Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Many packages suddenly disappeared

github.com

Post reply on HN
Print view View original

331–340 of 520 posts

Re: Many packages suddenly disappeared

#331

Post by rmrfrmrf »

Silhouette wrote: post #246
rmrfrmrf wrote: post #181

Earlier quoted context omitted.

I suspected that someone would mention this, but the fact of the matter is both systems are mostly interoperable. The switch from npm to yarn would be nothing like migrating from Gulp + Browserify to Webpack. To switch to yarn, I printed out a one-page cheat sheet and taped it to my wall. I’ve had one blunder in the time I’ve used it (misunderstanding what `yarn upgrade` did x_x), but it was easily reverted.

I think you're making TeMPOraL's point, though. Even in this relatively close case, it's not a zero-overhead transition. There are some changes. There are some new behaviours. You still need to know which things really work exactly the same and where the differences come from even if those differences are only minor. You always need due diligence about whether a new tool is reliable, future-proof, trustworthy, etc. A…

Right, and that non-zero overhead is part of being a software developer.

It’s also laughable that npm is accused of being a hack and yarn is accused of being over-engineered.

Re: Many packages suddenly disappeared

#332

Post by sillysaurus3 »

danjoc wrote: post #325
seldo wrote: post #291

Earlier quoted context omitted.

Absofuckinglutely. It's being done as we speak.

Good luck explaining this https://news.ycombinator.com/item?id=16087079 in the face of this https://news.ycombinator.com/item?id=14905870 Literally nothing was done for 158 days. You yourself asked: https://github.com/node-forward/discussions/issues/29#issuec... "How would package signing prevent people from requesting the wrong package? The malware author could also sign their package." And here is a perfect example…

You're taking flak for this, but you're right.

When I was doing pentesting, we had an interesting assignment. Our job was to pop a dev project. Then we'd tell them how to secure themselves.

One of our tactics was to set up fake Github profiles with very similar names, then try to get someone internal to the team to `git clone` and run our code. Boom, remote shell.

We didn't execute the plan. But it was thrown around as an idea.

When a package on npm can disappear, and a new package can appear in its place at a later version, by a different author, and there is no connection between those two people, then you're in a bad situation. Just because no one currently runs attacks like this doesn't mean you'll be safe forever. It's worth getting ahead of this.

I don't know whether package signing is the best solution. Maybe yes, maybe no. But the question is, if a package vanishes, what is the proper action to take?

The solution seems like a rollback. Let us have the latest previous version from the same author, by default. That will fix the builds and not require any heavyweight changes.

But package signing would definitely be nice, if it can be integrated in a lightweight and chaos-free fashion.

Re: Many packages suddenly disappeared

#333

Post by prh8 »

As someone unfamiliar with NPM, why does it not lock package names for a certain period of time? Rubygems has a 90 day period, so if a package is completely removed, the name can't be used for that long. That seems like it would help with the security side of these problems.

Re: Many packages suddenly disappeared

#334

Post by rmrfrmrf »

TeMPOraL wrote: post #223
rmrfrmrf wrote: post #145

Earlier quoted context omitted.

It’s a drop-in replacement CLI tool. Let’s not be dramatic.

The problem isn't with that one tool alone. The problem is with the entire ecosystem, in which all the tools get regularly replaced by "better" ones. It all adds up.

To be precise, new tools are continuously created to address the weaknesses of other tools. This happens in other languages, just more slowly due to smaller community sizes.

Re: Many packages suddenly disappeared

#335

Post by hateduser2 »

rootlocus wrote: post #232
hateduser2 wrote: post #84

Earlier quoted context omitted.

It badfles me that technologists commonly complain about new technology. As far as I can tell your complaint boils down to “people should stop making and switching to new things”.. I find it hard to understand why someone with this attitude would be a technologist of any kind, and I find the attitude really obnoxious.

https://xkcd.com/927/

I’ve seen this.

