Major bank accidentally published a private package to the public NPM Registry • Hacker News Board

Re: Major bank accidentally published a private package to the public NPM Registry

#111

Post by krainboltgreene » Mon, Mar 11, 2019, 11:31 PM UTC

ljm wrote: post #92

seniorsassycat wrote: post #87

Earlier quoted context omitted.

Adding 'private: true' to the package.json prevents publishing to _any_ registry, including a corporate proxy. Adding a string or regex option for private that would only publish to matching registries may prevent issues like this. I ask for regex only because our corp proxy binds to a random port reach time it runs so a static string wouldn't be flexible enough.

Why isn’t this a source URL? Took a while for Ruby to get it but for the last 5 years you have default config for self-hosted sources whenever you make a new gem. Of course, npm is unique in being privately funded. It doesn’t want you doing that. Benefit of the doubt says that they thought they were publishing privately. Going back to Ruby, you will fail a bunch of CI steps just by leaving defaults in place.

Hey, contributor to rubygems here, there's no source url for ruby gems specification. You can read more here: https://guides.rubygems.org/specification-reference/

You're likely thinking of bundler's source, but even then that doesn't apply to publishing a gem.

Re: Major bank accidentally published a private package to the public NPM Registry

#112

Post by arkades » Mon, Mar 11, 2019, 11:34 PM UTC

benj111 wrote: post #91

tylersmith wrote: post #84

Earlier quoted context omitted.

If you leave your keys in your car for 3 years it's still illegal for me to take a joy ride in it. I don't personally believe in/support the concept of IP but in a world that does (like the US) it doesn't make sense to me that people being able to see your property for 3 years gives them the right to use it.

If you leave you car keys at my house for 3 years does the change the answer? With the car parked on my drive? I'm not sure a car is the best comparison though. How about a restaurant putting mint imperials by the cash register. Is it legal for patrons to take one?

Property rights don’t go away because someone made it easy for you to violate them.

Mints are put out explicitly for you to take. Property right intentionally transferred.

Re: Major bank accidentally published a private package to the public NPM Registry

#113

Post by alexanderdmitri » Mon, Mar 11, 2019, 11:37 PM UTC

lugg wrote: post #104

kbenson wrote: post #98

Earlier quoted context omitted.

At some points in a language and its package management system's lifetime, reducing barriers to publishing are one of the best things that can be done to increase packages and fill out the ecosystem, and drive utility and adoption. Later, once you have most needs filled by packages, and a good number of enterprise users, more control is beneficial. Companies appreciate it, and single users are willing to jump through…

Please don't think this way. This is such a solvable problem. Doesn't package.json have an is private repo flag? Why not just respect that? Why does everyone everyone in this thread think a pop up is the solution? Pop ups are a code smell. They mean your application does not correctly match user intent with the action so badly you had to specifically get your user to tell you what they meant to do. Did you mean to do…

I disagree, there have been times a well-placed popup stopped me from accidentally doing something really stupid, other times there wasn't a popup and I ended up doing something stupid.

It doesn't necessarily have to be a pop up popup per say, but extra validation around dangerous actions is user friendly.

And of course there can always be an override for the extra validation in case it potentially screws up some people's workflows, but I'd make a user explicitly set the override, like the 'NoHostAuthenticationForLocalhost' option in ssh for example.

Re: Major bank accidentally published a private package to the public NPM Registry

#114

Post by zmmmmm » Mon, Mar 11, 2019, 11:37 PM UTC

bradknowles wrote: post #90

benj111 wrote: post #80

Earlier quoted context omitted.

IANAL but if someone makes code publicly available (for 3 years). Then isn't there an argument to be made that its reasonable to make use of it? Probably not redistribute it, but use it at least. So I'm not even sure an explicit upload license would be required.

With physical property, there is the concept of Squatter's Rights. With copyright, if you fail to protect it adequately (which I don't think is very well defined by the court system), then the IP in question can pass into the public domain. I'm not sure what all rights (physical or otherwise) might be applicable here.

> With copyright, if you fail to protect it adequately (which I don't think is very well defined by the court system), then the IP in question can pass into the public domain.

