Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

bleepingcomputer.com

Post reply on HN
Print view View original

521–530 of 1001 posts

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#521

Post by ThunderSizzle »

arvinsim wrote: post #498
gfykvfyxgc wrote: post #3

I don’t understand the mindset of open source developers who dedicate significant time energy and life to free software, unless there’s a tangible, quantifiable advantage to doing so. That advantage may well be indirect such as reputational or learning. I just don’t grasp why people do it for nothing, to the advantage of large companies.

We probably are going into an age where giving away software for free will die. And you know what? I support this kind of thinking. I mean, if people can monetize videos on Youtube, shouldn't developers monetize their software too?

I was just recently starting a blog series and attempting to pair it with a YouTube channel for a new project. If you want to monetize a project, I'd assume that would be a way to do it.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#522

Post by arvinsim »

Dma54rhs wrote: post #316
jbverschoor wrote: post #304

How come npm packages aren’t immutable and signed just like rubygems? Totally understand the guy though

It's insane indeed, this stunt wrecked Googles official firebade cli app for npm. Google is full of talented developers and org is supposedly security minded, how does something like that get through. People pay top dollar to use their cloud services.

From what I read in other comments, one of the possible motives of this action is to teach a lesson to these billion dollar companies who are piggybacking on OSS without giving back a single cent to the developers.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#523

Post by dragonwriter »

iandanforth wrote: post #502
dariusj18 wrote: post #450

Earlier quoted context omitted.

malicious is it's own beast that should always be guarded against, but being MIT doesn't give someone the right to be malicious.

"THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR T…

> Unfit software that causes damage is covered, intent or no.

Well, no, an assertion of nonliability isn’t a magical incantation; local law in whatever jurisdiction is applicable may limit the effect of such an assertion; in places with meaningful consumer protection laws there are limits on the ability to disclaim warranties, and even without decent consume protection law it's often impossible to disclaim liability for malicious torts.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#524

Post by josephcsible »

iandanforth wrote: post #502
dariusj18 wrote: post #450

Earlier quoted context omitted.

malicious is it's own beast that should always be guarded against, but being MIT doesn't give someone the right to be malicious.

"THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR T…

I don't see how that matters. Imagine if you hid a bomb in a car, sold it to me as a used car with no warranty, and then remotely detonated the bomb. You'd unambiguously be on the wrong side of the law, and the lack of warranty wouldn't make a bit of difference.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#525

Post by arvinsim »

hnthrowaway0315 wrote: post #125
mrtksn wrote: post #67

For a bit more context: https://news.ycombinator.com/item?id=29839786 In essence, It seems to be the case of a developer getting screwed, being disillusioned, becoming political, making bombs?, attacking the ecosystem etc. Many years ago, I recall another developer of popular NPM packages(Azer Koçulu) pulling a similar thing[0]. https://qz.com/646467/how-one-programmer-broke-the-internet-... We followed each other on…

Programmers have all the power to hurt things but they rarely think about using that power. Sometimes it's not how much value you can create that wins the day, but how much pain you can strike at other people that counts. Politics is like that. Ugly, but necessary.

The sad thing is that some(most?) of them only want to think about the code and do not want to do deal with the real world implications of the software that they are involved in.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#526

Post by arvinsim »

29athrowaway wrote: post #332

I think package managers such as npm should require package maintainers to sign a legally binding agreement that they're not going to willfully do stuff like this. There's no other way. Why? because determining if a package is malicious via static analysis or other automatic means would be the equivalent of creating a solution for the halting problem.

> I think package managers such as npm should require package maintainers to sign a legally binding agreement that they're not going to willfully do stuff like this.

I would think this would discourage a lot of people to contribute to NPM.

It's not about enforcement but the threat.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#527

Post by Sebb767 »

tehbeard wrote: post #243
oneoff786 wrote: post #240

Earlier quoted context omitted.

I’m a self taught Python programmer. I haven’t don’t much front end. Why do some JS devs import tiny packages to do simple things? I don’t feel like I’ve seen this behavior in Python. Is it because browsers are an awful environment?

stdlib of JS vs python or php is absolutely tiny. It's improving over time, but it's still playing catchup.

And if you're optimizing for the browser, you can't count on the improvements being there. So you still want to use third-party libraries for their polyfills.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#529

Post by pessimizer »

AmericanChopper wrote: post #263
oblio wrote: post #119

Earlier quoted context omitted.

Tragedy of the commons, shortsightedness and misaligned individual incentives. Individual contributors in large companies, especially, would want their companies to fund FOSS projects they use. But approval processes are generally extremely complicated and there's nothing to gain internally by doing it. And we're talking about money that these corporations spend each millisecond. They barely need approvals for many o…

Most of the companies that I’ve worked for have funded the FOSS that we used. By allowing me and my colleagues to contribute features we needed, or fix bugs that were affecting us. The core maintainers probably never knew these PRs were funded at an hourly rate paid for by some big bank, and sadly quite a few of the projects that I’ve contributed to have rug-pulled into some sort of non-FOSS enterprise product. We al…

For clarification, you're not referring to "contributing features [you] needed" or fixing bugs on the clock as funding? That's probably a nice thing, unless nobody needs a particular feature except the people who fund you at an hourly rate, but it's not "funding the FOSS" you use. That's when you give someone money. You can't eat features and bugfixes - without the rug-pulling you're decrying here.

FOSS is licensing, not religion. Rug-pulling a project from people who are enjoying using it isn't "anti-FOSS" IMO. This may not apply to you, but for all the contrast that OSS people project between their pragmatism and Free Software people being insane religious zealots on a jihad against money, OSS advocates seem to imbue a lot of flaky new agey spiritism into what FOSS is or isn't.

Post reply on HN