131–140 of 236 posts
Earlier quoted context omitted.
If this happens often, perhaps the user interface for npm publish needs to change? I mean, that's the only thing I can see mitigating this, with like a nice dialog that says "hey, are you REALLY REALLY sure and have you consulted lawyers on this???" Or something to that effect. Or maybe companies can just pony up for NPM Enterprise which fits their use case.
No alert box ever will save you from doing the biggest mistakes, most people don’t read them.
Earlier quoted context omitted.
This isn't an open question. If you don't have a license from the copyright holder, you can't legally use it, except for fair use exemptions: perhaps you could write a blog post criticizing it.
We're talking about code. Which is more like a recipe than a novel. If Coca Cola writes down its proprietary recipe on their entrance "by mistake", I can definitely make use of it. Maybe I can't photocopy it for sale, but I can definitely re-use their previously-secret techniques. I can even say I got it from them through their own error and have the exact same outputs for the exact same inputs. Trade secrets aren't…
Courts strongly disagree with you.
Earlier quoted context omitted.
If you leave you car keys at my house for 3 years does the change the answer? With the car parked on my drive? I'm not sure a car is the best comparison though. How about a restaurant putting mint imperials by the cash register. Is it legal for patrons to take one?
Property rights don’t go away because someone made it easy for you to violate them. Mints are put out explicitly for you to take. Property right intentionally transferred.
Same for any lost property, if you find something valuable (wallet full of cash), you generally have to turn it in to the police, and there is a notification process to try to find the owner, and after a period of time (generally 3 months), if no one has claimed it, it's yours. Again, local laws are going to differ, but the general legal concept, that "A finder of property acquires no rights in mislaid property, is entitled to possession of lost property against everyone except the true owner, and is entitled to keep abandoned property."[1] is common.
There's some old saying about possession being 9/10ths of the law....
[1] https://en.wikipedia.org/wiki/Lost,_mislaid,_and_abandoned_p...
Earlier quoted context omitted.
Please don't think this way. This is such a solvable problem. Doesn't package.json have an is private repo flag? Why not just respect that? Why does everyone everyone in this thread think a pop up is the solution? Pop ups are a code smell. They mean your application does not correctly match user intent with the action so badly you had to specifically get your user to tell you what they meant to do. Did you mean to do…
> Doesn't package.json have an is private repo flag? Why not just respect that? npm does reflect that flag. If you set private in package.json, npm won't publish it publicly. From docs: > private > If you set "private": true in your package.json, then npm will refuse to publish it. > This is a way to prevent accidental publication of private repositories. If you would like to ensure that a given package is only ever…
Make it so you have to explicitly go in and mark your package.json as public before npm will publish it, and have the default be private?
I don't have _too_ much sympathy for the bank here - it's in npm's best interest to make it easy to publish leftpad.js easily - and that probably should be their default stance.
The bank should be responsible for ensuring their "banking grade security" includes not accidentally publishing their source code to public repos. (How much would you bet against there being instances exactly like this where the publication vector was GitHub instead of npm? How much would you bet against this exact code being on a public git repo somewhere as well? How many public code hosting services should be expected to change their business models because some bank gets uptight after they've fucked up?)
Earlier quoted context omitted.
This is going to be cynical, but as far as I understand it people are looking for usability through vanity. Why not install `com.facebook.react’? Reverse domain notation is remarkably elegant given our internet. You are not typing ‘npm i com.facebook.react’ so often that it’s a pain. You probably use ‘create-react-app’ which is even worse. Instead, every language creates a new cash grab for common names. And made it…
The JavaScript community is moving into the Enterprise and is discovering Java's good ideas from 1995
A whole quarter of a century, or perhaps half of the entire software industries lifetime, of exciting known security errors to look forward to!
BRB, off to hide all my bitcoin under my mattress...
Here’s a pro tip: Enable 2FA for your NPM account Not only do you get additional security for 2FA, you also get a prompt for the TOTP pin that makes you question what and where you’re publishing.
Even with this, people are dumb. It's probably not a case of "we didn't realize we were publishing to" and instead a case of "some dev didn't realize this was a bad idea".
Surely in a bank, when publishing, the decisions aren't down to a single dev. Either many people made a mistake together or many people made lots of small mistakes separately that added up to one big one??
FWIW, I don't know, I'm a small time potter, just how I imagine things happen in banks (I do know a couple of devs who work/worked for banks).
Earlier quoted context omitted.
Adding 'private: true' to the package.json prevents publishing to _any_ registry, including a corporate proxy. Adding a string or regex option for private that would only publish to matching registries may prevent issues like this. I ask for regex only because our corp proxy binds to a random port reach time it runs so a static string wouldn't be flexible enough.
Why isn’t this a source URL? Took a while for Ruby to get it but for the last 5 years you have default config for self-hosted sources whenever you make a new gem. Of course, npm is unique in being privately funded. It doesn’t want you doing that. Benefit of the doubt says that they thought they were publishing privately. Going back to Ruby, you will fail a bunch of CI steps just by leaving defaults in place.
In what world is pushing your source code to a venture backed (therefore viral growth oriented) company who promote themselves with "npm Inc supports the JavaScript community by providing the registry where developers publish and share packaged open-source modules" possibly consistent with a view that "they thought they were publishing privately"???
Sorry, but I just don't buy that.
Somebody at the bank fucked up. It cannot possibly be npm Inc's responsibility to detect and somehow police that.
Earlier quoted context omitted.
With physical property, there is the concept of Squatter's Rights. With copyright, if you fail to protect it adequately (which I don't think is very well defined by the court system), then the IP in question can pass into the public domain. I'm not sure what all rights (physical or otherwise) might be applicable here.
Dragonwriters answer was what I was thinking. Are you thinking trademark rather that copyright? I'm not sure you can fail to adequately protect a copyright in that sense.
Earlier quoted context omitted.
> Doesn't package.json have an is private repo flag? Why not just respect that? npm does reflect that flag. If you set private in package.json, npm won't publish it publicly. From docs: > private > If you set "private": true in your package.json, then npm will refuse to publish it. > This is a way to prevent accidental publication of private repositories. If you would like to ensure that a given package is only ever…
Perhaps inverting the logic there might be worth considering? Make it so you have to explicitly go in and mark your package.json as public before npm will publish it, and have the default be private? I don't have _too_ much sympathy for the bank here - it's in npm's best interest to make it easy to publish leftpad.js easily - and that probably should be their default stance. The bank should be responsible for ensurin…
Some bank developer (or more likely, some underpaid contractor) wants to share something between projects and doesn't want the hassle of proper channels, or just doesn't care enough and thinks "I'll publish this, who will ever find it?".
Years later someone stumbles upon it, maybe they don't even know who did it, "NPM why do you have our code?!?!?!?!"
This is the most likely scenario once you consider this was a bank. In which case there's nothing NPM could do. No warning would have changed their intent, they knew what they were signing up for.