Major bank accidentally published a private package to the public NPM Registry • Hacker News Board

Re: Major bank accidentally published a private package to the public NPM Registry

#181

Post by benj111 » Tue, Mar 12, 2019, 6:52 AM UTC

icebraining wrote: post #142

benj111 wrote: post #86

Earlier quoted context omitted.

Theres nuance though, that copypasting a previous comment doesn't answer. What about public domain works for example? Or you had a good faith belief you had permission from the copyright holder, eg someone misrepresented themselves as the copyright holder, or the copyright holder published the code in public without a copyright notice?

Public domain: any software made to run on current machines is too new to have expired copyright; the author(s) may have dedicated it to the PD, but you have to find that dedication, which is equivalent to a license. Good faith: that may affect the amount of damages the copyright holder can extract, but it's still illegal to use the software. Copyright notices: haven't been required for 30 years.

Copyright older than 30 years still requires the notice (and this is banking software).

My underlying point though was that it was an unreasonable answer, to just copy paste the previous answer. No one here that I've seen has claimed to be a lawyer, and no one I've seen has defined what nations laws we are talking about. At that level of discourse, the question posed, deserved a reasonable answer.

Re: Major bank accidentally published a private package to the public NPM Registry

#182

Post by Nimelrian » Tue, Mar 12, 2019, 7:30 AM UTC

madeofpalk wrote: post #126

lugg wrote: post #104

Earlier quoted context omitted.

Please don't think this way. This is such a solvable problem. Doesn't package.json have an is private repo flag? Why not just respect that? Why does everyone everyone in this thread think a pop up is the solution? Pop ups are a code smell. They mean your application does not correctly match user intent with the action so badly you had to specifically get your user to tell you what they meant to do. Did you mean to do…

> Doesn't package.json have an is private repo flag? Why not just respect that? npm does reflect that flag. If you set private in package.json, npm won't publish it publicly. From docs: > private > If you set "private": true in your package.json, then npm will refuse to publish it. > This is a way to prevent accidental publication of private repositories. If you would like to ensure that a given package is only ever…

The npm docs also state that the "files" property of the package.json limits what gets installed if you install that package in another project.

Ever tried installing a local package via a file path? NPM just symlinks it into node_modules, causing issues because you suddenly have duplicated dependencies. Yarn does the same, btw.

I have given up any hope regarding npm/yarn acting sensible long ago.

Re: Major bank accidentally published a private package to the public NPM Registry

#183

Post by snazzycalynx » Tue, Mar 12, 2019, 7:32 AM UTC

This is annoying. Maybe npm can consider adding a confirmation prompt to publish if a new package is about to be created. Not sure if it'd prevented such ignorance though.

Re: Major bank accidentally published a private package to the public NPM Registry

#184

Post by dodobirdlord » Tue, Mar 12, 2019, 7:35 AM UTC

zaphirplane wrote: post #174

detaro wrote: post #66

Earlier quoted context omitted.

> If you don't have a license from the copyright holder, you can't legally use it, except for fair use exemptions: perhaps you could write a blog post criticizing it.

To be clear, do the files contains a copyright or licence, if they do not and many companies don’t attach a copyright header to their files. Why would the assumption be that the files are not public domain or free for use

Because unless otherwise stated, they just aren't.

Re: Major bank accidentally published a private package to the public NPM Registry

#185

Post by barrystaes » Tue, Mar 12, 2019, 7:55 AM UTC

symlinkk wrote: post #32

I hate how there's no official way to run your own private NPM registry. So you have to either pay NPM or resort to third party solutions like verdaccio. It's such an obvious money grab by the NPM devs.

Its not official, and not free, but GitLab can host NPM packages: https://about.gitlab.com/2019/01/22/gitlab-11-7-released/#np...

Re: Major bank accidentally published a private package to the public NPM Registry

#186

Post by Dylan16807 » Tue, Mar 12, 2019, 8:03 AM UTC

benj111 wrote: post #177

v_lisivka wrote: post #157

Earlier quoted context omitted.

As you see, it doesn't change anything: I will be downvoted, then sued, then jailed despite my beliefs.

That isn't demonstrating a good faith belief. Buying a Rolex from some guy in a car park is different to buying one from a jewelers. The former wouldn't protect you in any way, the later would let you demonstrate a good faith belief that it wasn't stolen, and wasn't fake.