Re: Many packages suddenly disappeared

#336

Post by [deleted] »

ioquatix wrote: post #235
maxander wrote: post #121

Earlier quoted context omitted.

And all this is happening just as after the public release of a serious exploit which allows malicious code to do all sorts of nefarious things when it is somehow installed on the target machine . Hmm. Given that there's hints, at least, that the problems were caused by some particular developer's actions, I wonder about the security model for package-managed platforms altogether now. If I were a big cybercrime ring,…

You could sign packages and record their signatures along with the version. Which, coincidentally, is basically what https://teapot.nz does, e.g.: https://github.com/kurocha/geometry/blob/master/development-... Although, I've never considered this in the case of an actual attack. It would make sense to actually fingerprint the entire source tree and record this too somewhere, so when you build it you know you are get…

[deleted]

Re: Many packages suddenly disappeared

#337

Post by nnutter »

seldo wrote: post #268

Hi folks, npm COO here. This was an operational issue that we worked to correct. All packages are now restored: https://status.npmjs.org/incidents/41zfb8qpvrdj

Seems like you should have froze publishing instead of saying, "Please do not attempt to republish packages, as this will hinder our progress in restoring them." Especially, to prevent, even temporary, hijacking.

Re: Many packages suddenly disappeared

#338

Post by ytpete »

maxander wrote: post #121
racbart wrote: post #5

PSA: Please be cautious because this is an excellent opportunity for taking over packages and injecting malware by malicious people. Example: https://www.npmjs.com/package/duplexer3 which has 4M monthly downloads just reappeared, published by a fresh npm user. They published another two versions since then, so it's possible they've initially republished unchanged package, but now are messing with the code. Previously…

And all this is happening just as after the public release of a serious exploit which allows malicious code to do all sorts of nefarious things when it is somehow installed on the target machine . Hmm. Given that there's hints, at least, that the problems were caused by some particular developer's actions, I wonder about the security model for package-managed platforms altogether now. If I were a big cybercrime ring,…

With cases like the current one, or the leftpad incident in 2016, I'm surprised package registries still allow recycling old package names after a package was deleted. Really seems like deleted packages should be frozen forever - if the original author never recreates it or transfers ownership, then people would have to explicitly choose to move to some new fork with a new id.

But your point about pressuring or bribing package authors still stands as a scary issue. Similar things have already happened: for example, Kite quietly buying code-editor plugins from their original authors and then adding code some consider spyware (see https://news.ycombinator.com/item?id=14902630). I believe there were cases where a similar thing happened with some Chrome extensions too...

Re: Many packages suddenly disappeared

#339

Post by StavrosK »

tomjakubowski wrote: post #73
StavrosK wrote: post #49

Earlier quoted context omitted.

Wouldn't just pinning the hash of a package be a better solution?

That’s probably fine from the security perspective, but the hash won’t make the package re-appear if it disappears out of nowhere. That’s the other benefit of a private/on-premesis mirror.

True. I work with PyPI and it's been extremely solid for years, so we tend to just not consider this a problem at all. Pipenv stores hashes for each package version as well, so you get the security aspect built in.

Pipenv has pretty much fixed Python packaging/dependencies, in my opinion. It's the all-in-one tool I've always wanted. If you do any Python work, try it, it's great.

Re: Many packages suddenly disappeared

#340

Post by brown9-2 »

tomjakubowski wrote: post #82
izacus wrote: post #61

Hmm, I Java world we pretty much always used a local (company-owned) Maven proxy server, which grabbed packages from public repos and cached them locally to make sure builds still work if public servers were down or slow... or packages disappeared. This isn't a standard practice in JS world?

I’ve worked at places where the Java devs used Maven Central directly. I’ve also worked at a place where the Node devs use an on-premises copy of dependencies for builds and deploys. It might not be as standard a practice in the Java world as you think.

Where did those Java devs who pulled from Maven central directly publish their artifacts?
Post reply on HN