Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Node.js koa-router package transferred to unknown user

github.com

Post reply on HN
Print view View original

41–48 of 48 posts

Re: Tell HN: Node.js koa-router package transferred to unknown user

#41

Post by gnahckire »

chrischen wrote: post #34
gnahckire wrote: post #26

Earlier quoted context omitted.

> Let's set the record straight... @ZijianHe offered to maintain it, and I agreed to let him maintain it. Our relationship is not anyone's business. Why not be transparent about selling the package? Or attempting to do so? > Chinese developers have contributed more to this repository than anyone from the Koa organization. This kind of racial scaremongering or guilt by association is not acceptable. Its offensive. Nic…

If you pulled up crime statics on black people vs white people, you'd have similar damning statistics. Rather than prejudicing this "unknown Chinese" guy why not treat him as a person first and find out who he is, and what he has to say?

Fair point. Although one shouldn't discount statistics altogether. Security experts lean on skepticism to help minimize exposure and discover new things.

Race and nationality aside, the transfer of ownership to an entity that has zero open source contributions in the js space does look very suspicious. I'm just surprised that an open source author didn't provide that disclosure to users of his work.

Re: Tell HN: Node.js koa-router package transferred to unknown user

#42

Post by chrischen »

gnahckire wrote: post #41
chrischen wrote: post #34

Earlier quoted context omitted.

If you pulled up crime statics on black people vs white people, you'd have similar damning statistics. Rather than prejudicing this "unknown Chinese" guy why not treat him as a person first and find out who he is, and what he has to say?

Fair point. Although one shouldn't discount statistics altogether. Security experts lean on skepticism to help minimize exposure and discover new things. Race and nationality aside, the transfer of ownership to an entity that has zero open source contributions in the js space does look very suspicious. I'm just surprised that an open source author didn't provide that disclosure to users of his work.

In almost all cases, including this one, you will have better signals than to bucket a whole race or culture under a generalized stereotype.

For example i can see at least another Chinese contributor who is against this who works at Alibaba that commented.

The principle issue here is that the repo was put up for sale, and anyone paying for the opportunity to maintain a free library should be scrutinized. This would be true regardless of if they were Chinese, black, or a white guy from San Francisco.

Re: Tell HN: Node.js koa-router package transferred to unknown user

#43

Post by krainboltgreene »

doublerebel wrote: post #39
yazboo wrote: post #13

Earlier quoted context omitted.

Could you not do that on PyPi and rubygems as well?

Absolutely not. PyPi and Rubygems have much more strict and sane ownership policies to prevent unauthorized takeovers of packages. (Same with apt and every other major package repo.) No package in any package manager, if it contains code, and greater than 0 downloads and dependencies, should ever be replaced. The cost of storing an old package is miniscule compared to a system where anyone can petition for a package…

> Rubygems have much more strict and sane ownership policies to prevent unauthorized takeovers of packages

No we don't. Our process is just as secure as npm's. Please stop talking about things you don't actually know.

Re: Tell HN: Node.js koa-router package transferred to unknown user

#45

Post by antic »

binarymax wrote: post #3

The npm package ownership process is flawed. Anecdotally, I received an email from npm support saying someone requested publish rights to a package that I manage. The default was that the access would be granted if I did not respond within 30 days. It's very possible this went through npm support, they received no reply within the window, and the transfer was granted. There are good practices around domain names to l…

Allowing automatic claiming of ownership by a third party is extremely dangerous to the ecosystem. This sounds like a vulnerability that could be used to publish malicious code to repos that people are using but that are no longer maintained (event-stream->flatmap-stream, anyone?).

Re: Tell HN: Node.js koa-router package transferred to unknown user

#46

Post by rogierschouten »

binarymax wrote: post #3

The npm package ownership process is flawed. Anecdotally, I received an email from npm support saying someone requested publish rights to a package that I manage. The default was that the access would be granted if I did not respond within 30 days. It's very possible this went through npm support, they received no reply within the window, and the transfer was granted. There are good practices around domain names to l…

I once took over ownership of the then-quite-popular async-lock package. It had a bug and it really wasn't being maintained anymore. The process was actually quite beneficial to the community in that case. That being said, I think the owner didn't understand English very well so I'm not sure he would have understood the emails from NPM support had he read them.

Re: Tell HN: Node.js koa-router package transferred to unknown user

#47

Post by move_zig »

bearmcbearsly wrote: post #23
javitury wrote: post #12

koa-router was owned by @alexmingoia and not by @koajs. Still it is a central piece of the koa framework that compromises practically every koa setup. The only alternative I have found is this: https://github.com/koajs/trie-router The transition from express to koa has been slow, and this doesn't help. It will undermine the confidence on the koa framework.

Now that you can trivially use async functions as express handlers, what are the major benefits of transitioning to Koa?

I regularly use async functions as handlers in Express, but I always include a try ... catch block inside each one. What's the trivial way to use them?

Re: Tell HN: Node.js koa-router package transferred to unknown user

#48

Post by midway »

bearmcbearsly wrote: post #23
javitury wrote: post #12

koa-router was owned by @alexmingoia and not by @koajs. Still it is a central piece of the koa framework that compromises practically every koa setup. The only alternative I have found is this: https://github.com/koajs/trie-router The transition from express to koa has been slow, and this doesn't help. It will undermine the confidence on the koa framework.

Now that you can trivially use async functions as express handlers, what are the major benefits of transitioning to Koa?

Turn-key ready http2 which is significantly faster.
Post reply on HN