Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

bleepingcomputer.com

Post reply on HN
Print view View original

201–210 of 1001 posts

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#201

Post by bee_rider »

mschuster91 wrote: post #162
bee_rider wrote: post #89

Earlier quoted context omitted.

Packing is most of the point of a distro. They are specifically taking on that responsibility. They also have a better perspective to handle overall compatibility. In a sense you've pointed out the alternative to having the programmer handling the packaging -- having some third party package and distribute. And this separation of responsibility turns out be almost always be a better solution. Distribution and coding…

Given that Debian (and its descendants...) packages a shitload of npm packages, it's a wide stretch to say there is more QA for these packages from the Debian side than there is from the npm side. The one thing that Debian provides is that in the case there is a security issue, admins worldwide only need to do "apt update && apt upgrade" and they are safe, without having to check all of the software that runs on thei…

I do think people would be served, generally, by being more aware of the fact that distros are not some doing some hardcore security vetting. But the alternative is just to use whatever was pushed up to NPM, right? In that case, Debian packager+NPM push > NPM push by definition, unless the Debian packager somehow provides negative QA, which seems unlikely. (Also, on the incredibly unlikely offchance that some Debian packager reads this comment -- your work is incredibly useful and I very much appreciate it, just trying to be realistic about what exactly is provided by your group!)

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#202

Post by IceDane »

starkd wrote: post #175
bastardoperator wrote: post #108

Should I get paid for my multiple contributions to faker (I don't think I should)? I've submitted several PR's for generating data all of which were accepted. Even back then the maintainer was barking about money... Honestly the project would be better off forked. He did not write this library entirely by himself, at this point I just see him as holding other committers contributions as hostage. It's a bad look, why…

I couldn't help but think the same thing. Seems like an incredibly immature way to handle it. He could have easily set an end date and state nothing will be maintained beyond that date. It's not a good look.

I don't think he cares at this point.

I think this is a person that has been driven to the absolute end of their patience. If he's really barely been getting by, then I can only imagine the sheer frustration he must be feeling. Not only are there swathes of fortune 500 companies which depend on his package but don't contribute a dime, but he also had a company with millions of dollars in funding look at his idea and then weaponize his own project to beat him to market.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#203

Post by stjohnswarts »

shaunpersad wrote: post #121

AITA for thinking that if you develop open-source software and your license permits anyone to use it for free, then complaining about no compensation is not a valid complaint? I totally understand that billionaire corporations use software like this for free. But the software maintainer has explicitly allowed _anyone_ to use it for free. If you don't want them to use it for free, license it as such. What am I not see…

It's all freedom of speech. You can express yourself. It doesn't mean you aren't shouting into an uncaring void though… which is what I imagine most of the HN audience is when you're asking for sympathy when you released your software in a libre manner.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#204

Post by throw_m239339 »

mschuster91 wrote: post #146
throw_m239339 wrote: post #126

Earlier quoted context omitted.

> The they have gotten the right for npm to distribute the source code in context of npm. There is absolutely no copyright or publishing right transfer that takes place when one "publishes" a package on NPM (or on Github). None. The original author is absolutely entitled to a DMCA takedown notice and NPM would have to oblige him.

You can't legally retract opening up software source code under most if not all popular open source licenses.

open source =/= free software.

That's the first mistake you are making.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#205

Post by yashap »

fault1 wrote: post #80
hartator wrote: post #46

Anyone knows what the author meant by the "LIBERTY LIBERTY LIBERTY" message? It's unclear if it's referring to current authoritarian turns in our western world, big corps using his software for free, or something else.

The author of this package was caught with 50lbs of Potassium Nitrate (in the middle of NYC) and a bunch of materials on making bombs and booby traps when his apartment caught fire: https://abc7ny.com/suspicious-package-queens-astoria-fire/64... https://www.qgazette.com/articles/more-charges-possible-for-... https://nypost.com/2020/09/16/resident-of-nyc-home-with-susp... He might have been the unibomber in training.…

He’s also going on about a wild conspiracy theory about Aaron Swartz getting assassinated because he was on to Ghislaine Maxwell, or something like that. And linking it to his open source comments in a way that doesn’t seem to make sense.

He’s almost certainly going through major mental issues, along the lines of schizophrenia or something similar. He needs help.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#206

Post by dathinab »

throw_m239339 wrote: post #126
dathinab wrote: post #103

Earlier quoted context omitted.

