To partially mitigate this issue, I scope all private packages to @corp-internal/, then use a .npmrc directive to push all packages in @corp-internal/ to packagecloud.io. The @corp/ scope is used for open source packages, @corp-internal scope does not exist on the public npm registry so no chance of config issues causing mistaken pushes.
Major bank accidentally published a private package to the public NPM Registry
121–130 of 236 posts
Re: Major bank accidentally published a private package to the public NPM Registry
#122Earlier quoted context omitted.
Please don't think this way. This is such a solvable problem. Doesn't package.json have an is private repo flag? Why not just respect that? Why does everyone everyone in this thread think a pop up is the solution? Pop ups are a code smell. They mean your application does not correctly match user intent with the action so badly you had to specifically get your user to tell you what they meant to do. Did you mean to do…
I disagree, there have been times a well-placed popup stopped me from accidentally doing something really stupid, other times there wasn't a popup and I ended up doing something stupid. It doesn't necessarily have to be a pop up popup per say, but extra validation around dangerous actions is user friendly. And of course there can always be an override for the extra validation in case it potentially screws up some peo…
Popups only work if they Confirm button is not a button, but "enter this text exactly: I really want to publish this package to the whole wide world" and block copy-paste.
If the user hacks around that, it's their own fault.
Re: Major bank accidentally published a private package to the public NPM Registry
#123Earlier quoted context omitted.
At some points in a language and its package management system's lifetime, reducing barriers to publishing are one of the best things that can be done to increase packages and fill out the ecosystem, and drive utility and adoption. Later, once you have most needs filled by packages, and a good number of enterprise users, more control is beneficial. Companies appreciate it, and single users are willing to jump through…
This is going to be cynical, but as far as I understand it people are looking for usability through vanity. Why not install `com.facebook.react’? Reverse domain notation is remarkably elegant given our internet. You are not typing ‘npm i com.facebook.react’ so often that it’s a pain. You probably use ‘create-react-app’ which is even worse. Instead, every language creates a new cash grab for common names. And made it…
The JavaScript community is moving into the Enterprise and is discovering Java's good ideas from 1995
Re: Major bank accidentally published a private package to the public NPM Registry
#124Slightly off topic, but my experience with lawyers and technology has been mostly discouraging. For example, one lawyer wanted to sue a client of ours for using an open-source JS dropdown menu that we were also using--he said they stole our code. He was also concerned that we were letting people 'View Source' our web pages and stealing our IP.
I think lawyers need to talk amongst themselves more; there are certainly even ones who specialise in open-source.
He was also concerned that we were letting people 'View Source' our web pages and stealing our IP.
...and here is where the DRM advocacy comes in. Don't let them ruin the Internet...
Re: Major bank accidentally published a private package to the public NPM Registry
#125Earlier quoted context omitted.
With physical property, there is the concept of Squatter's Rights. With copyright, if you fail to protect it adequately (which I don't think is very well defined by the court system), then the IP in question can pass into the public domain. I'm not sure what all rights (physical or otherwise) might be applicable here.
> With copyright, if you fail to protect it adequately (which I don't think is very well defined by the court system), then the IP in question can pass into the public domain. This is not true. Not even remotely true. It is routine that a company notices someone using their copyrights after decades and then sues about it. Oracle is suing Google over code that was "unprotected" for a decade before they decided to sue.…
[deleted]
Re: Major bank accidentally published a private package to the public NPM Registry
#126Earlier quoted context omitted.
At some points in a language and its package management system's lifetime, reducing barriers to publishing are one of the best things that can be done to increase packages and fill out the ecosystem, and drive utility and adoption. Later, once you have most needs filled by packages, and a good number of enterprise users, more control is beneficial. Companies appreciate it, and single users are willing to jump through…
Please don't think this way. This is such a solvable problem. Doesn't package.json have an is private repo flag? Why not just respect that? Why does everyone everyone in this thread think a pop up is the solution? Pop ups are a code smell. They mean your application does not correctly match user intent with the action so badly you had to specifically get your user to tell you what they meant to do. Did you mean to do…
> Doesn't package.json have an is private repo flag? Why not just respect that?
npm does reflect that flag. If you set private in package.json, npm won't publish it publicly. From docs:
> private
> If you set "private": true in your package.json, then npm will refuse to publish it.
> This is a way to prevent accidental publication of private repositories. If you would like to ensure that a given package is only ever published to a specific registry (for example, an internal registry), then use the publishConfig dictionary described below to override the registry config param at publish-time.
Re: Major bank accidentally published a private package to the public NPM Registry
#127This is more common than we think. At RedLock[1], we found several docker images which aren't supposed to be public. [1] https://redlock.io/blog/docker-repo-public-access
And on a little website known as Github there is a lot more :) (and Google Search stays the #1 reliable source of private data followed by AWS S3).
Re: Major bank accidentally published a private package to the public NPM Registry
#128I hate how there's no official way to run your own private NPM registry. So you have to either pay NPM or resort to third party solutions like verdaccio. It's such an obvious money grab by the NPM devs.
Whats wrong w/ nexus? https://blog.sonatype.com/using-nexus-3-as-your-repository-p... All our devs have our group repo configured as default. Any publishing is done to our private repo (via CI only) and any public package is pulled through the proxy repo, this way all packages are cached in our private repo so when npm registry goes down / someone unpublishes (which happens/ed?) our CI server doesn't die.
Nexus is great, comes with an easy to use docker image - and also works as a Nuget repository and more.
Re: Major bank accidentally published a private package to the public NPM Registry
#129Earlier quoted context omitted.
> If you don't have a license from the copyright holder, you can't legally use it, except for fair use exemptions: perhaps you could write a blog post criticizing it.
Theres nuance though, that copypasting a previous comment doesn't answer. What about public domain works for example? Or you had a good faith belief you had permission from the copyright holder, eg someone misrepresented themselves as the copyright holder, or the copyright holder published the code in public without a copyright notice?
I have good faith belief that all software on torrent trackers are in public domain or had permission from the copyright holder.
Re: Major bank accidentally published a private package to the public NPM Registry
#130Earlier quoted context omitted.
If you leave you car keys at my house for 3 years does the change the answer? With the car parked on my drive? I'm not sure a car is the best comparison though. How about a restaurant putting mint imperials by the cash register. Is it legal for patrons to take one?
Property rights don’t go away because someone made it easy for you to violate them. Mints are put out explicitly for you to take. Property right intentionally transferred.
Your missing the point. How is the transfer communicated? Common law traditions and statutes.