Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

bleepingcomputer.com

Post reply on HN
Print view View original

491–500 of 1001 posts

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#491

Post by LAC-Tech »

kcb wrote: post #453
epaulson wrote: post #167

It's time for someone to make a Redhat, but for "safe" open source software libraries. My big enterprise would sign up for it in a heartbeat. We'd pay for access from an alternative NPM registry where everything is at least semi-vetted - someone at least looks at diffs before new versions get updated and made available. Sure, the "safe" repo wouldn't have as nearly as many packages as the main NPM repo, but if it had…

Use a language where you don't need to pull in 100 dependencies to create a useful application/service.

It's not a language problem. It's a cultural problem.

Last I checked create-react-app pulls around 1k transitive dependencies. Can't really blame JS for that, can we?

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#492

Post by josephcsible »

arvinsim wrote: post #490
evolve2k wrote: post #30

Earlier quoted context omitted.

Actually in attempting to answer my own question, on other platforms like YouTube and Medium, popular content receives monetary support by virtue of being popular. What if this was addressed at the “platform” level, I’m thinking the package manager here, NPM. If npm had paid plans that would essentially mop up larger corporations they could then auto-distribute funds Spotify style based on “number of listens”. I’d pe…

I think a new license should be created in order to facilitate this.

That would be awful. Such a license would necessarily be neither free nor open source.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#493

Post by lolinder »

syshum wrote: post #257
stjohnswarts wrote: post #207

Earlier quoted context omitted.

It still doesn't mean you can't call the guy out for being an asshole. However, that's the only relief you'll get in matters such as these. Other avenues would be to tweet about it and make it known that this is what you can expect from the same guy in the future so avoid him for future work as he won't be acting like an adult.

That also does not mean you cant call out the corporations that are leaching off open source... I find it ironic that people are more upset at this guy for complaining about corporations, than they are about the corporations leaching... the dev and hacker communities have really gone full on #HailCorporate haven't they. Where did my anti-establishment Libre community of the 90's go... I long for the good old days

We're not upset at the guy for complaining about corporations. We're upset at him for pulling a stunt that may have hurt some large corporations, but mostly just caught a lot of small projects in the crossfire.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#494

Post by godDLL »

mulmen wrote: post #273
IceDane wrote: post #202

Earlier quoted context omitted.

I don't think he cares at this point. I think this is a person that has been driven to the absolute end of their patience. If he's really barely been getting by, then I can only imagine the sheer frustration he must be feeling. Not only are there swathes of fortune 500 companies which depend on his package but don't contribute a dime, but he also had a company with millions of dollars in funding look at his idea and…

It seems completely insane to me to give away work and then expect compensation for it.

But completely sane to base your project on a package of code you don't control?

Or to lock up his Github account for exercising his prerogative onto his own code?

His behaviour is unusual, but that, you know, could change easily. It could become the normal just like that. Puff.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#495

Post by betwixthewires »

not2b wrote: post #419
RVuRnvbM2e wrote: post #191

Earlier quoted context omitted.

If that is true it's an outrageous overreaction by GH. Are they now gatekeeping the kinds of code changes you can make to your own repo?

It isn't your own if you host it with them, and they aren't obliged to help you commit sabotage.

It's not yours? Really. They own it now because they host it for you?

So some ToS could override the software license for your project? In that case I don't see why anyone would use github, ever.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#496

Post by bluefox »

chii wrote: post #480
bluefox wrote: post #347

Earlier quoted context omitted.

I take it you've never read a virus magazine like, say, 40Hex or 29A? What is "malicious code" anyway? Maybe Microsoft Windows is malicious. It does contain code to format your disk.

Intent matters. Windows contains the rm -rf code, but you, as a user, would have to knowingly trigger it and confirm. It's not like windows tricks you into formatting your drive. Directing the argument into windows is just whataboutism.

[flagged]

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#497

Post by chii »

xbar wrote: post #414
josephcsible wrote: post #246

Earlier quoted context omitted.

People who are upset that GitHub suspended him: would you still be upset if the contents of the new package were "require('child_process').exec('rm -rf /*');"? If not, then how malicious does code have to be before a suspension is okay in your opinion?

What are the set of commits that GitHub should allow people to make to repos that they solely own?

The set of commits that aren't directly trying to trick someone into installing malicious software.

It's fine to host code that contains any instructions, as long as the intent of that code is not to trick someone into running malicious software.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#498

Post by arvinsim »

gfykvfyxgc wrote: post #3

I don’t understand the mindset of open source developers who dedicate significant time energy and life to free software, unless there’s a tangible, quantifiable advantage to doing so. That advantage may well be indirect such as reputational or learning. I just don’t grasp why people do it for nothing, to the advantage of large companies.

We probably are going into an age where giving away software for free will die.

And you know what? I support this kind of thinking.

I mean, if people can monetize videos on Youtube, shouldn't developers monetize their software too?

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#499

Post by Karupan »

josephcsible wrote: post #433
throw_m239339 wrote: post #416

Earlier quoted context omitted.

> ... it’s not obvious to me? If the source was maintained on Bitbucket, why the hell would bitbucket nuke the developer's account access? That's not their problem what happens on NPM. Github and NPM are defacto the exact same company on the other hand. Github actions are in retaliation of NPM "mispublishing".

Marak didn't just mess with NPM. He also did a force push to his GitHub repo, replacing all the code there.

So? It is a project under his username and he could've done anything he pleased with it. Not defending him, but banning him on GitHub instead of NPM is just bizarre.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#500

Post by arvinsim »

sseagull wrote: post #452
andrew_ wrote: post #310

Earlier quoted context omitted.

Because it's fun ya mook. That's it. That's the reason. It's fun to tinker. It's fun to put things out there into the ether. It's fun to exercise the brain and try new things and learn new ways to do things and publish things. The second it stops being fun, we stop.

I’ve realized the idea that the “Hacker” part of “Hacker News” is no longer here, and just a nod to some ancient, possibly apocryphal, past. Discussions now are about how you shouldn’t run your own server, and you should use popular stuff so you can speed up development and get your startup going. I mean, I know about ycombinator and all. But it doesn’t seem to truly encompass the hacker spirit, if you ask me.

People always take the convenient route until it bites them in the ass.

Necessity is the mother of invention after all.

Post reply on HN