Except if they have reason to believe the code was uploaded with the permission of the copyright holder. The they have gotten the right for npm to distribute the source code in context of npm.

> The they have gotten the right for npm to distribute the source code in context of npm. There is absolutely no copyright or publishing right transfer that takes place when one "publishes" a package on NPM (or on Github). None. The original author is absolutely entitled to a DMCA takedown notice and NPM would have to oblige him.

First you agreed to ToS when you uploaded things to npm. I haven't read the terms but it should be enough for npm to publish on npm no matter the license.

Secondly and as important if you publish something under an Open Source license(1) then you _cannot unpublish it_. You granted copyright to _everyone_ for and existing both now and in the future to distribute and use it(2) (legally it's a bit more complex but that's what it boils down to).

(1): Assuming you had the legal right to do so, but if not you are liable for any fall out, not npm (because ToS, they still need to take it down reasonable fast, but they might be able to sue you).

(2): Within the constraints of the license.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#207

Post by stjohnswarts »

melony wrote: post #134
shaunpersad wrote: post #121

AITA for thinking that if you develop open-source software and your license permits anyone to use it for free, then complaining about no compensation is not a valid complaint? I totally understand that billionaire corporations use software like this for free. But the software maintainer has explicitly allowed _anyone_ to use it for free. If you don't want them to use it for free, license it as such. What am I not see…

That's fine, but then the downstream shouldn't complain either when the code breaks, whether intentionally or unintentionally. The contract on paper disclaims all liability after all. There is a social contract and then there is the literal contract. A lot of commenters here seem to be willfully obtuse or simply ignoring the former.

It still doesn't mean you can't call the guy out for being an asshole. However, that's the only relief you'll get in matters such as these. Other avenues would be to tweet about it and make it known that this is what you can expect from the same guy in the future so avoid him for future work as he won't be acting like an adult.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#208

Post by shukantpal »

melony wrote: post #134
shaunpersad wrote: post #121

AITA for thinking that if you develop open-source software and your license permits anyone to use it for free, then complaining about no compensation is not a valid complaint? I totally understand that billionaire corporations use software like this for free. But the software maintainer has explicitly allowed _anyone_ to use it for free. If you don't want them to use it for free, license it as such. What am I not see…

That's fine, but then the downstream shouldn't complain either when the code breaks, whether intentionally or unintentionally. The contract on paper disclaims all liability after all. There is a social contract and then there is the literal contract. A lot of commenters here seem to be willfully obtuse or simply ignoring the former.

> That's fine, but then the downstream shouldn't complain either when the code breaks, whether intentionally or unintentionally.

There's no contract that says complaining is banned.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#209

Post by josephcsible »

dane-pgp wrote: post #144
throw_m239339 wrote: post #83

Earlier quoted context omitted.

> This is true for npm. After the incident with leftpad, you can't unpublish anymore. You can, however, publish a new patch update that completely breaks everything. You absolutely can unpublish, it just requires more steps. If NPM gets a DMCA takedown request they will absolutely have to fulfill it.

> If NPM gets a DMCA takedown request they will absolutely have to fulfill it. Assuming the package is released under a Free Software licence, what grounds would there be for a DMCA takedown? I suppose a developer could include the lyrics to a pop song in their code (possibly encrypted), and then tell the copyright holder about it (since I don't think you can make a DMCA request on behalf of a copyright holder withou…

> I don't think you can make a DMCA request on behalf of a copyright holder without their permission

In theory, you're right. In practice, there's never any actual consequences for filing a false DMCA claim. Worst case is that the thing doesn't get taken down, but that's no worse than if they didn't file it at all.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#210

Post by ldjb »

wbl wrote: post #92
mjlawson wrote: post #58

Earlier quoted context omitted.

This is true for npm. After the incident with leftpad, you can't unpublish anymore. You can, however, publish a new patch update that completely breaks everything.

Why does a new version break projects without action by the project owners? In Go you would have to explicitly update to the broken version.

Very often, package installation is automated as part of a build pipeline. So if you want to build and deploy a new version of your software, you'll kick off the pipeline and that could potentially download a newer version of a package than was previously being used.

Incidents like this highlight that this may not be the best idea.

Post reply on HN