Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

bleepingcomputer.com

Post reply on HN
Print view View original

281–290 of 1001 posts

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#281

Post by tln »

epaulson wrote: post #167

It's time for someone to make a Redhat, but for "safe" open source software libraries. My big enterprise would sign up for it in a heartbeat. We'd pay for access from an alternative NPM registry where everything is at least semi-vetted - someone at least looks at diffs before new versions get updated and made available. Sure, the "safe" repo wouldn't have as nearly as many packages as the main NPM repo, but if it had…

I think this could be done as a community.

Imagine if npm allowed organizations to publish "vetted pointers" to packages. So redhat could publish a "{redhat}colors", which would include only the vetted versions.

When installing, you could choose to setup your installation to allow "redhat-vetted" versions only. And that would apply even to sub-dependencies.

This becomes a community tool if "redhat" could tell npm to vet anything vetted by another org.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#282

Post by bcrl »

bcrl wrote: post #215
Xylakant wrote: post #77

Earlier quoted context omitted.

Signing would not have helped at all here - the author decided to nuke their project (and likely their last reputation), they could have signed that commit/package.

Requiring multiple signatures from several trusted sources would have.

I'm seriously downvoted for this? We have just had an incident where a maintainer acted maliciously and has demonstrated that a single point of trust is insufficient. If we really care about avoiding issues with open source software, clearly it is necessary to get multiple maintainers to sign off on changes to widely used open source projects. We have had all the technology components needed to implement this for decades, we just need the will to implement a system that is better. If we don't use this incident to improve, then it's going to happen again, and maybe the consequences will be worse.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#283

Post by [deleted] »

melony wrote: post #134
shaunpersad wrote: post #121

AITA for thinking that if you develop open-source software and your license permits anyone to use it for free, then complaining about no compensation is not a valid complaint? I totally understand that billionaire corporations use software like this for free. But the software maintainer has explicitly allowed _anyone_ to use it for free. If you don't want them to use it for free, license it as such. What am I not see…

That's fine, but then the downstream shouldn't complain either when the code breaks, whether intentionally or unintentionally. The contract on paper disclaims all liability after all. There is a social contract and then there is the literal contract. A lot of commenters here seem to be willfully obtuse or simply ignoring the former.

[deleted]

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#284

Post by sli »

I'll admit that I cracked up pretty good over this, and am glad that I'm not working in JS/TS every day anymore for reasons among these kinds, but I am firmly on the developer's side on this one. Github suspending the developer's account is well within the realm of the type of questionable actions I expected out of Github after its acquisition by MS and only makes me feel even better about my long-ago move to Gitlab (a story for another time).

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#286

Post by bdcravens »

IceDane wrote: post #202
starkd wrote: post #175

Earlier quoted context omitted.

I couldn't help but think the same thing. Seems like an incredibly immature way to handle it. He could have easily set an end date and state nothing will be maintained beyond that date. It's not a good look.

I don't think he cares at this point. I think this is a person that has been driven to the absolute end of their patience. If he's really barely been getting by, then I can only imagine the sheer frustration he must be feeling. Not only are there swathes of fortune 500 companies which depend on his package but don't contribute a dime, but he also had a company with millions of dollars in funding look at his idea and…

Of course he acknowledged his reality:

"they can legally copy your Intellectual Property"

But let's be honest - if they hadn't copied his, they could have easily used the Ruby or Perl version. All he did was port a previous library.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#287

Post by gremlinsinc »

notRobot wrote: post #21

Here's my $.02: Packages are literally remote code exec vulns in the hands of package authors. At the very least, it takes them under a minute to break your app, simply by deleting their package. Read the article. This is not the first time it's happened, and it's not going to be the last. [0] I write backends (mostly in PHP, although not exclusively), and I release a lot of my code under libre licenses. But I don't…

I often find myself... ripping out a lot of what I 'need' into something that maybe isn't always well-maintainable, but it's my fuckfest of code, and if something breaks it's because I choose to eff it up myself. Esp, when it's something API related, most php api sdk's are poorly maintained anyways and need updating as I go, plus I usually learn the api pretty well as I rebuild and test the new classes.

Ironically, I'm working on a laravel package myself that i'm hoping to maintain (and turn into a viable side project) that's basically jetstream with SaaS components, and UI elements... (think ui component libraries + laravel jetstream + extra SaaS/ERP things like tenancy beyond just teams but..like Org which can have teams, projects, employees, and each user can belong to multiple orgs, teams, projects, and have attached profiles to each.

For a lot of the UI stuff, I've basically repacked MIT stuff for tailwindcss components, and laravel/livewire added some extra configurations and options, and made it so you don't need Jetstream, just this thing... so a lot of it is actually other's packaged code pulled into one package so, ideally there's one dependency that could even be easily forked and repurposed for a team's needs but cover a lot of boilerplate possibilities.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#288

Post by umvi »

cerved wrote: post #269
umvi wrote: post #194

Earlier quoted context omitted.

Rollback what? You can't rollback someone else's dependencies.

Your source code obviously

In this case, the problem isn't in your own source code, it's in someone else's source code.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#289

Post by paulryanrogers »

hibikir wrote: post #170
tailspin2019 wrote: post #95

Earlier quoted context omitted.

> If npm had paid plans that would essentially mop up larger corporations they could then auto-distribute funds Spotify style based on “number of listens”. This seems like a pretty decent idea…

Until there's enough money in the pot that making your packages seem very important happens to be a productive use of one's time. At that point, you have to start dealing with fake downloads, dependencies added for no reason to somewhat more popular packages that aren't paying much attention... and suddenly you need to take money from the pool to pay for your fraud prevention team.

Perhaps download's value could be weighted by associated domains? For example if Apple.com is relying on it the author will get paid more than random.example

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#290

Post by bdcravens »

qaq wrote: post #278
IceDane wrote: post #268

Earlier quoted context omitted.

https://web.archive.org/web/20210628030444/https://marak.com...

still confused faker.js is in no way an original project, ruby faker is 4 years older than faker.js and I doubt it's the oldest.

Ruby version was based on the Perl version, and this author acknowledged his was based on those 2 versions (from the previous version's README):

    faker.js was inspired by and has used data definitions from:

    https://github.com/stympy/faker/ - Copyright (c) 2007-2010 Benjamin Curtis
    http://search.cpan.org/~jasonk/Data-Faker-0.07/ - Copyright 2004-2005 by Jason Kohles
Post reply on HN