Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Major bank accidentally published a private package to the public NPM Registry

twitter.com

Post reply on HN
Print view View original

151–160 of 236 posts

Re: Major bank accidentally published a private package to the public NPM Registry

#151

Post by gpm »

syntheticcdo wrote: post #29
JustSomeNobody wrote: post #9

Abused the DMCA also. SMH.

How is this DMCA abuse? A copyright owner is requesting that a site that has safe harbor protection remove an unauthorized copyrighted work. The employee that originally created the unauthorized package may no longer work for the bank, unable to be identified, or doesn't have the credentials anymore.

The banks employee granted NPM a (probably) valid license to distribute the code (quoted below - from the tos). Submitting a DMCA request claiming requires claiming under penalty of perjury that no such license exists. That's (probably) incorrect, any lawyer reasonably knows that a license would have been granted, and as such (probably) criminal. Unfortunately (?) this sort of perjury is never prosecuted in practice.

> (From npm tos) Your Content belongs to you. You decide whether and how to license it. But at a minimum, you license npm to provide Your Content to users of npm Services when you share Your Content. That special license allows npm to copy, publish, and analyze Your Content, and to share its analyses with others. npm may run computer code in Your Content to analyze it, but npm's special license alone does not give npm the right to run code for its functionality in npm products or services

Re: Major bank accidentally published a private package to the public NPM Registry

#153

Post by [deleted] »

zmmmmm wrote: post #114
bradknowles wrote: post #90

Earlier quoted context omitted.

With physical property, there is the concept of Squatter's Rights. With copyright, if you fail to protect it adequately (which I don't think is very well defined by the court system), then the IP in question can pass into the public domain. I'm not sure what all rights (physical or otherwise) might be applicable here.

> With copyright, if you fail to protect it adequately (which I don't think is very well defined by the court system), then the IP in question can pass into the public domain. This is not true. Not even remotely true. It is routine that a company notices someone using their copyrights after decades and then sues about it. Oracle is suing Google over code that was "unprotected" for a decade before they decided to sue.…

[deleted]

Re: Major bank accidentally published a private package to the public NPM Registry

#154

Post by duncan-donuts »

satori99 wrote: post #148
omouse wrote: post #73

Earlier quoted context omitted.

If this happens often, perhaps the user interface for npm publish needs to change? I mean, that's the only thing I can see mitigating this, with like a nice dialog that says "hey, are you REALLY REALLY sure and have you consulted lawyers on this???" Or something to that effect. Or maybe companies can just pony up for NPM Enterprise which fits their use case.

Setting `private: true` to your package.json will prevent this from happening

setting `public:true` would solve this problem

Re: Major bank accidentally published a private package to the public NPM Registry

#155

Post by dec0dedab0de »

bigiain wrote: post #135
madeofpalk wrote: post #126

Earlier quoted context omitted.

> Doesn't package.json have an is private repo flag? Why not just respect that? npm does reflect that flag. If you set private in package.json, npm won't publish it publicly. From docs: > private > If you set "private": true in your package.json, then npm will refuse to publish it. > This is a way to prevent accidental publication of private repositories. If you would like to ensure that a given package is only ever…

Perhaps inverting the logic there might be worth considering? Make it so you have to explicitly go in and mark your package.json as public before npm will publish it, and have the default be private? I don't have _too_ much sympathy for the bank here - it's in npm's best interest to make it easy to publish leftpad.js easily - and that probably should be their default stance. The bank should be responsible for ensurin…

I think open source tools should always default to sharing. If you're trying to keep things secret it should be up to you to keep them secret.

Re: Major bank accidentally published a private package to the public NPM Registry

#156

Post by jjeaff »

pbhjpbhj wrote: post #137
landr0id wrote: post #120

Earlier quoted context omitted.

Even with this, people are dumb. It's probably not a case of "we didn't realize we were publishing to" and instead a case of "some dev didn't realize this was a bad idea".

>some dev didn't realize Surely in a bank, when publishing, the decisions aren't down to a single dev. Either many people made a mistake together or many people made lots of small mistakes separately that added up to one big one?? FWIW, I don't know, I'm a small time potter, just how I imagine things happen in banks (I do know a couple of devs who work/worked for banks).

You are going to have a ton of technical barriers in place if you are going to stop everyone from publishing to one of the many and varied code repos out there.

Re: Major bank accidentally published a private package to the public NPM Registry

#157

Post by v_lisivka »

v_lisivka wrote: post #129
benj111 wrote: post #86

Earlier quoted context omitted.

Theres nuance though, that copypasting a previous comment doesn't answer. What about public domain works for example? Or you had a good faith belief you had permission from the copyright holder, eg someone misrepresented themselves as the copyright holder, or the copyright holder published the code in public without a copyright notice?

I have good faith belief that all software on torrent trackers are in public domain or had permission from the copyright holder.

As you see, it doesn't change anything: I will be downvoted, then sued, then jailed despite my beliefs.

Re: Major bank accidentally published a private package to the public NPM Registry

#159

Post by bachmeier »

kevin_thibedeau wrote: post #150
benatkin wrote: post #70

Earlier quoted context omitted.

They never contacted a human at npm, they just went straight over their heads.

Npm should have a forced arbitration clause for anyone posting code under US jurisdiction. Then they can pull a procedural power play.

That wouldn't help. The bank's accusing them of publishing stolen code.

Re: Major bank accidentally published a private package to the public NPM Registry

#160

Post by delfinom »

gpm wrote: post #151
syntheticcdo wrote: post #29

Earlier quoted context omitted.

How is this DMCA abuse? A copyright owner is requesting that a site that has safe harbor protection remove an unauthorized copyrighted work. The employee that originally created the unauthorized package may no longer work for the bank, unable to be identified, or doesn't have the credentials anymore.

The banks employee granted NPM a (probably) valid license to distribute the code (quoted below - from the tos). Submitting a DMCA request claiming requires claiming under penalty of perjury that no such license exists. That's (probably) incorrect, any lawyer reasonably knows that a license would have been granted, and as such (probably) criminal. Unfortunately (?) this sort of perjury is never prosecuted in practice.…

They can't make the argument that the bank employee had no legal right to grant NPM a license as the bank owns the copyright and not the employee?
Post reply on HN