Major bank accidentally published a private package to the public NPM Registry • Hacker News Board

Re: Major bank accidentally published a private package to the public NPM Registry

#91

Post by benj111 » Mon, Mar 11, 2019, 10:41 PM UTC

tylersmith wrote: post #84

benj111 wrote: post #80

Earlier quoted context omitted.

IANAL but if someone makes code publicly available (for 3 years). Then isn't there an argument to be made that its reasonable to make use of it? Probably not redistribute it, but use it at least. So I'm not even sure an explicit upload license would be required.

If you leave your keys in your car for 3 years it's still illegal for me to take a joy ride in it. I don't personally believe in/support the concept of IP but in a world that does (like the US) it doesn't make sense to me that people being able to see your property for 3 years gives them the right to use it.

If you leave you car keys at my house for 3 years does the change the answer? With the car parked on my drive?

I'm not sure a car is the best comparison though.

How about a restaurant putting mint imperials by the cash register. Is it legal for patrons to take one?

Re: Major bank accidentally published a private package to the public NPM Registry

#92

Post by ljm » Mon, Mar 11, 2019, 10:43 PM UTC

seniorsassycat wrote: post #87

seldo wrote: post #3

This really isn't news, folks. It happens every week. I was just grumpy this morning.

Adding 'private: true' to the package.json prevents publishing to _any_ registry, including a corporate proxy. Adding a string or regex option for private that would only publish to matching registries may prevent issues like this. I ask for regex only because our corp proxy binds to a random port reach time it runs so a static string wouldn't be flexible enough.

Why isn’t this a source URL?

Took a while for Ruby to get it but for the last 5 years you have default config for self-hosted sources whenever you make a new gem.

Of course, npm is unique in being privately funded. It doesn’t want you doing that.

Benefit of the doubt says that they thought they were publishing privately.

Going back to Ruby, you will fail a bunch of CI steps just by leaving defaults in place.

Re: Major bank accidentally published a private package to the public NPM Registry

#93

Post by benj111 » Mon, Mar 11, 2019, 10:44 PM UTC

dragonwriter wrote: post #88

benj111 wrote: post #80

Earlier quoted context omitted.

IANAL but if someone makes code publicly available (for 3 years). Then isn't there an argument to be made that its reasonable to make use of it? Probably not redistribute it, but use it at least. So I'm not even sure an explicit upload license would be required.

You seem to be arguing for an implied license; such things do exist—but the exact scope is often not obvious even to lawyers in the absence of case law covering very similar situations as to the kind of content and the use to be made of it.

My understanding is that it was based on custom/ industry norms. But yes a lot of lawyering would probably be involved.

Re: Major bank accidentally published a private package to the public NPM Registry

#94

Post by vortico » Mon, Mar 11, 2019, 10:44 PM UTC

"Ignorance" is not having knowledge about a certain field. Everyone has it.

"Stupidity" is having ignorance about a field but pretending not to.

These lawyers may have 7 years of law school education, but they are still "stupid".

Re: Major bank accidentally published a private package to the public NPM Registry

#95

Post by delecti » Mon, Mar 11, 2019, 10:45 PM UTC

bradknowles wrote: post #90

benj111 wrote: post #80

Earlier quoted context omitted.

IANAL but if someone makes code publicly available (for 3 years). Then isn't there an argument to be made that its reasonable to make use of it? Probably not redistribute it, but use it at least. So I'm not even sure an explicit upload license would be required.

With physical property, there is the concept of Squatter's Rights. With copyright, if you fail to protect it adequately (which I don't think is very well defined by the court system), then the IP in question can pass into the public domain. I'm not sure what all rights (physical or otherwise) might be applicable here.

Are you maybe thinking of trademark? If you fail to protect a trademark then you can lose it.

AFAIK, you can selectively (or not at all) enforce copyright all you want and then change your mind later.

Re: Major bank accidentally published a private package to the public NPM Registry

#96

Post by bdamm » Mon, Mar 11, 2019, 10:46 PM UTC

RIMR wrote: post #69

bdamm wrote: post #62

Earlier quoted context omitted.

