In our company access to public repos is blocked. I was upset about it when it was introduced, but now I start to see the point...
You can't install from npm?
[deleted]
Major bank accidentally published a private package to the public NPM Registry
171–180 of 236 posts
Re: Major bank accidentally published a private package to the public NPM Registry
#172In our company access to public repos is blocked. I was upset about it when it was introduced, but now I start to see the point...
You can't install from npm?
Most likeley they have an internal npm repository that mirrors all the packages, only available through a proxy.
At least that's how it works where I work, other than having to set up your proxy settings once, there's no noticable difference.
Re: Major bank accidentally published a private package to the public NPM Registry
#173This really isn't news, folks. It happens every week. I was just grumpy this morning.
So true. How many takedown requests per week do you think Apache.org gets from megacorps of the form "Our employee asked for help, and their debugging logs published our internal URLs. please delete this post and all replies" ?
Re: Major bank accidentally published a private package to the public NPM Registry
#174Earlier quoted context omitted.
Was there a licence attached to the files? What if there wasn’t
> If you don't have a license from the copyright holder, you can't legally use it, except for fair use exemptions: perhaps you could write a blog post criticizing it.
To be clear, do the files contains a copyright or licence, if they do not and many companies don’t attach a copyright header to their files. Why would the assumption be that the files are not public domain or free for use
Re: Major bank accidentally published a private package to the public NPM Registry
#175Earlier quoted context omitted.
You can't install from npm?
Most likeley they have an internal npm repository that mirrors all the packages, only available through a proxy. At least that's how it works where I work, other than having to set up your proxy settings once, there's no noticable difference.
That's the best practice that should really be implemented everywhere. The proxy can even filter the packages by license, so you don't put AGPL code into your e-banking solution by negligence.
Re: Major bank accidentally published a private package to the public NPM Registry
#176Earlier quoted context omitted.
If you leave you car keys at my house for 3 years does the change the answer? With the car parked on my drive? I'm not sure a car is the best comparison though. How about a restaurant putting mint imperials by the cash register. Is it legal for patrons to take one?
Property rights don’t go away because someone made it easy for you to violate them. Mints are put out explicitly for you to take. Property right intentionally transferred.
I have never ever seen a sign next to the mints saying they a free for patrons. I just assume because that's the done thing, I would make the same presumption about the software package.
Of someone leaves a car on my drive I can do something about it, you may not be able to do in your territory. I'm surprised there isn't the a legal concept of abandonment though, what do you do if someone drops an empty can on your land?
Re: Major bank accidentally published a private package to the public NPM Registry
#177Earlier quoted context omitted.
I have good faith belief that all software on torrent trackers are in public domain or had permission from the copyright holder.
As you see, it doesn't change anything: I will be downvoted, then sued, then jailed despite my beliefs.
That isn't demonstrating a good faith belief.
Buying a Rolex from some guy in a car park is different to buying one from a jewelers. The former wouldn't protect you in any way, the later would let you demonstrate a good faith belief that it wasn't stolen, and wasn't fake.
Re: Major bank accidentally published a private package to the public NPM Registry
#178Earlier quoted context omitted.
Perhaps inverting the logic there might be worth considering? Make it so you have to explicitly go in and mark your package.json as public before npm will publish it, and have the default be private? I don't have _too_ much sympathy for the bank here - it's in npm's best interest to make it easy to publish leftpad.js easily - and that probably should be their default stance. The bank should be responsible for ensurin…
What's impressive to me is you (and so many others) being charitable enough to assume that the original developer didn't intentionally publish this package. Some bank developer (or more likely, some underpaid contractor) wants to share something between projects and doesn't want the hassle of proper channels, or just doesn't care enough and thinks "I'll publish this, who will ever find it?". Years later someone stumb…
If there’s enough friction, no one would bother publishing to public repo instead of setting up private Nexus instance, which is quite easy. And it’s quite possible that the leak could happen on early stage of CI setup for that project (private flag removed, but wrong login used). It’s a mistake very easy to make: “private” flag is just not an appropriate tool for private CI.
Re: Major bank accidentally published a private package to the public NPM Registry
#179Earlier quoted context omitted.
At some points in a language and its package management system's lifetime, reducing barriers to publishing are one of the best things that can be done to increase packages and fill out the ecosystem, and drive utility and adoption. Later, once you have most needs filled by packages, and a good number of enterprise users, more control is beneficial. Companies appreciate it, and single users are willing to jump through…
Please don't think this way. This is such a solvable problem. Doesn't package.json have an is private repo flag? Why not just respect that? Why does everyone everyone in this thread think a pop up is the solution? Pop ups are a code smell. They mean your application does not correctly match user intent with the action so badly you had to specifically get your user to tell you what they meant to do. Did you mean to do…
I wasn't condoning popups. I was making a high level observation of package systems in general.
That said, I fully support a terminal level confirmation the first time something is pushed publicly in any package manager. It is absolutely the correct thing to do to add safeties to a process that is irreversible and can have negative consequences. Often enough, making anything public online is irreversible, and making something public that wasn't ever supposed to be can have negative consequences in many respects.
But what I was really thinking of when I was typing my original comment was moving to a system where someone actually approves new package publishing accounts and or some subset of package namespace requests. Systems that start without any sort of moderating or approval process seem to eventually settle on one. The reasons for this are numerous, from security to just keeping people from overwhelming the more common or sought after names and general sanity checks (does a system really need to allow separate packages for a term where one is singular and one is plural? Who does that help?).
Re: Major bank accidentally published a private package to the public NPM Registry
#180Earlier quoted context omitted.
> Doesn't package.json have an is private repo flag? Why not just respect that? npm does reflect that flag. If you set private in package.json, npm won't publish it publicly. From docs: > private > If you set "private": true in your package.json, then npm will refuse to publish it. > This is a way to prevent accidental publication of private repositories. If you would like to ensure that a given package is only ever…
Perhaps inverting the logic there might be worth considering? Make it so you have to explicitly go in and mark your package.json as public before npm will publish it, and have the default be private? I don't have _too_ much sympathy for the bank here - it's in npm's best interest to make it easy to publish leftpad.js easily - and that probably should be their default stance. The bank should be responsible for ensurin…
> it's in npm's best interest to make it easy to publish leftpad.js easily
That's what I was getting at above. It definitely was in NPM's best interest to do so. Depending on your definition of "easily", is it still in their interest to have it quite that easy? Perhaps a different default is in order now, as you suggest. Or perhaps it should even require a confirmation dialog on the terminal for the first public push? People will still use NPM at this point. Not having enough packages or a package for a specific functionality is hardly a problem for them any more.