Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Major bank accidentally published a private package to the public NPM Registry

twitter.com

Post reply on HN
Print view View original

211–220 of 236 posts

Re: Major bank accidentally published a private package to the public NPM Registry

#211

Post by burfog »

jjeaff wrote: post #156
pbhjpbhj wrote: post #137

Earlier quoted context omitted.

>some dev didn't realize Surely in a bank, when publishing, the decisions aren't down to a single dev. Either many people made a mistake together or many people made lots of small mistakes separately that added up to one big one?? FWIW, I don't know, I'm a small time potter, just how I imagine things happen in banks (I do know a couple of devs who work/worked for banks).

You are going to have a ton of technical barriers in place if you are going to stop everyone from publishing to one of the many and varied code repos out there.

An air gap will stop innocent mistakes and outsiders.

Re: Major bank accidentally published a private package to the public NPM Registry

#212

Post by burfog »

orthoxerox wrote: post #175
woutr_be wrote: post #172

Earlier quoted context omitted.

Most likeley they have an internal npm repository that mirrors all the packages, only available through a proxy. At least that's how it works where I work, other than having to set up your proxy settings once, there's no noticable difference.

That's the best practice that should really be implemented everywhere. The proxy can even filter the packages by license, so you don't put AGPL code into your e-banking solution by negligence.

It is part of best practice. You really should have an air gap. Consider the problem of malware connecting out and then giving an attacker a VPN into your network.

Re: Major bank accidentally published a private package to the public NPM Registry

#213

Post by philliphaydon »

omouse wrote: post #73
seldo wrote: post #3

This really isn't news, folks. It happens every week. I was just grumpy this morning.

If this happens often, perhaps the user interface for npm publish needs to change? I mean, that's the only thing I can see mitigating this, with like a nice dialog that says "hey, are you REALLY REALLY sure and have you consulted lawyers on this???" Or something to that effect. Or maybe companies can just pony up for NPM Enterprise which fits their use case.

It should not auto create accounts. Compared to Nuget. I find NPM absolutely scary to use because it’s unpredictable. (Personal opinion)

Re: Major bank accidentally published a private package to the public NPM Registry

#214

Post by benj111 »

icebraining wrote: post #206
benj111 wrote: post #181

Earlier quoted context omitted.

Copyright older than 30 years still requires the notice (and this is banking software). My underlying point though was that it was an unreasonable answer, to just copy paste the previous answer. No one here that I've seen has claimed to be a lawyer, and no one I've seen has defined what nations laws we are talking about. At that level of discourse, the question posed, deserved a reasonable answer.

> Copyright older than 30 years still requires the notice Nope, only on works published over 30 years ago. This package was published only three years ago, regardless of when it was created. There really isn't much nuance under the copyright rules almost universally agreed under treaties like Berne, UCC and TRIPS. This kind of what-ifing a clear statement just sounds like a bad movie trope.

We don't know when it was first published though. If its Cobol code, with dates from the 70s in the comments, that's different to if being JavaScript or some such.

And if you get enough money and lawyers in one place you can create plenty of nuance.

Dragonwriter reminded me of the term, implied licence in another subthread. That clearly seems arguable in this case even if it isn't considered winnable. Case law progresses through winning 'unwinnable' cases.

I think we're approaching this from completely different positions though. I appreciate the what-ifing, exploring the hypotheticals. It isn't as if we have any power to make a difference in a court of law, and I would hope no one is relying on this thread for legal advice.

Re: Major bank accidentally published a private package to the public NPM Registry

#215

Post by arcatek »

Ndymium wrote: post #188

A recent experience tells me this is a very easy mistake to do, though. I was using Yarn to publish a package to an internal package repository (so setting `private: true` was not an option). I did not know at the time that Yarn would not honor `publishConfig` in the `package.json` file, and it would also ignore the package's organisation set in `.yarnrc` (which is used to direct read operations to the internal repos…

It would make sense to print the registry before asking for the new version in `yarn publish`, so that you get a chance to double-check that the publish target is what you expect. Will open a PR for the 1.16, unless someone beats me to it :)

Re: Major bank accidentally published a private package to the public NPM Registry

#216

Post by smackfu »

burfog wrote: post #211
jjeaff wrote: post #156

Earlier quoted context omitted.

You are going to have a ton of technical barriers in place if you are going to stop everyone from publishing to one of the many and varied code repos out there.

An air gap will stop innocent mistakes and outsiders.

And kill dev productivity.

Re: Major bank accidentally published a private package to the public NPM Registry

#217

Post by burfog »

smackfu wrote: post #216
burfog wrote: post #211

Earlier quoted context omitted.

An air gap will stop innocent mistakes and outsiders.

And kill dev productivity.

None of that productivity matters if the company dies due to being hacked into.

You might not even know that this happened. Mysteriously, a clone company pops up, or a competitor seems to know all your contract negotiations and customers.

Another possibility is that a lawsuit over data leakage takes out the company. Sometimes reputation alone can kill a company.

BTW, it's really pessimistic to suggest that an air gap would kill productivity. It isn't that hard to physically transfer files from the computer at your left to the computer at your right. The disconnected network can have copies of popular software repositories, including for your OS to get updates.

Re: Major bank accidentally published a private package to the public NPM Registry

#218

Post by huffstler »

redshat wrote: post #192

I work at a large bank and a majority (if not 98.98989%) of the employees are morons. This doesn't surprise me one bit. I hope we find out which bank it is, I would bet money on it being the one I am employed at. Banks do security through obscurity and worry more about COMPLIANCE than they do actual security and that is a fact.

As someone who also works at a bank (though not a large national one) I get the same feeling, though I understand it to an extent. Not complying to bank standards means you get dinged if you get audited. Getting dinged means you will most likely get your budget cut by an amount next quarter. Or get the group "reorganized".

Re: Major bank accidentally published a private package to the public NPM Registry

#219

Post by joshuacc »

Ndymium wrote: post #195
rounce wrote: post #193

Earlier quoted context omitted.

> What saved me was that the package was inside an organisation ("@foo/bar") and those are not free on NPM... (Public) Orgs _are_ free on NPM (at least nowdays) so maybe even that wouldn't have saved you.

Then I am not sure what did prevent publishing, but it was not published.

npm orgs are free, but the org has to be created before you can publish to an org's scope.

Re: Major bank accidentally published a private package to the public NPM Registry

#220

Post by colejohnson66 »

zaphirplane wrote: post #174
detaro wrote: post #66

Earlier quoted context omitted.

> If you don't have a license from the copyright holder, you can't legally use it, except for fair use exemptions: perhaps you could write a blog post criticizing it.

To be clear, do the files contains a copyright or licence, if they do not and many companies don’t attach a copyright header to their files. Why would the assumption be that the files are not public domain or free for use

Copyright law in the US grants a copyright to all works without an application (so not the same as a patent)
Post reply on HN