Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Major bank accidentally published a private package to the public NPM Registry

twitter.com

Post reply on HN
Print view View original

81–90 of 236 posts

Re: Major bank accidentally published a private package to the public NPM Registry

#81

Post by vvoyer »

omouse wrote: post #73
seldo wrote: post #3

This really isn't news, folks. It happens every week. I was just grumpy this morning.

If this happens often, perhaps the user interface for npm publish needs to change? I mean, that's the only thing I can see mitigating this, with like a nice dialog that says "hey, are you REALLY REALLY sure and have you consulted lawyers on this???" Or something to that effect. Or maybe companies can just pony up for NPM Enterprise which fits their use case.

No alert box ever will save you from doing the biggest mistakes, most people don’t read them.

Re: Major bank accidentally published a private package to the public NPM Registry

#82

Post by OnlyOneCannolo »

omouse wrote: post #73
seldo wrote: post #3

This really isn't news, folks. It happens every week. I was just grumpy this morning.

If this happens often, perhaps the user interface for npm publish needs to change? I mean, that's the only thing I can see mitigating this, with like a nice dialog that says "hey, are you REALLY REALLY sure and have you consulted lawyers on this???" Or something to that effect. Or maybe companies can just pony up for NPM Enterprise which fits their use case.

What you're describing is consumer protection, but a company isn't a consumer. The bank responsible for their own actions.

Re: Major bank accidentally published a private package to the public NPM Registry

#83

Post by ungzd »

symlinkk wrote: post #32

I hate how there's no official way to run your own private NPM registry. So you have to either pay NPM or resort to third party solutions like verdaccio. It's such an obvious money grab by the NPM devs.

There are many ways to specify dependency except from central npm server: https://docs.npmjs.com/files/package.json#dependencies

That includes tarballs on http, git repos and even freaking local directories.

For companies where putting packages on smb mount is treated as non-enterprisey, npm have "npm enterprise" offering: https://www.npmjs.com/products/enterprise

Re: Major bank accidentally published a private package to the public NPM Registry

#84

Post by tylersmith »

benj111 wrote: post #80
thaumasiotes wrote: post #44

Earlier quoted context omitted.

> If their code is proprietary, no one can use it. Even if they accidentally uploaded it to a public site. Surely this depends on the terms under which they uploaded it. I would expect npm to have a legal structure in place under which code you upload for public use is also licensed for public use.

IANAL but if someone makes code publicly available (for 3 years). Then isn't there an argument to be made that its reasonable to make use of it? Probably not redistribute it, but use it at least. So I'm not even sure an explicit upload license would be required.

If you leave your keys in your car for 3 years it's still illegal for me to take a joy ride in it. I don't personally believe in/support the concept of IP but in a world that does (like the US) it doesn't make sense to me that people being able to see your property for 3 years gives them the right to use it.

Re: Major bank accidentally published a private package to the public NPM Registry

#85

Post by ivan_gammel »

vvoyer wrote: post #81
omouse wrote: post #73

Earlier quoted context omitted.

If this happens often, perhaps the user interface for npm publish needs to change? I mean, that's the only thing I can see mitigating this, with like a nice dialog that says "hey, are you REALLY REALLY sure and have you consulted lawyers on this???" Or something to that effect. Or maybe companies can just pony up for NPM Enterprise which fits their use case.

No alert box ever will save you from doing the biggest mistakes, most people don’t read them.

Just compare this to publication to Maven Central - you’ll never publish there by accident exactly because there are significant barriers. Public NPM repo should not be that easily accessible for upload.

Re: Major bank accidentally published a private package to the public NPM Registry

#86

Post by benj111 »

detaro wrote: post #66
zaphirplane wrote: post #64

Earlier quoted context omitted.

Was there a licence attached to the files? What if there wasn’t

> If you don't have a license from the copyright holder, you can't legally use it, except for fair use exemptions: perhaps you could write a blog post criticizing it.

Theres nuance though, that copypasting a previous comment doesn't answer.

What about public domain works for example? Or you had a good faith belief you had permission from the copyright holder, eg someone misrepresented themselves as the copyright holder, or the copyright holder published the code in public without a copyright notice?

Re: Major bank accidentally published a private package to the public NPM Registry

#87

Post by seniorsassycat »

seldo wrote: post #3

This really isn't news, folks. It happens every week. I was just grumpy this morning.

Adding 'private: true' to the package.json prevents publishing to _any_ registry, including a corporate proxy. Adding a string or regex option for private that would only publish to matching registries may prevent issues like this.

I ask for regex only because our corp proxy binds to a random port reach time it runs so a static string wouldn't be flexible enough.

Re: Major bank accidentally published a private package to the public NPM Registry

#88

Post by dragonwriter »

benj111 wrote: post #80
thaumasiotes wrote: post #44

Earlier quoted context omitted.

> If their code is proprietary, no one can use it. Even if they accidentally uploaded it to a public site. Surely this depends on the terms under which they uploaded it. I would expect npm to have a legal structure in place under which code you upload for public use is also licensed for public use.

IANAL but if someone makes code publicly available (for 3 years). Then isn't there an argument to be made that its reasonable to make use of it? Probably not redistribute it, but use it at least. So I'm not even sure an explicit upload license would be required.

You seem to be arguing for an implied license; such things do exist—but the exact scope is often not obvious even to lawyers in the absence of case law covering very similar situations as to the kind of content and the use to be made of it.

Re: Major bank accidentally published a private package to the public NPM Registry

#89

Post by [deleted] »

omouse wrote: post #73
seldo wrote: post #3

This really isn't news, folks. It happens every week. I was just grumpy this morning.

If this happens often, perhaps the user interface for npm publish needs to change? I mean, that's the only thing I can see mitigating this, with like a nice dialog that says "hey, are you REALLY REALLY sure and have you consulted lawyers on this???" Or something to that effect. Or maybe companies can just pony up for NPM Enterprise which fits their use case.

[deleted]

Re: Major bank accidentally published a private package to the public NPM Registry

#90

Post by bradknowles »

benj111 wrote: post #80
thaumasiotes wrote: post #44

Earlier quoted context omitted.

> If their code is proprietary, no one can use it. Even if they accidentally uploaded it to a public site. Surely this depends on the terms under which they uploaded it. I would expect npm to have a legal structure in place under which code you upload for public use is also licensed for public use.

IANAL but if someone makes code publicly available (for 3 years). Then isn't there an argument to be made that its reasonable to make use of it? Probably not redistribute it, but use it at least. So I'm not even sure an explicit upload license would be required.

With physical property, there is the concept of Squatter's Rights. With copyright, if you fail to protect it adequately (which I don't think is very well defined by the court system), then the IP in question can pass into the public domain.

I'm not sure what all rights (physical or otherwise) might be applicable here.

Post reply on HN