Major bank accidentally published a private package to the public NPM Registry • Hacker News Board

Re: Major bank accidentally published a private package to the public NPM Registry

#71

Post by detaro » Mon, Mar 11, 2019, 10:13 PM UTC

MagicPropmaker wrote: post #55

ufo wrote: post #47

Earlier quoted context omitted.

Software is copyrighted "by default". You don't need to apply for copyright like you would need to do with a patent.

https://www.uspto.gov/patents-getting-started/international-... USPTO explanation of difference between a Patent, Copyright, and Trade Secret.

The software could contain a trade secret, and someone could discover it from reading the source (e.g. the banks magic evaluation function for credit ratings, or their trading strategy, or ...). That doesn't grant them any protected right on the software, which is protected by copyright.

Re: Major bank accidentally published a private package to the public NPM Registry

#72

Post by lgeorget » Mon, Mar 11, 2019, 10:15 PM UTC

Wowfunhappy wrote: post #42

icebraining wrote: post #31

Earlier quoted context omitted.

No, npm only says you give them a license to allow them to serve the package to users; other than that, you're free to license it however you want.

So the bank shouldn't be able to send DMCA takedown notices, right? Because they granted npm the license to redistribute the package.

I think they can argue that the code is their property and that the employee that published it on NPM had no mandate from the company to do so. So it's effectively "stolen code" in a sense, just as if the employee had done it to harm the company on purpose.

Re: Major bank accidentally published a private package to the public NPM Registry

#73

Post by omouse » Mon, Mar 11, 2019, 10:17 PM UTC

seldo wrote: post #3

This really isn't news, folks. It happens every week. I was just grumpy this morning.

If this happens often, perhaps the user interface for npm publish needs to change? I mean, that's the only thing I can see mitigating this, with like a nice dialog that says "hey, are you REALLY REALLY sure and have you consulted lawyers on this???"

Or something to that effect. Or maybe companies can just pony up for NPM Enterprise which fits their use case.

Re: Major bank accidentally published a private package to the public NPM Registry

#74

Post by fiatjaf » Mon, Mar 11, 2019, 10:20 PM UTC

ronilan wrote: post #2

Next tweet: “We sell a thing that prevents this kind of mistake ...” Just sayin.

Enterprise people don't deserve anything for free. They're horrible. They should be thankful that there are people who want to sell stuff for them, because I would never. Enterprise people are unbearable.

Re: Major bank accidentally published a private package to the public NPM Registry

#75

Post by skissane » Mon, Mar 11, 2019, 10:20 PM UTC

ahallock wrote: post #65

Slightly off topic, but my experience with lawyers and technology has been mostly discouraging. For example, one lawyer wanted to sue a client of ours for using an open-source JS dropdown menu that we were also using--he said they stole our code. He was also concerned that we were letting people 'View Source' our web pages and stealing our IP.

Maybe that's the difference between a specialist and a generalist. A lawyer who has experience and expertise working with the software industry is unlikely to make those kinds of silly mistakes. A lawyer who has no software industry experience, who just does general business law, contracts, real estate, wills, etc, who maybe even has some industry-specific experience in other industries like finance or manufacturing or construction, and thinks "software can't be that different"–that is the kind of lawyer who is far more likely to demonstrate that species of ignorance.

Re: Major bank accidentally published a private package to the public NPM Registry

#76

Post by Klathmon » Mon, Mar 11, 2019, 10:21 PM UTC

z3t4 wrote: post #58

Why not just take it down? What do you need a lawyer for ? Isnt there an option for deleting your own packages ?

npm doesn't allow you to delete a package once it has some downloads to prevent another left pad incident. I'm sure they can make exceptions, but it's not as simple as a quick CLI command.

Re: Major bank accidentally published a private package to the public NPM Registry

#77

Post by jordache » Mon, Mar 11, 2019, 10:21 PM UTC

it's probably just a data visualizer component.

Re: Major bank accidentally published a private package to the public NPM Registry

#78

Post by skissane » Mon, Mar 11, 2019, 10:23 PM UTC

taarushv wrote: post #61

beager wrote: post #30

Earlier quoted context omitted.

You'd think it's like, some proprietary trading algorithm, but in reality it's probably their own implementation of left-pad.

It was a react package. Source: https://twitter.com/seldo/status/1105157348560007168?s=09

Just guessing here, but probably something like some front-end UI components for their internet banking system. Which then probably got simplified to "someone has posted the source code to our internet banking system on the Internet"

Re: Major bank accidentally published a private package to the public NPM Registry

#79

Post by AWildC182 » Mon, Mar 11, 2019, 10:23 PM UTC

bdamm wrote: post #62

cm2187 wrote: post #33

Earlier quoted context omitted.

Does the fact that the bank distributed the material in the first place change the situation?

No. The Bank's intent is what matters, not the intent or actions of a single employee.

At some point the corporation needs to take responsibility for what its actors do... You can't just say everything good that happens is because the corp is awesome and everything bad that happens is because that one guy did something stupid so it's all his fault and the corp is still awesome.

Re: Major bank accidentally published a private package to the public NPM Registry

#80

Post by benj111 » Mon, Mar 11, 2019, 10:25 PM UTC

thaumasiotes wrote: post #44

Mikeb85 wrote: post #8

Earlier quoted context omitted.

If their code is proprietary, no one can use it. Even if they accidentally uploaded it to a public site.

> If their code is proprietary, no one can use it. Even if they accidentally uploaded it to a public site. Surely this depends on the terms under which they uploaded it. I would expect npm to have a legal structure in place under which code you upload for public use is also licensed for public use.

IANAL but if someone makes code publicly available (for 3 years). Then isn't there an argument to be made that its reasonable to make use of it? Probably not redistribute it, but use it at least. So I'm not even sure an explicit upload license would be required.