This is a tangent but there's nothing wrong with buying a fake. So you can have a good faith belief that it was a counterfeit, which can protect you somewhat in the case that it was stolen.

Re: Major bank accidentally published a private package to the public NPM Registry

#187

Post by benj111 » Tue, Mar 12, 2019, 8:14 AM UTC

Dylan16807 wrote: post #186

benj111 wrote: post #177

Earlier quoted context omitted.

That isn't demonstrating a good faith belief. Buying a Rolex from some guy in a car park is different to buying one from a jewelers. The former wouldn't protect you in any way, the later would let you demonstrate a good faith belief that it wasn't stolen, and wasn't fake.

This is a tangent but there's nothing wrong with buying a fake. So you can have a good faith belief that it was a counterfeit, which can protect you somewhat in the case that it was stolen.

In the copyright example you're probably right.

More generally, say if wanted consumer protections consistent with it being a Rolex, or if you wanted to sell it as a Rolex. Then whether you bought it as a fake does matter.

Re: Major bank accidentally published a private package to the public NPM Registry

#188

Post by Ndymium » Tue, Mar 12, 2019, 8:17 AM UTC

A recent experience tells me this is a very easy mistake to do, though. I was using Yarn to publish a package to an internal package repository (so setting `private: true` was not an option). I did not know at the time that Yarn would not honor `publishConfig` in the `package.json` file, and it would also ignore the package's organisation set in `.yarnrc` (which is used to direct read operations to the internal repository).

What it did was ask me to "log in" (there was no prompt to sign up), which I did with our internal credentials. It also asked for an email address, which in retrospect was foolish of me to provide, but that was the only indicator that something was not right. It did not tell me where I would be publishing to.

When it was done it said the package was published. I checked the internal repository and it was not there. Instantly felt that horrible feeling in my stomach that everyone knows. I went to npmjs.com and found out that it had helpfully created an account with the internal credentials I provided, the credentials that were given in a prompt that said "npm login".

What saved me was that the package was inside an organisation ("@foo/bar") and those are not free on NPM, so the package was not published, even though Yarn said so. The user account was created, though, so I had to recycle that password and send email to NPM support to get the account deleted (there is no way to delete your account yourself, sadly).

The moral of this post is that when I saw this tweet I did not laugh at the company's foolishness in publishing internal code on NPM, because I almost did that myself and saw how easy the mistake is to make. (Of course, the rest of the tweet with the DMCA stuff is foolishness.)

Re: Major bank accidentally published a private package to the public NPM Registry

#189

Post by adrianhel » Tue, Mar 12, 2019, 8:24 AM UTC

kbenson wrote: post #180

bigiain wrote: post #135

Earlier quoted context omitted.

Perhaps inverting the logic there might be worth considering? Make it so you have to explicitly go in and mark your package.json as public before npm will publish it, and have the default be private? I don't have _too_ much sympathy for the bank here - it's in npm's best interest to make it easy to publish leftpad.js easily - and that probably should be their default stance. The bank should be responsible for ensurin…

> it's in npm's best interest to make it easy to publish leftpad.js easily That's what I was getting at above. It definitely was in NPM's best interest to do so. Depending on your definition of "easily", is it still in their interest to have it quite that easy? Perhaps a different default is in order now, as you suggest. Or perhaps it should even require a confirmation dialog on the terminal for the first public push…

They could just change it to `npm publish npm|url name` with some useful warnings. The name should be checked against package.name.

Then libraries could simply add an npm script for publishing.

    npm publish

    To publish a package to
    npm, you must enter:

      npm publish npm 

    To publish a package to
    another registry, you
    must enter:

      npm publish

Just as easy, just clearer.

Re: Major bank accidentally published a private package to the public NPM Registry

#190

Post by born2discover » Tue, Mar 12, 2019, 8:44 AM UTC

taarushv wrote: post #61

beager wrote: post #30

Earlier quoted context omitted.

You'd think it's like, some proprietary trading algorithm, but in reality it's probably their own implementation of left-pad.

It was a react package. Source: https://twitter.com/seldo/status/1105157348560007168?s=09

My bad, didn't see that one!