In our company access to public repos is blocked.
I was upset about it when it was introduced, but now I start to see the point...
Major bank accidentally published a private package to the public NPM Registry
161–170 of 236 posts
Re: Major bank accidentally published a private package to the public NPM Registry
#162This really isn't news, folks. It happens every week. I was just grumpy this morning.
If this happens often, perhaps the user interface for npm publish needs to change? I mean, that's the only thing I can see mitigating this, with like a nice dialog that says "hey, are you REALLY REALLY sure and have you consulted lawyers on this???" Or something to that effect. Or maybe companies can just pony up for NPM Enterprise which fits their use case.
I work at a major bank and for the US Army. Both of those organizations are hyper sensitive about security for good reasons. Unfortunately that hyper sensitivity often results in really bad decisions and gross misunderstanding of software.
Publishing software is not a security violation in greater than 98% of cases. The only valid exceptions are protections of trade secrets and cryptographic information.
I am not counting software with embedded credentials, embedded business data, or other bad practices. Those are security violations regardless of public exposure.
Trying to explain this to security sensitive organizations is painful. I am confident in the stupidity of this conversation as somebody who has been writing code for more than 20 years and passed the CISSP exam the first time back when it was a 250 question paper test.
Re: Major bank accidentally published a private package to the public NPM Registry
#163Earlier quoted context omitted.
We're talking about code. Which is more like a recipe than a novel. If Coca Cola writes down its proprietary recipe on their entrance "by mistake", I can definitely make use of it. Maybe I can't photocopy it for sale, but I can definitely re-use their previously-secret techniques. I can even say I got it from them through their own error and have the exact same outputs for the exact same inputs. Trade secrets aren't…
> Which is more like a recipe than a novel. Courts strongly disagree with you.
Do they?
If you reverse engineer a system and write a spec using clean-room technique, it's going to be massively easier for the team to do it if they have lawful access to the no-longer proprietary source code.
And wouldn't that be the method to re-create your own copyrightable implementation of GPL code too?
Re: Major bank accidentally published a private package to the public NPM Registry
#164Tell them it's a $35 fee for every erroneous publish. They understand fees.
They wouldn’t believe it’s real at $35.
Maybe $35/byte. Then the lawyers could haggle, get it reduced to $35/non-white space byte, and feel like they accomplished something.
Re: Major bank accidentally published a private package to the public NPM Registry
#165Earlier quoted context omitted.
That is absolutely not true, and it flies in the face of the notion of "due diligence". This bank uploaded their own code to the repo, and when they found it they didn't bother to do any investigating before they started sending legal demands. It was 100% their responsibility to ensure that they were not responsible for their own leak before they started making legal threats. They decided to skip due diligence, and t…
The upload itself does not constitute the Company's policy. It is not "The Bank's" action. There is a legal standard for a company's action, which is a signature by an executive or possibly a lower signing officer. The employee that uploaded this almost certainly is not an officer. Their failure to discover that the upload was their own error is their failure. Thus, a DMCA request is appropriate, as the GP points out…
IIRC that's not quite how it works. It can be complex but one element often involved is whether the third-party had an objectively reasonable belief that the employee had the requisite authority. Who else than a software engineer would be uploading to a code repository?
That said, that relates mostly to vanilla contract and agency law. Copyright law can add its own twists.
Re: Major bank accidentally published a private package to the public NPM Registry
#166Earlier quoted context omitted.
Npm should have a forced arbitration clause for anyone posting code under US jurisdiction. Then they can pull a procedural power play.
That wouldn't help. The bank's accusing them of publishing stolen code.
The bank, as a corporate entity, posted the disputed code. It doesn't matter that the right hand doesn't know what the left hand did.
Re: Major bank accidentally published a private package to the public NPM Registry
#167Earlier quoted context omitted.
The banks employee granted NPM a (probably) valid license to distribute the code (quoted below - from the tos). Submitting a DMCA request claiming requires claiming under penalty of perjury that no such license exists. That's (probably) incorrect, any lawyer reasonably knows that a license would have been granted, and as such (probably) criminal. Unfortunately (?) this sort of perjury is never prosecuted in practice.…
They can't make the argument that the bank employee had no legal right to grant NPM a license as the bank owns the copyright and not the employee?
Yeah they can. This whole thing sounds ridiculous. I have a hard time imagining this ending any other way than the code being removed if the bank presses the issue.
Re: Major bank accidentally published a private package to the public NPM Registry
#168Earlier quoted context omitted.
At some points in a language and its package management system's lifetime, reducing barriers to publishing are one of the best things that can be done to increase packages and fill out the ecosystem, and drive utility and adoption. Later, once you have most needs filled by packages, and a good number of enterprise users, more control is beneficial. Companies appreciate it, and single users are willing to jump through…
Please don't think this way. This is such a solvable problem. Doesn't package.json have an is private repo flag? Why not just respect that? Why does everyone everyone in this thread think a pop up is the solution? Pop ups are a code smell. They mean your application does not correctly match user intent with the action so badly you had to specifically get your user to tell you what they meant to do. Did you mean to do…
> Pop ups are a code smell. They mean your application does not correctly match user intent with the action so badly you had to specifically get your user to tell you what they meant to do.
Not a rule. Do you really want undoable actions like "Delete" to just delete in a touch operated interface?
Re: Major bank accidentally published a private package to the public NPM Registry
#169In our company access to public repos is blocked. I was upset about it when it was introduced, but now I start to see the point...
You can't install from npm?