Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

bleepingcomputer.com

Post reply on HN
Print view View original

261–270 of 1001 posts

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#261

Post by fxtentacle »

notRobot wrote: post #21

Here's my $.02: Packages are literally remote code exec vulns in the hands of package authors. At the very least, it takes them under a minute to break your app, simply by deleting their package. Read the article. This is not the first time it's happened, and it's not going to be the last. [0] I write backends (mostly in PHP, although not exclusively), and I release a lot of my code under libre licenses. But I don't…

In my opinion, golang does this correctly. You can just git submodule the source code of your dependencies. That way, you're always in control over what gets updated and when.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#262

Post by sailingparrot »

raesene9 wrote: post #7
dagmx wrote: post #4

Earlier quoted context omitted.

GitHub ToS allow terminating accounts for malicious behaviour, which I'd argue that purposefully breaking downstream code is.

That seems like a bit of a shaky ground to stand on for GH. If someone publishes code for themselves, and at no time asks anyone to take it as a dependency, then at a later date they change that code in a way that breaks other people's use of it, do GH then take over the account?

Sure, trying to find exactly where the malicious line gets crossed is pretty hard and subjective, and maybe that will bite GH one day. But this specific case is not anywhere near that line, the sole intent of those commits was to break others, and he admitted so himself.

This is like arguing about whether the james webb telescope really is in space since we don't have a precise consensus about what altitude is considered the frontier with space.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#263

Post by AmericanChopper »

oblio wrote: post #119
Osmose wrote: post #74

It's a bit wild that the sum total money spent on salaries for engineers handling potential problems stemming from this or defending against the possibility in the future could probably have covered paying the maintainer a living wage many times over.

Tragedy of the commons, shortsightedness and misaligned individual incentives. Individual contributors in large companies, especially, would want their companies to fund FOSS projects they use. But approval processes are generally extremely complicated and there's nothing to gain internally by doing it. And we're talking about money that these corporations spend each millisecond. They barely need approvals for many o…

Most of the companies that I’ve worked for have funded the FOSS that we used. By allowing me and my colleagues to contribute features we needed, or fix bugs that were affecting us. The core maintainers probably never knew these PRs were funded at an hourly rate paid for by some big bank, and sadly quite a few of the projects that I’ve contributed to have rug-pulled into some sort of non-FOSS enterprise product. We all benefit from FOSS, including all these disgruntled maintainers. The FOSS way should be to pay it forward, to contribute to projects where you can. If you’re expecting to get paid for it, it’s not FOSS. Deciding you can’t maintain a project anymore is fine, but pulling it out from under the people that are using it is incredibly anti-FOSS.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#264

Post by zdragnar »

pc86 wrote: post #223
dane-pgp wrote: post #144

Earlier quoted context omitted.

> If NPM gets a DMCA takedown request they will absolutely have to fulfill it. Assuming the package is released under a Free Software licence, what grounds would there be for a DMCA takedown? I suppose a developer could include the lyrics to a pop song in their code (possibly encrypted), and then tell the copyright holder about it (since I don't think you can make a DMCA request on behalf of a copyright holder withou…

> but I would hope that such a poison-pill would be caught long before the package became widely depended on. I'm not sure what about the current open source ecosystem makes you think anyone would catch something like this.

Funny, my company couldn't use Webpack 1 because a dependency of a dependency... depended on an ancient package from the days when it was common to not bother with attaching a license.

Legally, that meant that noone could use it. In practice, nobody but our legal department cared, so we had to wait for version 2 when the dependency chain was updated to remove it.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#265

Post by ozim »

maxclark wrote: post #113

What’s the fix here? Maintainers should be able to do whatever they want either their code But if they vandalize their modules that should be a lifetime ban from the registry It’s pretty obvious that node needs a better method for dealing with this by now

Companies/people should do due diligence and not accept libraries just because they are free somewhere on the internet and stop "staring".

This would make libraries less popular and would make "stars"/"downloads" less of a misguided status symbol that is only making things worse, because the more "stars"/"downloads" people have the better they feel. Then comes hangover when reality hits and such person is left with silly numbers that are not going to buy anything but also not helping to land a job.

That would make people who should not be in a maintainer position not to be there as it would stop being so attractive.

In the end there would be libraries/frameworks created by corporations that can afford that or by real enthusiasts that understand what they sign up for.

Did Linus Torvalds made Linux to be famous - not - he did it because he liked to have it. He made it into career and got famous, but he is an exception not the rule. There is too much people who are in it for the wrong reasons that is my conclusion.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#266

Post by Flocular »

epaulson wrote: post #167

It's time for someone to make a Redhat, but for "safe" open source software libraries. My big enterprise would sign up for it in a heartbeat. We'd pay for access from an alternative NPM registry where everything is at least semi-vetted - someone at least looks at diffs before new versions get updated and made available. Sure, the "safe" repo wouldn't have as nearly as many packages as the main NPM repo, but if it had…

I could see a govermental effort be approriate too. Alot of critical infrastructure is depending on open source too. Agencies like the German BSI should embrace and invest into open-source much more strongly.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#267

Post by franciscop »

msoad wrote: post #141

I do free work for open source _a lot_. I have a rather controversial opinion on this. I don't think I should be paid for my work because the moment money comes in I have to be responsible for the work I was doing for fun. I enjoy building cool things others can use for free and I want to reserve the right to respond to feature requests with a simple "PRs are welcome! :)". I get my paycheck from my employer and I hav…

I have a different opinion, but I respect yours; and that's the basis of open source. There's many, many vastly different reasons why people do open source, and partly probably why we haven't "banded together to get paid" so to speak.

For me, if I got donations that'd be great, but it'd not create a different sense of responsibility for my work, I'd keep doing exactly the same (unless I was explicitly hired as a contractor, but that's different). I do not particularly mind not being paid though, it's me who is putting my own code out there for people to use, for free!

Now I make mainly open source JS libraries and use the fairly liberal MIT, if I worked in end-products where there might be a bit more of a "competition" or a big company might literally repackage/resell your product I might release those under a different license, like dual-licensed or similar.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#268

Post by IceDane »

qaq wrote: post #233
IceDane wrote: post #202

Earlier quoted context omitted.

I don't think he cares at this point. I think this is a person that has been driven to the absolute end of their patience. If he's really barely been getting by, then I can only imagine the sheer frustration he must be feeling. Not only are there swathes of fortune 500 companies which depend on his package but don't contribute a dime, but he also had a company with millions of dollars in funding look at his idea and…

what idea?

https://web.archive.org/web/20210628030444/https://marak.com...

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#270

Post by aaaaaaaaaaab »

oneoff786 wrote: post #240
notRobot wrote: post #21

Here's my $.02: Packages are literally remote code exec vulns in the hands of package authors. At the very least, it takes them under a minute to break your app, simply by deleting their package. Read the article. This is not the first time it's happened, and it's not going to be the last. [0] I write backends (mostly in PHP, although not exclusively), and I release a lot of my code under libre licenses. But I don't…

I’m a self taught Python programmer. I haven’t don’t much front end. Why do some JS devs import tiny packages to do simple things? I don’t feel like I’ve seen this behavior in Python. Is it because browsers are an awful environment?

They don’t know better.
Post reply on HN