Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Many packages suddenly disappeared

github.com

Post reply on HN
Print view View original

351–360 of 520 posts

Re: Many packages suddenly disappeared

#351

Post by edejong »

johnny22 wrote: post #247
edejong wrote: post #144

Earlier quoted context omitted.

I am very surprised that a package manager of this calibre and impact abstains from best practices when it comes to authentication through code-signing. Other package managers are miles ahead of NPM. For example, Nix, which uses immutability and hashing to always produce the same artifact, regardless of changes of the sources.

comparing distro package managers is a ton different than free for all spaces like packagist, ruby gems, pypi, npm, etc.

You have a point, but we need to take into account that the technology has been around for a long time, the risks are well known and documented, and safety concerns of most of these package managers have been addressed to maintainers.

The example in the article has come to light accidentally, but we must seriously ask ourselves how many incidents are currently unidentified.

Besides, you can use Nix for 'normal' development. It is suitable for more things than just a distro package manager.

Re: Many packages suddenly disappeared

#352

Post by sandworm101 »

danso wrote: post #227
rubyn00bie wrote: post #158

Earlier quoted context omitted.

I’m pretty sure they’re referencing the Byrds song and not the Bible directly: https://m.youtube.com/watch?feature=youtu.be&v=pKP4cfU28vM

No. The Byrds song, which is itself an excerpt/phrase of Ecclesiastes, does not have phrases like " and a time to pluck up that which is planted "

Because the bible version isnt subject to copyright takedowns.

Re: Many packages suddenly disappeared

#353

Post by zbentley »

DougWebb wrote: post #229
sergiotapia wrote: post #9

Yikes, what is it about node/npm/javascript that makes it feel like a house of cards?

Yikes, what is it about node/npm/javascript that makes it feel like a house of cards? I think the (short) answer is "node, npm, and javascript". The longer answer has something to do with the automatic installation of dependencies, and the common use of shell scripts downloaded directly off the internet and executed using the developer's or sysadmin's user account. I used to use CPAN all the time. CPAN would check de…

> CPAN... forced you to be aware of what you're installing

I think CPAN is pretty sweet for variety/wide reach of packages available, but this is flat-out wrong.

CPAN is not a package manager; it is a file sprayer/script runner with a goal of dependency installation. That's perfectly sufficient for a lot of use cases, but to me "package manager" means "program that manages packages of software on my system", not the equivalent of "curl cpan.org/whatever | sh".

CPAN packages can (and do by very common convention) spray files all over the place on the target system. Then, those files are usually not tracked in a central place, so packages can't be uninstalled, packages that clobber other packages' files can't be detected, and "where did this file come from?"-type questions cannot be answered.

Whether CPAN or NPM "force you to be aware of what you're installing" seems like the least significant difference between the tools. When NPM tells you "I installed package 'foo'", it almost always means that the only changes it made to your system were in the "node_modules/foo" folder, global or not. When CPAN tells you "I installed package 'foo'" it means "I ran an install script that might have done anything that someone named 'foo'; hope that script gave you some verbose output and told you everything it was doing! Good luck removing/undoing its changes if you decide you don't want that package!"

There are ways around all of those issues with CPAN, and plenty of tools in Perl distribution utilities to address them, but they are far from universally taken advantage of. CPAN is extremely unlike, and often inferior to, NPM. Imagine if NPM packages did all of their installation logic inside a post-install hook; that's more like a CPAN distribution.

Re: Many packages suddenly disappeared

#354

Post by [deleted] »

scrollaway wrote: post #159
ris wrote: post #52

Earlier quoted context omitted.

Already counting down the days before yarn is considered old and broken and people are recommending switching to the next hot package manager/bundler...

yarn is one of those things coming out of the JS world that is actually really well made. yarn, typescript, react; say what you want about js fatigue, these are rock-solid, well-tested projects that are really good at what they do. A major reason for the high toolchurn in that ecosystem is how many of those tools are not designed from the ground up, don't quite solve the things they ought to, or solve them in really…

[deleted]

Re: Many packages suddenly disappeared

#355

Post by abritinthebay »

megaman22 wrote: post #293
borntyping wrote: post #278

Earlier quoted context omitted.

