Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

bleepingcomputer.com

Post reply on HN
Print view View original

331–340 of 1001 posts

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#331

Post by lmm »

dane-pgp wrote: post #144
throw_m239339 wrote: post #83

Earlier quoted context omitted.

> This is true for npm. After the incident with leftpad, you can't unpublish anymore. You can, however, publish a new patch update that completely breaks everything. You absolutely can unpublish, it just requires more steps. If NPM gets a DMCA takedown request they will absolutely have to fulfill it.

> If NPM gets a DMCA takedown request they will absolutely have to fulfill it. Assuming the package is released under a Free Software licence, what grounds would there be for a DMCA takedown? I suppose a developer could include the lyrics to a pop song in their code (possibly encrypted), and then tell the copyright holder about it (since I don't think you can make a DMCA request on behalf of a copyright holder withou…

> Assuming the package is released under a Free Software licence, what grounds would there be for a DMCA takedown?

Noncompliance with the license, e.g. by removing required copyright notices/attribution in the code (this has happened in the past). Or straight-up uploading someone else's non-free code.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#332

Post by 29athrowaway »

I think package managers such as npm should require package maintainers to sign a legally binding agreement that they're not going to willfully do stuff like this.

There's no other way.

Why? because determining if a package is malicious via static analysis or other automatic means would be the equivalent of creating a solution for the halting problem.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#333

Post by greyface- »

29athrowaway wrote: post #332

I think package managers such as npm should require package maintainers to sign a legally binding agreement that they're not going to willfully do stuff like this. There's no other way. Why? because determining if a package is malicious via static analysis or other automatic means would be the equivalent of creating a solution for the halting problem.

What consideration, if any, should package maintainers receive in return for legally binding themselves in this way?

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#334

Post by 29athrowaway »

greyface- wrote: post #333
29athrowaway wrote: post #332

I think package managers such as npm should require package maintainers to sign a legally binding agreement that they're not going to willfully do stuff like this. There's no other way. Why? because determining if a package is malicious via static analysis or other automatic means would be the equivalent of creating a solution for the halting problem.

What consideration, if any, should package maintainers receive in return for legally binding themselves in this way?

The publication of their package.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#335

Post by nomdep »

cesarb wrote: post #295
superkuh wrote: post #149

Earlier quoted context omitted.

I don't understand why. It's his code to break if he wants. But I guess when you use a social media service to host your code these are expected and normal results.

> It's his code to break if he wants. This is a library, not standalone software. Breaking it means breaking the code of every software which uses that library.

And per the MIT license, he offers it “WITHOUT WARRANTY OF ANY KIND (…) INCLUDING BUT NOT LIMITED TO (…) FITNESS FOR A PARTICULAR PURPOSE”

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#336

Post by lobocinza »

GreenWatermelon wrote: post #260
lobocinza wrote: post #180

Earlier quoted context omitted.

Free as in freedom is not the same as free as in beer. This model where someone develops something for free and then those that benefit the most don't contribute back isn't sustainable. I don't know if the packages owner was conscious about it but this was a political act and hopefully the impact will be positive. From where we are we have two options: (1) companies find a way to make open source financially rewardin…

Both seem to result in more jobs for devs: - Devs do open source and get rewarded - Devs get hired to make crappy alternative software for companies

Unless someone find a way to replace devs with a machine there will be demand. And for the good and the bad there are efforts and partial success on doing that like tools to develop sites using only a GUI.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#337

Post by geuis »

I’ve got a really strong, and I believe relevant opinion on this.

I’ve been running jsonip.com as a free simple IP lookup service for 11 ish years.

I used to be very politically active (shout out to Indymedia). Nowadays the sentiments are the same but the outreach, it is lacking.

After Trump got elected, I went through the same phase many people did: shouting into the void on Facebook and Twitter. I was pissed off and wanted to feel like someone was listening to me, rather than doing anything about it.

