Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Many packages suddenly disappeared

github.com

Post reply on HN
Print view View original

441–450 of 520 posts

Re: Many packages suddenly disappeared

#441

Post by TeMPOraL »

rmrfrmrf wrote: post #334
TeMPOraL wrote: post #223

Earlier quoted context omitted.

The problem isn't with that one tool alone. The problem is with the entire ecosystem, in which all the tools get regularly replaced by "better" ones. It all adds up.

To be precise, new tools are continuously created to address the weaknesses of other tools. This happens in other languages, just more slowly due to smaller community sizes.

"new tools are continuously created to address the weaknesses of other tools, instead of fixing those weaknesses in those other tools" - FTFY.

> This happens in other languages, just more slowly due to smaller community sizes.

Yeah, my point is that there is a cost for learning learning a new tool; the faster those new tools replace the old ones (instead of someone fixing the old ones), the more you have to pay of that cost.

Re: Many packages suddenly disappeared

#444

Post by semi-extrinsic »

jbg_ wrote: post #438
MagicWishMonkey wrote: post #318

Earlier quoted context omitted.

Wouldn't you need to install those packages as root for the code to have privileges to take advantage of that exploit?

I've known plenty of developers whose automatic response to `packagemanager install packagename` failing is `sudo packagemanager install packagename`.

I sincerely hope all modern package managers, when invoked with sudo, immediately spawn a very-low-privilege process that does most of the work sandboxed to /tmp/whatnot, and the root process just copies files to the right place and runs some system calls to update databases etc.

Re: Many packages suddenly disappeared

#445

Post by mst »

ytpete wrote: post #338
maxander wrote: post #121

Earlier quoted context omitted.

And all this is happening just as after the public release of a serious exploit which allows malicious code to do all sorts of nefarious things when it is somehow installed on the target machine . Hmm. Given that there's hints, at least, that the problems were caused by some particular developer's actions, I wonder about the security model for package-managed platforms altogether now. If I were a big cybercrime ring,…

With cases like the current one, or the leftpad incident in 2016, I'm surprised package registries still allow recycling old package names after a package was deleted. Really seems like deleted packages should be frozen forever - if the original author never recreates it or transfers ownership, then people would have to explicitly choose to move to some new fork with a new id. But your point about pressuring or bribi…

> With cases like the current one, or the leftpad incident in 2016, I'm surprised package registries still allow recycling old package names after a package was deleted.

CPAN requires the old author to explicitly transfer or mark it abandoned-and-available-to-new-owner.

For all the things wrong with perl5 (and I love it dearly but have spent enough time I can probably list more things wrong with it than the people who hate it ;) it's always a trifle depressing to watch other ecosystems failing to steal the things we got right.

Re: Many packages suddenly disappeared

#447

Post by ilaksh »

Deinumite wrote: post #295
ilaksh wrote: post #197

Earlier quoted context omitted.

npm does pin versions by default (although originally they did not). The fact that you _need_ to have a local mirror for Maven isn't really a plus for Java. You can get a local mirror or similar setup for npm also.

It is not a requirement for Java it is just standard practice. Also Maven does not allow you to remove packages once they are pushed, I think that is what he meant by Java being unaffected.

npm also does not allow you to remove packages. read my comment more carefully.

Re: Many packages suddenly disappeared

#448

Post by trampi »

stephengillie wrote: post #412
brown9-2 wrote: post #340

Earlier quoted context omitted.

Where did those Java devs who pulled from Maven central directly publish their artifacts?

Possibly Sonarqube Nexus. The Java devs at my workplace use Sonarqube along with Jenkins and Maven on the same server. I believe they communicate through the shared directory on the file system. (Pet peeve: another product named "Nexus". Please choose original names for your software.)

It's Sonatype Nexus, Sonarqube is the code quality checker.

Re: Many packages suddenly disappeared

#449

Post by CaptSpify »

zbentley wrote: post #365
none_to_remain wrote: post #233

Earlier quoted context omitted.

At my job we do native C and C++, some Java, some C#, scripting in Shell, Python, and Perl. When the left-pad incident happened someone said something to the room about it, we all looked it up, and spent a good 15 minutes mind-boggled, laughing and being grateful we weren't web devs. "Wait, you're telling me these people need NPM and GitHub to deploy? Seriously?"

"Wait, you're telling me these people rely on their ISP and the telco infrastructure being operational to deploy? Seriously?" "Wait, you're telling me these people need an internet-available Ubuntu mirror to install their development environments?" "Wait, you're telling me these people need their users to have specific, updated browsers in order to run the deployed software?" "Wait, you're telling me these people nee…

And? Most of these are things you absolutely should be thinking about

Re: Many packages suddenly disappeared

#450

Post by tzs »

shawn wrote: post #15

So, funny story: I registered the "nazi" npm package. When you require it, it says "I did nazi that coming." That's it. (Though it would've been a funny name for a linter.) ... Or it did. I received a harshly worded letter from npm saying they axed it. It hit all the talking points about inclusiveness and making sure no one feels even slightly annoyed. Meh. No point to this story. Just an interesting situation with a…

Try a package named Nazí, which provides a collection of the chess games of 2016 US Women's Chess Champion Nazí Paikidze [1]. At the same time also do one named Fabiano, which provides a collection of the games of Fabiano Caruana [2], the 2016 US Chess Champion.

If they take that down the Nazí one but not the Fabiano one, you can then take your mischief making to the next level by accusing them of being misogynists for banning a package promoting a woman chess champion but leaving up the one for the man.

[1] http://www.chessgames.com/player/nazi_paikidze.html

[2] http://www.chessgames.com/player/fabiano_caruana.html

Post reply on HN