Many packages suddenly disappeared • Hacker News Board

Re: Many packages suddenly disappeared

#191

Post by foepys » Sat, Jan 06, 2018, 9:46 PM UTC

tgtweak wrote: post #168

foepys wrote: post #50

Earlier quoted context omitted.

I have recently taken over an Angular project (with a C# backend, thankfully) at my job. It took two hours to get it to even compile correctly because some dependencies were apparently outdated in package.json and it just ran on the other dev's machine by accident. I don't understand why I need over 100 dependencies for a simple Angular Single Page App that pulls JSON from the backend and pushes JSON back. Meanwhile,…

Does that backend use nuget for dependencies?

No. It needs nothing but the .NET Framework (not .NET Core) because .NET is already providing everything we need.

Re: Many packages suddenly disappeared

#192

Post by TeMPOraL » Sat, Jan 06, 2018, 9:47 PM UTC

rootlocus wrote: post #167

> I was here. > We made history! Fastest issue to reach 1000 comments, in just 2 hours. > cheers everyone, nice chatting with you. 17 away from hitting 1000 btw! > Is GitHub going to die with the volume of comments? Kind of disappointed the NPM community is turning github into reddit right now.

There's probably a large overlap between the two communities.

Re: Many packages suddenly disappeared

#193

Post by gkya » Sat, Jan 06, 2018, 9:47 PM UTC

shawn wrote: post #48

shrimp_emoji wrote: post #29

Earlier quoted context omitted.

Does "stalinist" work?

Dunno, but it's quite hard to resist childish urges. I note that "jew" is still available, and .jew is a perfectly valid extension which no program has ever claimed. I love all cultures. There's something worth learning from each of them, if you try. But emergent social dynamics are deeply interesting too: I get it (everyone does), and it makes perfect sense. Yet we've all collectively agreed that those are unwholeso…

> Yet this is all very English-centric. I've often wondered whether foreign users ever get annoyed with some of our names that happen to acronym to something unfortunate in their native language. Do they just have to live with it, or does it never happen?

Well we have to live with it, and funny things happen. In Turkish, which is my mother tongue, the English word Scheme sounds very similar to "sikim", which is a very vulgar way to say "my dick". About five years ago having lunch with colleagues (programmers), chattering about programming languages, when I said I liked Scheme, I had some weird looks :) Some more on this: https://news.ycombinator.com/item?id=7421315

Re: Many packages suddenly disappeared

#194

Post by eric_h » Sat, Jan 06, 2018, 9:49 PM UTC

csdreamer7 wrote: post #126

racbart wrote: post #5

PSA: Please be cautious because this is an excellent opportunity for taking over packages and injecting malware by malicious people. Example: https://www.npmjs.com/package/duplexer3 which has 4M monthly downloads just reappeared, published by a fresh npm user. They published another two versions since then, so it's possible they've initially republished unchanged package, but now are messing with the code. Previously…

How does RubyGems handle a package being removed and replaced by a different (and maybe malicious) actor? Not allow a package to be deleted? Block the package name from being claimed by someone else?

From http://help.rubygems.org/kb/gemcutter/removing-a-published-r...:

> Once you've yanked all versions of a gem, anyone can push onto that same gem namespace and effectively take it over. This way, we kind of automate the process of taking over old gem namespaces.

Re: Many packages suddenly disappeared

#195

Post by newfoundglory » Sat, Jan 06, 2018, 9:49 PM UTC

paultopia wrote: post #184

Stupid question from non-pro here: everyone's always like "never commit libraries into source control." But, um, this kinda thing?

This kinda thing is dealt with by artifact storing and caching, not source control.

Re: Many packages suddenly disappeared

#196

Post by sublimino » Sat, Jan 06, 2018, 9:49 PM UTC

Apparently the restore is now complete:

https://github.com/npm/registry/issues/255#issuecomment-3557...

Re: Many packages suddenly disappeared

#197

Post by ilaksh » Sat, Jan 06, 2018, 9:50 PM UTC

tetha wrote: post #59

antonkm wrote: post #17

Gah. Moments like these always gives me a bit of panic, since I realize that so much of my software relies on external sources. Relying on npm, Atlassian/GitHub etc really hurts when stuff like this happens. Issues always gets resolved, but cases such as the GitLab incident should be enough to always keep some local copies around.

I've stopped wondering about NPMs structure. But still: Our bog-standard in-house java development setup would be unaffected by this class of problems. You need some kind of private maven repository, and nexus or artifactory automatically mirrors downloaded dependencies. And on top of that, versions are pinned per default. So new malicious versions wouldn't be used either. We could safely build new hotfix releases ev…

npm does pin versions by default (although originally they did not). The fact that you _need_ to have a local mirror for Maven isn't really a plus for Java. You can get a local mirror or similar setup for npm also.

Re: Many packages suddenly disappeared

#198

Post by djsumdog » Sat, Jan 06, 2018, 9:50 PM UTC

edejong wrote: post #144

no29 wrote: post #101

Earlier quoted context omitted.

maybe it's time to push for adding signed packages to npm long discussion here: https://github.com/node-forward/discussions/issues/29

I am very surprised that a package manager of this calibre and impact abstains from best practices when it comes to authentication through code-signing. Other package managers are miles ahead of NPM. For example, Nix, which uses immutability and hashing to always produce the same artifact, regardless of changes of the sources.

So I know rpms and debs are signed, as I've setup repos for both. Docker repositories require a valid SSL key (or you have to manually allow untrusted repos). But do Python packages and Ruby gems have signature verification? How does pypy/pip and gem deal with validating a package is what it claims to be?

Re: Many packages suddenly disappeared

#199

Post by ownagefool » Sat, Jan 06, 2018, 9:51 PM UTC

mschuster91 wrote: post #67

cpuguy83 wrote: post #54

Earlier quoted context omitted.

You can setup mirrors for dockerhub... Or any docker registry. You also can require image signing such that if an image is signed by an untrusted party it will fail.

> You can setup mirrors for dockerhub... Or any docker registry. But you can't make dockerd talk to this mirror by default, unless you're running the fossil Redhat fork. That is the problem: if you want to use Docker, you must open up your server to the Internet, and the entire Internet at it as the Docker infrastructure is loadbalanced and there are no guarantees the IPs will stay stable.

Just to re-iterate, docker supports mirrors as my sibling poster suggested. :)

Re: Many packages suddenly disappeared

#200

Post by _Marak_ » Sat, Jan 06, 2018, 9:51 PM UTC

8n4vidtmkvmk wrote: post #175

_Marak_ wrote: post #129

We really need to hear from NPM why this happened. There is currently no way for a user to remove their own packages or unpublish packages anymore from the public NPM API ( a change following the `left-pad` incident ). This leads me to believe this was an internal NPM error. My guess is employee error.

Whaaa...? I swear I used `npm unpublish` several times in the past year. Yeah, it definitely exists: https://docs.npmjs.com/cli/unpublish

Only for a version less than 24 hours old. You can no longer remove established packages.

A quote from the documentation page you linked:

> With the default registry (registry.npmjs.org), unpublish is only allowed with versions published in the last 24 hours. If you are trying to unpublish a version published longer ago than that, contact support@npmjs.com.