Do you think npm is a flawed design ?
Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
251–260 of 1001 posts
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#252Earlier quoted context omitted.
> If NPM gets a DMCA takedown request they will absolutely have to fulfill it. Assuming the package is released under a Free Software licence, what grounds would there be for a DMCA takedown? I suppose a developer could include the lyrics to a pop song in their code (possibly encrypted), and then tell the copyright holder about it (since I don't think you can make a DMCA request on behalf of a copyright holder withou…
> I don't think you can make a DMCA request on behalf of a copyright holder without their permission Tell that you Youtube's copyright trolls
The people trolling YouTube over copyright are either making false Content ID claims[0] (not DMCA takedown requests), or claiming infringement based on an incorrect match of something they genuinely hold the copyright on.[1]
You're probably right, though, that there is enough imprecision in the system for someone to claim that someone else's code snippet infringes on the copyright of a code snippet the claimant had previously published.
[0] https://torrentfreak.com/u-s-indicts-two-men-for-running-a-2...
[1] https://freebeacon.com/culture/google-youtube-algorithm-copy...
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#253Earlier quoted context omitted.
Quoted post unavailable.
Sorry, this is bullshit. > When investigators entered Squires' apartment to look further, they found more bomb making items including potassium nitrate. Magnesium powder, sulfur powder, copper powder, aluminum powder, hobby fuse and mixing cups were also discovered in the home. "The chemicals separately are what they are, but taken together they can assemble an explosive device," Deputy Commissioner of Intelligence a…
> You can do chemistry all your want, but attempting to build a bomb, even of the attempt doesn't succeed, is illegal.
I will also say, that as a native New Yorker, doing this type of "kitchen chemistry" (if that was he was doing) is _extremely_ reckless in a dense residential neighborhood.
He was either was just a hobbyist who liked experimenting with explosives and he was fine with recklessly endangering an entire community.... or he was planning to commit a bombing.
A different article:
> On Thursday, law enforcement sources told News 4 the fire started because he had a box next to his stove that caught fire. He tossed it, trying to douse the flames, and it landed in his living room, which then also caught fire.
So he went to the hospital with severe burns on his hands. We don't know yet exactly what he was doing, but I don't think he deserves anybody's sympathy. That has its limits.
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#254Some people find this too rough, but the reality is: do not license something as MIT or any free license if you are not happy with commercial users benefiting from your work . Simple as that. None of them are under any obligation to pay, maintain, promote, or not clone your project.
Also let's keep in mind that these projects would never have achieved their level of popularity if they were not licensed liberally. The value he's provided was based on free; you can't then compare it to the alternative after the fact.
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#255Earlier quoted context omitted.
Adding this kind of disclaimer notice doesn't mean you can do whatever you want. If you perform action in obviously bad faith, your account will be suspended – it's very simple. Github's terms of service must have somewhere detailed description about it.
> Github's terms of service must have somewhere detailed description about it. Please, point me to the part where bugs, intentional or not, are disallowed. Taking over someone's account is not justified; for this, definitely, but I'd say it's never is. Block the account yes; take over, no.
https://docs.github.com/en/github/site-policy/github-terms-o...
>GitHub has the right to suspend or terminate your access to all or any part of the Website at any time, with or without cause, with or without notice, effective immediately. GitHub reserves the right to refuse service to anyone for any reason at any time.
github owns your account -- if the github company thinks they should terminate your account, they will.
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#256Earlier quoted context omitted.
You're using a VCS I presume? Why not just rollback?
The replies here (and on twitter) really are making me realize a lot of the hurt that will possibly stem from marak's actions really were ripe to happen given the sheer number of javascript developers who don't understand at all what they're doing. IT people for some reason tend not to be great at introspection which tells me this won't be fixed because this is more than just one asshole dude, this is a systemic issu…
Anecdotal but everywhere I've worked on JS codebases has used lockfiles. It might be this isn't affecting that many but those it is affecting are loud.
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#257Earlier quoted context omitted.
That's fine, but then the downstream shouldn't complain either when the code breaks, whether intentionally or unintentionally. The contract on paper disclaims all liability after all. There is a social contract and then there is the literal contract. A lot of commenters here seem to be willfully obtuse or simply ignoring the former.
It still doesn't mean you can't call the guy out for being an asshole. However, that's the only relief you'll get in matters such as these. Other avenues would be to tweet about it and make it known that this is what you can expect from the same guy in the future so avoid him for future work as he won't be acting like an adult.
That also does not mean you cant call out the corporations that are leaching off open source...
I find it ironic that people are more upset at this guy for complaining about corporations, than they are about the corporations leaching...
the dev and hacker communities have really gone full on #HailCorporate haven't they. Where did my anti-establishment Libre community of the 90's go... I long for the good old days
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#258Here's my $.02: Packages are literally remote code exec vulns in the hands of package authors. At the very least, it takes them under a minute to break your app, simply by deleting their package. Read the article. This is not the first time it's happened, and it's not going to be the last. [0] I write backends (mostly in PHP, although not exclusively), and I release a lot of my code under libre licenses. But I don't…
I’m a self taught Python programmer. I haven’t don’t much front end. Why do some JS devs import tiny packages to do simple things? I don’t feel like I’ve seen this behavior in Python. Is it because browsers are an awful environment?
npm (or yarn) for the most part works much better than python package managers
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#259GitHub has now suspended the maintainer: https://nitter.net/marak/status/1479200803948830724
I don't understand why. It's his code to break if he wants. But I guess when you use a social media service to host your code these are expected and normal results.
Is it his code to inject a backdoor in?
As another commenter said[0], this is malicious code and THAT is against the ToS of npm[1].
[0] https://news.ycombinator.com/item?id=29865977 [1] https://docs.npmjs.com/policies/open-source-terms#:~:text=Co...
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#260Earlier quoted context omitted.
When you publish free software you give it away as a gift. That's the point. Expecting compensation for a gift is the error.
Free as in freedom is not the same as free as in beer. This model where someone develops something for free and then those that benefit the most don't contribute back isn't sustainable. I don't know if the packages owner was conscious about it but this was a political act and hopefully the impact will be positive. From where we are we have two options: (1) companies find a way to make open source financially rewardin…
Both seem to result in more jobs for devs:
- Devs do open source and get rewarded
- Devs get hired to make crappy alternative software for companies