Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Major bank accidentally published a private package to the public NPM Registry

twitter.com

Post reply on HN
Print view View original

231–236 of 236 posts

Re: Major bank accidentally published a private package to the public NPM Registry

#231

Post by lucb1e »

seldo wrote: post #3

This really isn't news, folks. It happens every week. I was just grumpy this morning.

Can't you recycle some old lawyer letters then?

Or a little more radical, why even bother with the lawyers? You can explain to them how it is, and if they won't listen, they can sue you. Then you spend some lawyer costs, they lose because the whole thing is ridiculous, and you get a 'cost conviction' or 'cost order' as we call it (kostenveroordeling, where you pay the winning party's costs to prevent abuse of the system) so they pay your lawyer.

Re: Major bank accidentally published a private package to the public NPM Registry

#232

Post by mstade »

sh4dow wrote: post #230
Ndymium wrote: post #188

A recent experience tells me this is a very easy mistake to do, though. I was using Yarn to publish a package to an internal package repository (so setting `private: true` was not an option). I did not know at the time that Yarn would not honor `publishConfig` in the `package.json` file, and it would also ignore the package's organisation set in `.yarnrc` (which is used to direct read operations to the internal repos…

These days, I would never run publish myself in a corporate environment. A script that is triggered on pushing tags should take of that to precisely avoid such human errors. And of course changes to this script have to be reviewed. Also, a .rc file (package manager chosen by the team) with a private registry that refuses to publish unless done automatically by the pipeline set in the root of every project. The only r…

> These days, I would never run publish myself in a corporate environment. A script that is triggered on pushing tags should take of that to precisely avoid such human errors. And of course changes to this script have to be reviewed. > > Also, a .rc file (package manager chosen by the team) with a private registry that refuses to publish unless done automatically by the pipeline set in the root of every project.

This is how we do it. Publishing is locked down to specific service accounts, with credentials set up in a CI environment with locked down build configurations. Publishing to the internal registry is not possible unless you have these credentials, and you don’t. There’s a whole process for retrieving keys. Publishing to the internet isn’t possible due to a firewall just killing those requests dead. You could probably do it via a proxy, but you’d break your contract and probably be fired if not worse.

People complain about the locked down build configurations, until they need help at which point standard build configurations mean they actually get support, as opposed to “good luck; have fun!”

Source: I work for a major bank. (Presumably not the one this story is all about!)

Re: Major bank accidentally published a private package to the public NPM Registry

#233

Post by mstade »

redshat wrote: post #192

I work at a large bank and a majority (if not 98.98989%) of the employees are morons. This doesn't surprise me one bit. I hope we find out which bank it is, I would bet money on it being the one I am employed at. Banks do security through obscurity and worry more about COMPLIANCE than they do actual security and that is a fact.

I also work at one of the top tier banks but I’m not quite as doom and gloom as you. (Maybe I’m one of the 1.01011% – finally!)

It’s certainly true that some security practices within our organization seems more like security theater than anything else, but overall I think they have pretty reasonable standards and requirements set. It is very true though that the culture is almost entirely focused on compliance more than anything else, so there’re few proactive measures taken by teams. Lord knows no team I’ve ever seen outside of security wants to budget for it. Maybe it’s a damned if you, damned if you don’t kind of situation. If you don’t set compliance regulations you’ll get no security (move fast and break things, yay!) but if you do you end up with people ticking boxes saying “the thing is secure and stuff yo” and then play the blame game when it isn’t.

My feeling though, having worked with top tier banks in the financial industry for the last 8 years or so, is that more people are competent than not, but process stifles creativity and drive a lot of the time. It’s a very special kind of environment to work in.

Re: Major bank accidentally published a private package to the public NPM Registry

#234

Post by madeofpalk »

adrianhel wrote: post #189
kbenson wrote: post #180

Earlier quoted context omitted.

> it's in npm's best interest to make it easy to publish leftpad.js easily That's what I was getting at above. It definitely was in NPM's best interest to do so. Depending on your definition of "easily", is it still in their interest to have it quite that easy? Perhaps a different default is in order now, as you suggest. Or perhaps it should even require a confirmation dialog on the terminal for the first public push…

They could just change it to `npm publish npm|url name` with some useful warnings. The name should be checked against package.name. Then libraries could simply add an npm script for publishing. npm publish To publish a package to npm, you must enter: npm publish npm To publish a package to another registry, you must enter: npm publish Just as easy, just clearer.

cool, so now the developer that did this will just thoughtlessly type npm publish npm instead.

At the end of the day, there's only so much you can do. Really, a hammer shouldn't have a prompt on it confirming each hit. If it does, users will just instinctively press it and then a few months down the road they'll hit their thumb.

Re: Major bank accidentally published a private package to the public NPM Registry

#235

Post by tracker1 »

burfog wrote: post #217
smackfu wrote: post #216

Earlier quoted context omitted.

And kill dev productivity.

None of that productivity matters if the company dies due to being hacked into. You might not even know that this happened. Mysteriously, a clone company pops up, or a competitor seems to know all your contract negotiations and customers. Another possibility is that a lawsuit over data leakage takes out the company. Sometimes reputation alone can kill a company. BTW, it's really pessimistic to suggest that an air gap…

If your systems are so weak that seeing code puts you at risk, you have other issues.

Re: Major bank accidentally published a private package to the public NPM Registry

#236

Post by tracker1 »

symlinkk wrote: post #32

I hate how there's no official way to run your own private NPM registry. So you have to either pay NPM or resort to third party solutions like verdaccio. It's such an obvious money grab by the NPM devs.

There's LOTS of solutions for your own NPM, not to mention you can use git over ssh or http(s)... there are proxies, self-publish software. Some of it open-source, other options not so much. IIRC, you can even run your own npm if you wanted to.
Post reply on HN