Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

bleepingcomputer.com

Post reply on HN
Print view View original

481–490 of 1001 posts

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#481

Post by AmericanChopper »

Osmose wrote: post #322
AmericanChopper wrote: post #263

Earlier quoted context omitted.

Most of the companies that I’ve worked for have funded the FOSS that we used. By allowing me and my colleagues to contribute features we needed, or fix bugs that were affecting us. The core maintainers probably never knew these PRs were funded at an hourly rate paid for by some big bank, and sadly quite a few of the projects that I’ve contributed to have rug-pulled into some sort of non-FOSS enterprise product. We al…

> The FOSS way should be to pay it forward, to contribute to projects where you can. In theory, this was enforced by copyleft requiring derivative works to also be free software. In practice, companies use software with permissible licenses instead because then they can reap the benefits without any requirement to pay it forward. > If you’re expecting to get paid for it, it’s not FOSS. Being paid for your time has no…

Copyleft software isn’t free, it comes with a very hefty price tag. You don’t pay it forward by handing over all your IP. You pay it forward by contributing back. I have no moral qualms about using OSS in any project I’m working on, commercial or otherwise. Because I have published my own libraries for anybody to use, and contributed a huge amount of PRs to the software I use. When you publish something with a permissive licence, it stops being yours, but you benefit from having a huge number of people improve it for you. That’s how it works, that’s how it gets paid forward.

The OP is also attempting to use a proven failure of a business model, and then throwing a tantrum when it fails. Sure he’s within his rights to do so, but he has no moral high ground here, and I don’t think he’s entitled to any sympathy for adopting a business model that everybody knows for sure doesn’t work.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#482

Post by LAC-Tech »

How many of these stories do we need to hear before we start treating this problem seriously?

I'm not saying never use external libraries.

But recognise that each one of them is a potential ticking time bomb. Do you really need it, or is it a nice to have?

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#483

Post by hnick »

giaour wrote: post #373
hnick wrote: post #326

Earlier quoted context omitted.

I'm not even sure it's not a fool's errand with the current software ecosystem. I think at some point it will have to be a language level feature. The ability to sandbox or provide permissions to packages/functions. Just like our OS had to, just like browsers had to, just like phones had to. Our code is the platform, the packages the apps. It's a similar use case. If I could download a module, and tell the compiler t…

Doesn't deno take this approach? The runtime does kinda force the question by only supporting imports via fully qualified URLs.

It might, I'm not familiar but after a quick look it seems to operate on a vetted trust model i.e. you can use these because we checked and they are compatible. So you could miss out on a lot of the ecosystem.

I was leaning more towards the web approach where we assume everyone is out to get us, but they can't unless we give them that one permission they need. If it's a statically typed language then it'd even allow dependency walking to see what permissions are used at a granular level and we can decide not to bring in anything that's too loose. This of course won't solve cases like logic bugs, but it'd help mitigate the impact.

I'm just not sure if it's even feasible?

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#484

Post by kristjansson »

All applications should test in two environments. First, the set of packages satisfying stated constraints. Second, against a lockfile consisting of a fixed version for each dep. The first tracks compatibility with the ecosystem, the second verifies the deployable configuration. Valid version sets are manually moved from the first to the second. Upstream failures only break the first.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#485

Post by [deleted] »

noah_buddy wrote: post #402
hn_throwaway_99 wrote: post #392

Earlier quoted context omitted.

> It's a bad look, why would anyone want to deal with him after this stunt is beyond me. The maintainer appears to be unwell: https://abc7ny.com/suspicious-package-queens-astoria-fire/64...

The maintainer seems a few steps beyond unwell. Seems like he was planning a terrorist act of some sort. Even if one is mentally unwell, I would not first describe them that way should they choose to premeditate harm against others. If you're building bombs, you're almost certainly at that point. At the very least, the maintainer is unstable if not actively malicious and seeking to cause harm however he can.

[deleted]

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#486

Post by arvinsim »

NKosmatos wrote: post #114

Try to look at it from another point of view. Marak is fed up of all these billion dollar companies (and other small projects) using his code, he has some financial problems and so he decides to teach them a lesson. I sympathize and for sure if I were responsible for a big company and I was using an open source component/project I would donate something. We all have to rethink of how the open source funding is suppos…

Maybe OSS projects should start with a different default license than MIT

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#487

Post by lolinder »

etchalon wrote: post #454
shaunpersad wrote: post #121

AITA for thinking that if you develop open-source software and your license permits anyone to use it for free, then complaining about no compensation is not a valid complaint? I totally understand that billionaire corporations use software like this for free. But the software maintainer has explicitly allowed _anyone_ to use it for free. If you don't want them to use it for free, license it as such. What am I not see…

There are people who think its reasonable to take all the pennies from the "take a penny leave a penny" plate because "that's what it's there for."

The difference is that there aren't a finite number of pennies on this plate. Software can, by definition, be copied an infinite number of times.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#488

Post by StopHammoTime »

This raises some excellent points about code-ownership. Because I believe they should have at least forked rather than just restore his repo.

On the other hand if brother wants to get paid and stop people exploiting his work, maybe don't use the MIT license? There's always AGPL. Of course, as with Elastic, these projects would never get off the ground (in terms of support) without actually using a commercial-compliant license.

I'm starting to get sick of developers who release open-source work but then are surprised when people use their work as released. If you want someone to pay you money, ask for money. If they don't want to pay you, do something else. Stop playing games with licensing and taking things down.

Is all these people are doing are ruining open source.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#489

Post by chii »

throw_m239339 wrote: post #416
ghiculescu wrote: post #401

Earlier quoted context omitted.

... it’s not obvious to me?

> ... it’s not obvious to me? If the source was maintained on Bitbucket, why the hell would bitbucket nuke the developer's account access? That's not their problem what happens on NPM. Github and NPM are defacto the exact same company on the other hand. Github actions are in retaliation of NPM "mispublishing".

> why the hell would bitbucket nuke the developer's account access?

a counter-factual that isn't known or proven.

May be bitbucket would also nuke the repo, if NPM asked them and show proof that it contains malicious code. It would prevent spread, and would prevent damage.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#490

Post by arvinsim »

evolve2k wrote: post #30
evolve2k wrote: post #26

My sense is that it’s time to evolve licensing such that wealthy major consumers of packages that have become somewhat essential are naturally paying a licence fee. The problem is not in what the code does it’s a problem with the agreement for use.

Actually in attempting to answer my own question, on other platforms like YouTube and Medium, popular content receives monetary support by virtue of being popular. What if this was addressed at the “platform” level, I’m thinking the package manager here, NPM. If npm had paid plans that would essentially mop up larger corporations they could then auto-distribute funds Spotify style based on “number of listens”. I’d pe…

I think a new license should be created in order to facilitate this.
Post reply on HN