Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

bleepingcomputer.com

Post reply on HN
Print view View original

21–30 of 1001 posts

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#21

Post by notRobot »

Here's my $.02:

Packages are literally remote code exec vulns in the hands of package authors. At the very least, it takes them under a minute to break your app, simply by deleting their package. Read the article. This is not the first time it's happened, and it's not going to be the last. [0]

I write backends (mostly in PHP, although not exclusively), and I release a lot of my code under libre licenses. But I don't do packages. I don't want that level of control over other people's projects, it's scary as fuck. I have enough responsibilities as is.

I have a mailing list for people who use my code, when an update is out they can download the .php files, 'require' them and test them before deployment, but never will I do packages.

IMO, re-inventing the wheel sometimes is not the worst thing. Including code written by strangers that you haven't inspected and that they can remotely modify is. Stop using packages that are essentially wrappers around three-line Stack Overflow answers.

In this case, the old-fashioned way is the better way, and you'll have a hard time convincing me otherwise.

[0]: https://qz.com/646467/how-one-programmer-broke-the-internet-...

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#22

Post by not2b »

esarbe wrote: post #10
dagmx wrote: post #4

Earlier quoted context omitted.

GitHub ToS allow terminating accounts for malicious behaviour, which I'd argue that purposefully breaking downstream code is.

Why would the developer of any software that comes explicitly without warranty be hold responsible for downstream breakages? It's not as if one could force people to upgrade to newer versions and they can always keep depending on the old releases.

In this case, the developer's behavior was malicious: they intentionally caused damage. This is very different than some good faith change that breaks stuff downstream. Sure, the license says "no warranty". But github can decide that they won't tolerate vandals on their platform. It would be within their right to revert the bad change from the git database they hold, go back to the last good change and lock the developer out.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#24

Post by not2b »

ulimn wrote: post #11
esarbe wrote: post #9

It's his software and he can do with it as he pleases. It's an MIT license, so there's no warranty whatsoever. I'm not convinced that GitHub has any business suspending his account.

If he can do as he pleases, can't GitHub as well?

GitHub also has rights. They can choose to boot vandals off. They can choose not to host intentional malware.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#26

Post by evolve2k »

My sense is that it’s time to evolve licensing such that wealthy major consumers of packages that have become somewhat essential are naturally paying a licence fee.

The problem is not in what the code does it’s a problem with the agreement for use.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#27

Post by MaxBarraclough »

notRobot wrote: post #21

Here's my $.02: Packages are literally remote code exec vulns in the hands of package authors. At the very least, it takes them under a minute to break your app, simply by deleting their package. Read the article. This is not the first time it's happened, and it's not going to be the last. [0] I write backends (mostly in PHP, although not exclusively), and I release a lot of my code under libre licenses. But I don't…

> I don't want that level of control over other people's projects, it's scary

How far do you take this though? The average GNU Linux distro ships with a whole pile of packages already installed, from a multitude of different authors.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#28

Post by rajin444 »

MaxBarraclough wrote: post #27
notRobot wrote: post #21

Here's my $.02: Packages are literally remote code exec vulns in the hands of package authors. At the very least, it takes them under a minute to break your app, simply by deleting their package. Read the article. This is not the first time it's happened, and it's not going to be the last. [0] I write backends (mostly in PHP, although not exclusively), and I release a lot of my code under libre licenses. But I don't…

> I don't want that level of control over other people's projects, it's scary How far do you take this though? The average GNU Linux distro ships with a whole pile of packages already installed, from a multitude of different authors.

There’s no reason people can’t keep local caches of these libs if it is a major concern. This seems like a non issue.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#30

Post by evolve2k »

evolve2k wrote: post #26

My sense is that it’s time to evolve licensing such that wealthy major consumers of packages that have become somewhat essential are naturally paying a licence fee. The problem is not in what the code does it’s a problem with the agreement for use.

Actually in attempting to answer my own question, on other platforms like YouTube and Medium, popular content receives monetary support by virtue of being popular.

What if this was addressed at the “platform” level, I’m thinking the package manager here, NPM.

If npm had paid plans that would essentially mop up larger corporations they could then auto-distribute funds Spotify style based on “number of listens”.

I’d personally want to see this work mainly as enterprise plans.

Post reply on HN