Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Major bank accidentally published a private package to the public NPM Registry

twitter.com

Post reply on HN
Print view View original

101–110 of 236 posts

Re: Major bank accidentally published a private package to the public NPM Registry

#101

Post by knicholes »

omouse wrote: post #73
seldo wrote: post #3

This really isn't news, folks. It happens every week. I was just grumpy this morning.

If this happens often, perhaps the user interface for npm publish needs to change? I mean, that's the only thing I can see mitigating this, with like a nice dialog that says "hey, are you REALLY REALLY sure and have you consulted lawyers on this???" Or something to that effect. Or maybe companies can just pony up for NPM Enterprise which fits their use case.

You could not have a default. Then in order for someone to publish to the public NPM, they'd have to enter the URL for the public NPM. Otherwise publish should fail.

Re: Major bank accidentally published a private package to the public NPM Registry

#102

Post by Scoundreller »

JeremyBanks wrote: post #20
Scoundreller wrote: post #19

Earlier quoted context omitted.

I’m not sure how universally true that is. When governments fail to redact documents, it’s on them. If you “accidentally” talk to a reporter about your solicitor-privileged comms, it’s not privileged anymore.

This isn't an open question. If you don't have a license from the copyright holder, you can't legally use it, except for fair use exemptions: perhaps you could write a blog post criticizing it.

We're talking about code. Which is more like a recipe than a novel.

If Coca Cola writes down its proprietary recipe on their entrance "by mistake", I can definitely make use of it. Maybe I can't photocopy it for sale, but I can definitely re-use their previously-secret techniques.

I can even say I got it from them through their own error and have the exact same outputs for the exact same inputs.

Trade secrets aren't your secret anymore once you publish them.

All we know in this case is that copyright law was used as a tool to remove it.

Re: Major bank accidentally published a private package to the public NPM Registry

#103

Post by ljm »

kbenson wrote: post #98
ivan_gammel wrote: post #85

Earlier quoted context omitted.

Just compare this to publication to Maven Central - you’ll never publish there by accident exactly because there are significant barriers. Public NPM repo should not be that easily accessible for upload.

At some points in a language and its package management system's lifetime, reducing barriers to publishing are one of the best things that can be done to increase packages and fill out the ecosystem, and drive utility and adoption. Later, once you have most needs filled by packages, and a good number of enterprise users, more control is beneficial. Companies appreciate it, and single users are willing to jump through…

This is going to be cynical, but as far as I understand it people are looking for usability through vanity.

Why not install `com.facebook.react’? Reverse domain notation is remarkably elegant given our internet. You are not typing ‘npm i com.facebook.react’ so often that it’s a pain. You probably use ‘create-react-app’ which is even worse.

Instead, every language creates a new cash grab for common names. And made it worse. New namespaces, new squatting. I can publish ‘react-racket’ and do whatever I want behind the scenes with it.

Case in point: do you add coffeescript or coffee-script.

Why optimise for keystrokes in your term instead of stability for your client? Jesus fuck.

Re: Major bank accidentally published a private package to the public NPM Registry

#104

Post by lugg »

kbenson wrote: post #98
ivan_gammel wrote: post #85

Earlier quoted context omitted.

Just compare this to publication to Maven Central - you’ll never publish there by accident exactly because there are significant barriers. Public NPM repo should not be that easily accessible for upload.

At some points in a language and its package management system's lifetime, reducing barriers to publishing are one of the best things that can be done to increase packages and fill out the ecosystem, and drive utility and adoption. Later, once you have most needs filled by packages, and a good number of enterprise users, more control is beneficial. Companies appreciate it, and single users are willing to jump through…

Please don't think this way.

This is such a solvable problem.

Doesn't package.json have an is private repo flag? Why not just respect that?

Why does everyone everyone in this thread think a pop up is the solution?

Pop ups are a code smell. They mean your application does not correctly match user intent with the action so badly you had to specifically get your user to tell you what they meant to do. Did you mean to do that? Always, yes. Otherwise, undo.

The only place did you mean makes sense is in Google search results.

Why is public and private publish anywhere near each other? Why are they even on the same page?

Stop drawing boundaries around nouns.

Re: Major bank accidentally published a private package to the public NPM Registry

#107

Post by linsomniac »

ahallock wrote: post #65

Slightly off topic, but my experience with lawyers and technology has been mostly discouraging. For example, one lawyer wanted to sue a client of ours for using an open-source JS dropdown menu that we were also using--he said they stole our code. He was also concerned that we were letting people 'View Source' our web pages and stealing our IP.

That reminds me of a hosting client I used to have, which we got a DMCA takedown notice for: "They are using our software without a license." I replied: "They are a local reputable University, have you tried contacting them?" "I wasn't able to get ahold of them." "You weren't able to get ahold of a UNIVERSITY?!?" "Well, I didn't really try. I'm a subcontractor, in another country, and can't afford to make phone calls about it."

I had also reached out to our client contact. They contacted the CMS company, provided them with the license information, and then switched to another CMS.

Re: Major bank accidentally published a private package to the public NPM Registry

#108

Post by jessaustin »

kccqzy wrote: post #43
ionforce wrote: post #22

Is there a thing that's like "by using this service you put your work in the public domain" kinda thing?

No one would use such a thing. Very few open source code is in the public domain. The only one I can think of off the top of my head is SQLite.

In fairness, the bank in question might use such a thing, because they have difficulty making decisions that abide by their own policies.

Re: Major bank accidentally published a private package to the public NPM Registry

#109

Post by dang »

fiatjaf wrote: post #74
ronilan wrote: post #2

Next tweet: “We sell a thing that prevents this kind of mistake ...” Just sayin.

Enterprise people don't deserve anything for free. They're horrible. They should be thankful that there are people who want to sell stuff for them, because I would never. Enterprise people are unbearable.

Please don't break the site guidelines by name-calling, posting unsubstantively, or slurring $people.

https://news.ycombinator.com/newsguidelines.html

Re: Major bank accidentally published a private package to the public NPM Registry

#110

Post by kall »

lugg wrote: post #104
kbenson wrote: post #98

Earlier quoted context omitted.

At some points in a language and its package management system's lifetime, reducing barriers to publishing are one of the best things that can be done to increase packages and fill out the ecosystem, and drive utility and adoption. Later, once you have most needs filled by packages, and a good number of enterprise users, more control is beneficial. Companies appreciate it, and single users are willing to jump through…

Please don't think this way. This is such a solvable problem. Doesn't package.json have an is private repo flag? Why not just respect that? Why does everyone everyone in this thread think a pop up is the solution? Pop ups are a code smell. They mean your application does not correctly match user intent with the action so badly you had to specifically get your user to tell you what they meant to do. Did you mean to do…

npm publish already prevents you from publishing a package that has the private flag. They must not have had it set.
Post reply on HN