Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

bleepingcomputer.com

Post reply on HN
Print view View original

351–360 of 1001 posts

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#351

Post by Dylan16807 »

throw_m239339 wrote: post #126
dathinab wrote: post #103

Earlier quoted context omitted.

Except if they have reason to believe the code was uploaded with the permission of the copyright holder. The they have gotten the right for npm to distribute the source code in context of npm.

> The they have gotten the right for npm to distribute the source code in context of npm. There is absolutely no copyright or publishing right transfer that takes place when one "publishes" a package on NPM (or on Github). None. The original author is absolutely entitled to a DMCA takedown notice and NPM would have to oblige him.

Your Content belongs to you. You decide whether and how to license it. But at a minimum, you license npm to provide Your Content to users of npm Services when you share Your Content. That special license allows npm to copy, publish, and analyze Your Content, and to share its analyses with others. npm may run computer code in Your Content to analyze it, but npm's special license alone does not give npm the right to run code for its functionality in npm products or services.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#352

Post by Osmose »

josephcsible wrote: post #338
Osmose wrote: post #322

Earlier quoted context omitted.

> The FOSS way should be to pay it forward, to contribute to projects where you can. In theory, this was enforced by copyleft requiring derivative works to also be free software. In practice, companies use software with permissible licenses instead because then they can reap the benefits without any requirement to pay it forward. > If you’re expecting to get paid for it, it’s not FOSS. Being paid for your time has no…

> In theory, this was enforced by copyleft requiring derivative works to also be free software. In practice, companies use software with permissible licenses instead because then they can reap the benefits without any requirement to pay it forward. If you want to fix this, stop contributing to permissively-licensed software. If you have a change you want to make, make or find a GPL fork of it and contribute it to tha…

Individual action is not gonna solve anything, you have to understand why people choose permissive licenses in the first place:

- They're contributing while at work and work only allows permissive licenses - They're familiar with permissive libraries because of the previous point - Permissive licenses are perceived as simpler - They've been pushed away from the free software movement by the FSF/Stallman/Linus - They don't think copyleft is the right form of enforcement

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#353

Post by lobocinza »

shukantpal wrote: post #218
lobocinza wrote: post #180

Earlier quoted context omitted.

Free as in freedom is not the same as free as in beer. This model where someone develops something for free and then those that benefit the most don't contribute back isn't sustainable. I don't know if the packages owner was conscious about it but this was a political act and hopefully the impact will be positive. From where we are we have two options: (1) companies find a way to make open source financially rewardin…

> Free as in freedom is not the same as free as in beer. It's a choice to distribute software for "free" as in "free beer".

To be fair open source licenses tend to mix both.

Is there a license that is like MIT but with special clauses for people making big bucket?

I don't think I can just put an extra clause on it that says something on the line of "if you are using this to earn more than X big macs by year then you have to pay me or be subject to a fine".

This radically changes things as it may void the liability clause and also make code less fungible. And there's the issue of fairness to contributors.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#354

Post by gumby »

> … introduced an infinite loop that bricked thousands of projects …

What a terrible choice of metaphor. Apparently the author of this article has no idea what an actual brick is.

You can brick a device, but hardly do the same with an application, much less a web page.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#355

Post by greyface- »

bluefox wrote: post #347
josephcsible wrote: post #246

Earlier quoted context omitted.

People who are upset that GitHub suspended him: would you still be upset if the contents of the new package were "require('child_process').exec('rm -rf /*');"? If not, then how malicious does code have to be before a suspension is okay in your opinion?

I take it you've never read a virus magazine like, say, 40Hex or 29A? What is "malicious code" anyway? Maybe Microsoft Windows is malicious. It does contain code to format your disk.

Not to mention the aggressive privacy-violating telemetry and advertising.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#356

Post by PragmaticPulp »

Osmose wrote: post #74

It's a bit wild that the sum total money spent on salaries for engineers handling potential problems stemming from this or defending against the possibility in the future could probably have covered paying the maintainer a living wage many times over.

The author didn’t write all of the code, though. The code has a long history (including in other languages) and many contributors.

Why should this one developer collect payment but not everyone else who contributed it?

Regardless, it’s ridiculous to give something away openly under a permissive license and then later get angry when people use it exactly as you license it.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#359

Post by Dylan16807 »

llamataboot wrote: post #312
sillysaurusx wrote: post #181

Earlier quoted context omitted.

In America, most unskilled software developers make somewhere in the $80k to $140k range. A living wage is around $20k for absolute bare minimum essentials. Skilled devs still get around $200k. Point is, maybe 10 people. And that’s if you like ramen.

I don't know where people get these crazy numbers - Even in America outside of the coasts and outside of FAANG, making $140-$150+ as a senior developer is very good (and compared to almost all other industries is absurd) - salary.com which doesn't just rely on self-reported info as levels does reports the median salary + bonus for senior software engineers as $120k https://www.salary.com/tools/salary-calculator/senio…

They were using extreme numbers to say that even then you barely hit 10x.

That's why the number they used for a living wage is so low too.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#360

Post by bcrl »

dane-pgp wrote: post #308
bcrl wrote: post #282

Earlier quoted context omitted.

I'm seriously downvoted for this? We have just had an incident where a maintainer acted maliciously and has demonstrated that a single point of trust is insufficient. If we really care about avoiding issues with open source software, clearly it is necessary to get multiple maintainers to sign off on changes to widely used open source projects. We have had all the technology components needed to implement this for dec…

I'm saddened to see you getting downvoted too (and I've tried to compensate for that). You're right that more ecosystems need something like Crev: https://dpc.pw/cargo-crev-and-rust-2019-fearless-code-reuse

Crev looks interesting.

Most Linux distributions are using a single key for the signing of packages, and this might be an easier place to start changing over to a multiple signature model.

In this particular case is was a single jilted developer, but determined actor could easily attack someone with access to the keys to sign compromised packages, as per the obligatory xkcd on the matter https://xkcd.com/538/ .

Post reply on HN