understood the love for package managers that directly hook and import things into your codebase or repo or even worse servers. I guess the benefit is that "it just works", but the fact that you do not know where a package is coming from can't be worrying just me."
I share your concern. It's a tradeoff: tools that do this are very convenient, and the people who have thought about it have decided in some cases that convenience outweighs the security or stability aspects. And people can make that determination on a case-by-case basis.