No. The Bank's intent is what matters, not the intent or actions of a single employee.

That is absolutely not true, and it flies in the face of the notion of "due diligence". This bank uploaded their own code to the repo, and when they found it they didn't bother to do any investigating before they started sending legal demands. It was 100% their responsibility to ensure that they were not responsible for their own leak before they started making legal threats. They decided to skip due diligence, and t…

The upload itself does not constitute the Company's policy. It is not "The Bank's" action. There is a legal standard for a company's action, which is a signature by an executive or possibly a lower signing officer. The employee that uploaded this almost certainly is not an officer. Their failure to discover that the upload was their own error is their failure.

Thus, a DMCA request is appropriate, as the GP points out, the original employee that did the action quite likely cannot undo that action.

Re: Major bank accidentally published a private package to the public NPM Registry

#97

Post by benj111 » Mon, Mar 11, 2019, 10:47 PM UTC

bradknowles wrote: post #90

benj111 wrote: post #80

Earlier quoted context omitted.

IANAL but if someone makes code publicly available (for 3 years). Then isn't there an argument to be made that its reasonable to make use of it? Probably not redistribute it, but use it at least. So I'm not even sure an explicit upload license would be required.

With physical property, there is the concept of Squatter's Rights. With copyright, if you fail to protect it adequately (which I don't think is very well defined by the court system), then the IP in question can pass into the public domain. I'm not sure what all rights (physical or otherwise) might be applicable here.

Dragonwriters answer was what I was thinking.

Are you thinking trademark rather that copyright? I'm not sure you can fail to adequately protect a copyright in that sense.

Re: Major bank accidentally published a private package to the public NPM Registry

#98

Post by kbenson » Mon, Mar 11, 2019, 10:49 PM UTC

ivan_gammel wrote: post #85

vvoyer wrote: post #81

Earlier quoted context omitted.

No alert box ever will save you from doing the biggest mistakes, most people don’t read them.

Just compare this to publication to Maven Central - you’ll never publish there by accident exactly because there are significant barriers. Public NPM repo should not be that easily accessible for upload.

At some points in a language and its package management system's lifetime, reducing barriers to publishing are one of the best things that can be done to increase packages and fill out the ecosystem, and drive utility and adoption.

Later, once you have most needs filled by packages, and a good number of enterprise users, more control is beneficial. Companies appreciate it, and single users are willing to jump through an extra hoop or two much of the time because the rest of the ecosystem is so useful that it's not worth switching languages.

I think it's unlikely that a system will move from one style to another without an event causing them to reevaluate their prior choices. More likely, multiple events. This has already happened with NPM for other choices they made in the past, such as letting package namespaces be claimed by new people after someone gives it up, and whether releases are immutable, IIRC.

Re: Major bank accidentally published a private package to the public NPM Registry

#99

Post by ljm » Mon, Mar 11, 2019, 10:50 PM UTC

omouse wrote: post #73

seldo wrote: post #3

This really isn't news, folks. It happens every week. I was just grumpy this morning.

If this happens often, perhaps the user interface for npm publish needs to change? I mean, that's the only thing I can see mitigating this, with like a nice dialog that says "hey, are you REALLY REALLY sure and have you consulted lawyers on this???" Or something to that effect. Or maybe companies can just pony up for NPM Enterprise which fits their use case.

No, the first step is to say you haven’t set a publish source. Your toolkit might generate that but you should also see that in code review.

Re: Major bank accidentally published a private package to the public NPM Registry

#100

Post by shawnz » Mon, Mar 11, 2019, 10:53 PM UTC

Mikeb85 wrote: post #8

tombert wrote: post #4

Earlier quoted context omitted.

How much of them sending takedown notices was a desperate posturing of "omg please please please please don't use our code!!!" I can't possibly see how they would possibly have any case.

If their code is proprietary, no one can use it. Even if they accidentally uploaded it to a public site.

What if the public site states in their terms that they must be granted those rights on the uploaded material, and the actual copyright holder is the one who does the uploading (but accidentally)?