Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

bleepingcomputer.com

Post reply on HN
Print view View original

41–50 of 1001 posts

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#41

Post by grammarnazzzi »

gfykvfyxgc wrote: post #3

I don’t understand the mindset of open source developers who dedicate significant time energy and life to free software, unless there’s a tangible, quantifiable advantage to doing so. That advantage may well be indirect such as reputational or learning. I just don’t grasp why people do it for nothing, to the advantage of large companies.

> I don’t understand the mindset of open source developers who dedicate significant time energy and life to free software, unless there’s a tangible, quantifiable advantage to doing so.

They get: meaning, status, influence, connections, reputation, and opportunities

The free and open nature of their contribution makes it much easier to get all these benefits than they would with a paid and proprietary solution.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#42

Post by capableweb »

detaro wrote: post #39
capableweb wrote: post #36

Doesn't it seem strange that Snyk is creating a vulnerability report for this + labeling it a DoS? DoS is something someone executes against a target, in this case a package had it's functionality (purposefully) altered. That's like calling changing the API of a popular library DoS, because now application authors need to change their code/use a different library... Fittingly enough, all four solutions for this parti…

Introducing a deliberate endless loop is not like changing the API of a library, no.

But if the API offered a function called .countBy but then renamed that function to be .countAllBy, now I can't run my application anymore, causing my service to go down if I upgrade the version without testing it, is that a DoS now?

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#43

Post by heluser »

notRobot wrote: post #21

Here's my $.02: Packages are literally remote code exec vulns in the hands of package authors. At the very least, it takes them under a minute to break your app, simply by deleting their package. Read the article. This is not the first time it's happened, and it's not going to be the last. [0] I write backends (mostly in PHP, although not exclusively), and I release a lot of my code under libre licenses. But I don't…

To resolve such issues the central maven repo, for example, makes artifacts immutable when you publish them

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#44

Post by detaro »

capableweb wrote: post #42
detaro wrote: post #39

Earlier quoted context omitted.

Introducing a deliberate endless loop is not like changing the API of a library, no.

But if the API offered a function called .countBy but then renamed that function to be .countAllBy, now I can't run my application anymore, causing my service to go down if I upgrade the version without testing it, is that a DoS now?

no. is it really that complex of a concept that intent of a change matters too, and introducing an endless loop to cause trouble to users is different from a legitimate API change that does a useful thing?

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#45

Post by MaxBarraclough »

rajin444 wrote: post #28
MaxBarraclough wrote: post #27

Earlier quoted context omitted.

> I don't want that level of control over other people's projects, it's scary How far do you take this though? The average GNU Linux distro ships with a whole pile of packages already installed, from a multitude of different authors.

There’s no reason people can’t keep local caches of these libs if it is a major concern. This seems like a non issue.

Stale libraries are more likely to contain known security vulnerabilities.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#48

Post by rackjack »

evolve2k wrote: post #26

My sense is that it’s time to evolve licensing such that wealthy major consumers of packages that have become somewhat essential are naturally paying a licence fee. The problem is not in what the code does it’s a problem with the agreement for use.

This is already kind of happening with GPL for open source and Paid for commercial projects.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#49

Post by jayski »

hartator wrote: post #46

Anyone knows what the author meant by the "LIBERTY LIBERTY LIBERTY" message? It's unclear if it's referring to current authoritarian turns in our western world, big corps using his software for free, or something else.

or the insurance company jingle
Post reply on HN