Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Many packages suddenly disappeared

github.com

Post reply on HN
Print view View original

401–410 of 520 posts

Re: Many packages suddenly disappeared

#401

Post by yashap »

electric_sheep wrote: post #399
yashap wrote: post #357

Earlier quoted context omitted.

Were any of the deleted packages temporarily hijacked? It seems strongly like this was the case. If so, please confirm immediately so people who installed packages during this time can start scanning for malware. Even if the answer is “yes, 1+ packages were hijacked by not-the-original author, but we’re still investigating if there was malware”, tell people immediately. Don’t wait a few days for your investigation an…

I would also hope for and expect this to be communicated ASAP from the NPM org to its users. @seldo, I understand that you don't want to disseminate misleading info, but an abundance of caution seems warranted in this case as my understanding of the incident lines up with what @yashap has said. If we're wrong, straighten us out --- if we're not, please sound an advisory, because this is major.

Yeah, these were some core, widely used packages that were deleted. If they were temporarily hijacked, lots of dev machines (including mine) may have been compromised. There’s a major security risk here, if there was any hijacking now is not the timing for information hiding and PR.

Re: Many packages suddenly disappeared

#402

Post by smoyer »

aiiane wrote: post #369
smoyer wrote: post #363

Earlier quoted context omitted.

You must be one of those "dropped out of college and insisted on a founding CXX position COOs then? I'm glad I've stayed away from NodeJS and NPM.

That's entirely uncalled for.

Actually I'm doing him a favor ... I completely understand that people talk like that within companies. When emotions are involved, that's what happens. When you're acting in any capacity as a spokesperson for a company (or I guess a government or non-profit too), a bit more decorum is called for. It's not just him - I've been feeling this for a long time. One thing I appreciated about Obama was that he was always dignified (not that I always agreed with what he was saying). Now that the POTUS posts uncouth tweets, maybe it's okay to put statements like that in your SEC filings too.

I got down-voted for calling out some of Kalanick's frat-boy behavior and speech. I'm sure it's not popular on a site predominated by twenty-somethings but since I'm old, I'd prefer to be called old-fashioned or out-of-touch rather than simply being dismissed. If it helps ... I'm sorry that I was so blunt - I should have typed these couple of paragraphs instead.

Re: Many packages suddenly disappeared

#403

Post by peterwwillis »

You know, back in the "old days", we used to host packages on these sites called "mirrors", so when one went down, we could get the package from another, and verify authenticity using multiple sources and signed files. There would be hundreds of mirrors for one set of files.

Kind of funny how shitty modern technology is. But I heard a quote recently that kind of explains it: "The more sophisticated something is, the easier it is to break it."

Re: Many packages suddenly disappeared

#405

Post by alrs »

hateduser2 wrote: post #84
ris wrote: post #52

Earlier quoted context omitted.

Already counting down the days before yarn is considered old and broken and people are recommending switching to the next hot package manager/bundler...

It badfles me that technologists commonly complain about new technology. As far as I can tell your complaint boils down to “people should stop making and switching to new things”.. I find it hard to understand why someone with this attitude would be a technologist of any kind, and I find the attitude really obnoxious.

Technologists value "good", not "new." Sifting through all the "new" to find "better" is fun, so long as expectations are properly tempered.

Re: Many packages suddenly disappeared

#406

Post by christophilus »

notatoad wrote: post #106
lioeters wrote: post #89

Earlier quoted context omitted.

As a counterpoint, couldn't any sufficiently complex structure be called a hack and a house of cards, when you really dig down into how it's put together? Mm, maybe not any - as some complex systems are well-tested with solid architecture - but just some, or most..

A "house of cards" implies that you don't have to dig to topple it. If you have to really dig down into how it's put together in order to start pulling it apart it isn't really a house of cards. I don't use npm or node for anything serious, and i don't really have any knowledge of how NPM works, but this isn't the first time i've read this story of a whole bunch of packages disappearing and everybody's builds breakin…

I can't speak for PyPI, but I know Ruby gems has had vulnerabilities in the past. A quick DuckDuckGo will probably suffice to demonstrate that. I'm not saying NPM is a great system, but it does seem to me that most systems have flaws, and any system that is as heavily used as NPM is likely to have them surface faster than other systems.

Re: Many packages suddenly disappeared

#407

Post by christophilus »

hoistbypetard wrote: post #324
nawgszy wrote: post #256

Earlier quoted context omitted.

>these people need [their package manager] and [their source code management tool] to deploy? Seriously? Not really sure I understand what you're implying there

I'm not the poster you're replying to, but I think I understand it. npm is not just their package management tool... the way most people use it, it depends on someone else's package registry/repository to deploy to your own servers. And github is someone else's source code management tool/server. As a matter of policy, if I can't have something on my own server (or one my org controls) I don't get to rely on it to de…

Yeah. I've been on both sides of this coin. If I'm deploying cloud software (which I am, these days), then I have no problem relying on cloud software to make that deployment smoother. But if I ever go back to writing native applications, I sure as hell won't be reliant on the internet in order to manage intranet deployments. These are two different paradigms, and what works well in one doesn't make any sense in the other.

Re: Many packages suddenly disappeared

#408

Post by christophilus »

peterwwillis wrote: post #403

You know, back in the "old days", we used to host packages on these sites called "mirrors", so when one went down, we could get the package from another, and verify authenticity using multiple sources and signed files. There would be hundreds of mirrors for one set of files. Kind of funny how shitty modern technology is. But I heard a quote recently that kind of explains it: "The more sophisticated something is, the…

Yup. That's a good solution. P2P would probably be a decent solution, too-- bit torrent or block chain or whatever variant.

Re: Many packages suddenly disappeared

#409

Post by 112233 »

shawn wrote: post #48
shrimp_emoji wrote: post #29

Earlier quoted context omitted.

Does "stalinist" work?

Dunno, but it's quite hard to resist childish urges. I note that "jew" is still available, and .jew is a perfectly valid extension which no program has ever claimed. I love all cultures. There's something worth learning from each of them, if you try. But emergent social dynamics are deeply interesting too: I get it (everyone does), and it makes perfect sense. Yet we've all collectively agreed that those are unwholeso…

> I've often wondered whether foreign users ever get annoyed with some of our names that happen to acronym to something unfortunate in their native language. Do they just have to live with it, or does it never happen?

All the time, and the response from devs ... depends. Remember the recent Pik image format? Or Pidora linux, which to a russian ear sound akin to "FedoPiLix"? Or Vista, which is exactly "chicken" in latvian?

Mostly you kind of keep laughing and wincing for a few years, then you sorta get used to it.

Re: Many packages suddenly disappeared

#410

Post by christophilus »

danjoc wrote: post #325
seldo wrote: post #291

Earlier quoted context omitted.

Absofuckinglutely. It's being done as we speak.

Good luck explaining this https://news.ycombinator.com/item?id=16087079 in the face of this https://news.ycombinator.com/item?id=14905870 Literally nothing was done for 158 days. You yourself asked: https://github.com/node-forward/discussions/issues/29#issuec... "How would package signing prevent people from requesting the wrong package? The malware author could also sign their package." And here is a perfect example…

Yup. Publishing to Clojars requires GPG and is a bit of a pain compared to publishing to NPM. I'd take Clojar's approach any day of the week to this nonsense, though.
Post reply on HN