This is not true. Not even remotely true. It is routine that a company notices someone using their copyrights after decades and then sues about it. Oracle is suing Google over code that was "unprotected" for a decade before they decided to sue. In Australia (I know, different country, but this is the same), Men at Work were successfully sued 29 years after they released "Land Downunder" because it has a two bar riff with similarity to a song written in 1928 [1].

As a side note, I see this all the time. What is it about this particular topic that people seem to (a) consistently confuse these things but more importantly (b) feel confident enough about ti to repeat the confused viewpoint with certainty to others?

You are probably thinking of trademarks.

[1] https://en.wikipedia.org/wiki/Down_Under_(song)

Re: Major bank accidentally published a private package to the public NPM Registry

#115

Post by kall » Mon, Mar 11, 2019, 11:41 PM UTC

ljm wrote: post #103

kbenson wrote: post #98

Earlier quoted context omitted.

At some points in a language and its package management system's lifetime, reducing barriers to publishing are one of the best things that can be done to increase packages and fill out the ecosystem, and drive utility and adoption. Later, once you have most needs filled by packages, and a good number of enterprise users, more control is beneficial. Companies appreciate it, and single users are willing to jump through…

This is going to be cynical, but as far as I understand it people are looking for usability through vanity. Why not install `com.facebook.react’? Reverse domain notation is remarkably elegant given our internet. You are not typing ‘npm i com.facebook.react’ so often that it’s a pain. You probably use ‘create-react-app’ which is even worse. Instead, every language creates a new cash grab for common names. And made it…

There's a little bit of movement happening in that direction in the npm world with scoped packages. E.g. babel moving all official packages to @babel. Storybook does it too. Doesn't even have to be much of a branding loss. FB could publish @react/react, @react/native, @react/eslint-config, @react/create-app, @react/prop-types, @react/dom... Most of the typing is happening in require/import not npm install, so there's some argument for not going the full java route.

Re: Major bank accidentally published a private package to the public NPM Registry

#116

Post by 0xfeba » Mon, Mar 11, 2019, 11:43 PM UTC

ionforce wrote: post #22

Is there a thing that's like "by using this service you put your work in the public domain" kinda thing?

There is a `private` setting in the package.json to avoid this situation.

Re: Major bank accidentally published a private package to the public NPM Registry

#117

Post by koolba » Mon, Mar 11, 2019, 11:48 PM UTC

Here’s a pro tip: Enable 2FA for your NPM account

Not only do you get additional security for 2FA, you also get a prompt for the TOTP pin that makes you question what and where you’re publishing.

Re: Major bank accidentally published a private package to the public NPM Registry

#118

Post by [deleted] » Mon, Mar 11, 2019, 11:54 PM UTC

syntheticcdo wrote: post #29

JustSomeNobody wrote: post #9

Abused the DMCA also. SMH.

How is this DMCA abuse? A copyright owner is requesting that a site that has safe harbor protection remove an unauthorized copyrighted work. The employee that originally created the unauthorized package may no longer work for the bank, unable to be identified, or doesn't have the credentials anymore.

[deleted]

Re: Major bank accidentally published a private package to the public NPM Registry

#119

Post by JustSomeNobody » Mon, Mar 11, 2019, 11:56 PM UTC

syntheticcdo wrote: post #29

JustSomeNobody wrote: post #9

Abused the DMCA also. SMH.

How is this DMCA abuse? A copyright owner is requesting that a site that has safe harbor protection remove an unauthorized copyrighted work. The employee that originally created the unauthorized package may no longer work for the bank, unable to be identified, or doesn't have the credentials anymore.

How is it not? The bank uploaded it by mistake. Now some other entity has to pay because of that. There're other ways of handling this.

Re: Major bank accidentally published a private package to the public NPM Registry

#120

Post by landr0id » Mon, Mar 11, 2019, 11:57 PM UTC

koolba wrote: post #117

Here’s a pro tip: Enable 2FA for your NPM account Not only do you get additional security for 2FA, you also get a prompt for the TOTP pin that makes you question what and where you’re publishing.

Even with this, people are dumb. It's probably not a case of "we didn't realize we were publishing to" and instead a case of "some dev didn't realize this was a bad idea".