The npm repository is the largest package repository in the world. A lot of the major incidents they've could have happened to other ecosystems (e.g. PyPi allows a user to delete packages that other packages depend on), but they've either not happened or haven't had as large an impact. When npm breaks, everyone notices, because everyone either uses npm or knows someone who does.

Largely because Javacsript is so broken by default that it is almost required to depend on a whole slew of dependencies for functionality other languages contain in their built-in standard libraries. And furthermore, NPM dependencies are broken down into stupidly small units, versioned rapidly, and enforces very little consistency among transitive dependencies. Other languages and package management systems don't enc…

I’m impressed. Not one thing you just said is accurate.

Re: Many packages suddenly disappeared

#356

Post by MagicWishMonkey »

zbentley wrote: post #345
MagicWishMonkey wrote: post #318

Earlier quoted context omitted.

Wouldn't you need to install those packages as root for the code to have privileges to take advantage of that exploit?

No. Packages would not need to be installed as root. Additionally, many possible ways to use the exploit in GP could run as unprivileged users.

Wouldn't the package need to be executed as root, though? Or does spectre/meltdown not require privileged access?

Re: Many packages suddenly disappeared

#357

Post by yashap »

seldo wrote: post #268

Hi folks, npm COO here. This was an operational issue that we worked to correct. All packages are now restored: https://status.npmjs.org/incidents/41zfb8qpvrdj

Were any of the deleted packages temporarily hijacked? It seems strongly like this was the case. If so, please confirm immediately so people who installed packages during this time can start scanning for malware.

Even if the answer is “yes, 1+ packages were hijacked by not-the-original author, but we’re still investigating if there was malware”, tell people immediately. Don’t wait a few days for your investigation and post mortem if it’s possible that some users’ systems have already been compromised.

Re: Many packages suddenly disappeared

#358

Post by abritinthebay »

foepys wrote: post #50
sergiotapia wrote: post #9

Yikes, what is it about node/npm/javascript that makes it feel like a house of cards?

I have recently taken over an Angular project (with a C# backend, thankfully) at my job. It took two hours to get it to even compile correctly because some dependencies were apparently outdated in package.json and it just ran on the other dev's machine by accident. I don't understand why I need over 100 dependencies for a simple Angular Single Page App that pulls JSON from the backend and pushes JSON back. Meanwhile,…

You are describing bad development practices.

Not sure why you’re stuck on the number of deps either - as long as they’re small who cares?

Re: Many packages suddenly disappeared

#359

Post by mikestew »

sandworm101 wrote: post #352
danso wrote: post #227

Earlier quoted context omitted.

No. The Byrds song, which is itself an excerpt/phrase of Ecclesiastes, does not have phrases like " and a time to pluck up that which is planted "

Because the bible version isnt subject to copyright takedowns.

Start posting large parts of, say, the New International Version, let me know how that goes for you.

IOW, unless it’s the King James, it is likely very much subject to take down notices. Though I’m guessing a malicious troll is much more likely to know The Byrds than they are Old Testament.

Re: Many packages suddenly disappeared

#360

Post by abritinthebay »

marcosdumay wrote: post #273
newfoundglory wrote: post #189

Earlier quoted context omitted.

The basic explanation is that the dependencies for the angular app are much smaller, but I’m not sure which bit is confusing you. You don’t understand why an incorrectly written program required work to run when a bigger but correctly written program was easy?

> incorrectly written program In principle programs shouldn't stop working just because they are old. Yes, no language completely realize this. But there's a world of difference between C's "it was written only 40 years ago, why did compilers break it?" to Python's "yes, you are expected to review your code every 3 or 4 years", and there is another world of difference to the faster Javascript frameworks that practice…

No JS framework does that because they version things. Run the same versions and it works.

If you’re not pinning versions correctly that’s hardly JS’s fault.

Post reply on HN