After a few months, that passed. And I honestly looked around for what I could do.

Well it turns out I had (still have) a free simple api service that serves a couple million requests per day. It’s not much of an “audience” but it was something.

What I ended up doing is adding some simple anti Trump messages to the api response. Yeah, on the surface this seems dumb and juvenile but let me out it into perspective. It’s my service that I’ve paid money every month for a decade. When in a situation where you have no voice, I feel it’s valid to use what you have.

Now here’s the critical intersection with the topic at hand. I absolutely never did anything that fundamentally changed the api. I had no intention of breaking the client contract just to get attention. I added a couple extra fields, but in no way did that break anyone’s usage of the jsonip service.

What this author did is really juvenile and crass.

It’s a 13 year old level of maturity that leads someone to break the software chain that many downstream clients rely on. How many hundreds or thousands of build breakage alerts went off when they did a package upgrade because of this? How many thousands of human hours were spent because of this?

There’s some minor argument being made in this that the author is pushing for some type of remuneration for their work, and I am entirely behind that. Maybe they should fork their packages into a paid model. Maybe setup a Patreon account. Maybe get a job at a company that uses their software. I dunno. But there are more mature and legit options for getting paid for your work than breaking the toolchain for who knows how many people and ruining your reputation at the same time.

… /end rant

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#338

Post by josephcsible »

Osmose wrote: post #322
AmericanChopper wrote: post #263

Earlier quoted context omitted.

Most of the companies that I’ve worked for have funded the FOSS that we used. By allowing me and my colleagues to contribute features we needed, or fix bugs that were affecting us. The core maintainers probably never knew these PRs were funded at an hourly rate paid for by some big bank, and sadly quite a few of the projects that I’ve contributed to have rug-pulled into some sort of non-FOSS enterprise product. We al…

> The FOSS way should be to pay it forward, to contribute to projects where you can. In theory, this was enforced by copyleft requiring derivative works to also be free software. In practice, companies use software with permissible licenses instead because then they can reap the benefits without any requirement to pay it forward. > If you’re expecting to get paid for it, it’s not FOSS. Being paid for your time has no…

> In theory, this was enforced by copyleft requiring derivative works to also be free software. In practice, companies use software with permissible licenses instead because then they can reap the benefits without any requirement to pay it forward.

If you want to fix this, stop contributing to permissively-licensed software. If you have a change you want to make, make or find a GPL fork of it and contribute it to that instead.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#339

Post by Aeolun »

NKosmatos wrote: post #114

Try to look at it from another point of view. Marak is fed up of all these billion dollar companies (and other small projects) using his code, he has some financial problems and so he decides to teach them a lesson. I sympathize and for sure if I were responsible for a big company and I was using an open source component/project I would donate something. We all have to rethink of how the open source funding is suppos…

Like, I understand it. And he could easily have done something much more malicious, like running a ‘rm -rf /‘. This seems on the level of a very misplaced prank.

I feel like people (and especially corporations thst have freely used the library for years) are overreacting a bit.

This is just a warning signal that we depend on random packages too easily. The only thing standing between many products and disaster is the decency of maintainers.

Nobody wants to acknowledge that (me included) since it’ll mean my job becomes much more of a pain.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#340

Post by jayflux »

notRobot wrote: post #21

Here's my $.02: Packages are literally remote code exec vulns in the hands of package authors. At the very least, it takes them under a minute to break your app, simply by deleting their package. Read the article. This is not the first time it's happened, and it's not going to be the last. [0] I write backends (mostly in PHP, although not exclusively), and I release a lot of my code under libre licenses. But I don't…

> At the very least, it takes them under a minute to break your app, simply by deleting their package. Read the article. This is not the first time it's happened, and it's not going to be the last. [0]

That hasn’t been true for 7 years now, it was changed after the left-pad incident and that article everyone keeps quoting is from 2016. Deleting a GitHub repo or a package does not remove it from npm as part of their policy.

Post reply on HN