Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

bleepingcomputer.com

Post reply on HN
Print view View original

541–550 of 1001 posts

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#541

Post by Sebb767 »

melony wrote: post #134
shaunpersad wrote: post #121

AITA for thinking that if you develop open-source software and your license permits anyone to use it for free, then complaining about no compensation is not a valid complaint? I totally understand that billionaire corporations use software like this for free. But the software maintainer has explicitly allowed _anyone_ to use it for free. If you don't want them to use it for free, license it as such. What am I not see…

That's fine, but then the downstream shouldn't complain either when the code breaks, whether intentionally or unintentionally. The contract on paper disclaims all liability after all. There is a social contract and then there is the literal contract. A lot of commenters here seem to be willfully obtuse or simply ignoring the former.

There's a difference between stopping to give away your stuff for free and acting maliciously.

If I give away donuts for free and stop at some point, you have no right to complain. If I poison the donuts because you should've really thrown money at me for those donuts that I explicitly marked as free, I think you could complain after all.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#542

Post by joshspankit »

bastardoperator wrote: post #108

Should I get paid for my multiple contributions to faker (I don't think I should)? I've submitted several PR's for generating data all of which were accepted. Even back then the maintainer was barking about money... Honestly the project would be better off forked. He did not write this library entirely by himself, at this point I just see him as holding other committers contributions as hostage. It's a bad look, why…

> Should I get paid for my multiple contributions to faker (I don't think I should)?

The biggest thing that excites me about the possibilities for the future of smart contracts is that creators of all kinds could automatically benefit from any work they do.

This scenario, for example: Any company that used faker.js to make a profit would have X% of that revenue feed back to the smart contracts. The creator would probably get the most, followed by the maintainer, then anyone who had a PR approved, then maybe people who submitted good bug reports. All automatically, and all directly in to everyone’s wallet.

Not only would this be an easy way for creators to get paid, it would also incentivize the maintenance of those creations.

And if you didn’t want to get paid, you could simply have funds directed to charity or opt out of your share entirely.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#543

Post by _-david-_ »

bee_rider wrote: post #201
mschuster91 wrote: post #162

Earlier quoted context omitted.

Given that Debian (and its descendants...) packages a shitload of npm packages, it's a wide stretch to say there is more QA for these packages from the Debian side than there is from the npm side. The one thing that Debian provides is that in the case there is a security issue, admins worldwide only need to do "apt update && apt upgrade" and they are safe, without having to check all of the software that runs on thei…

I do think people would be served, generally, by being more aware of the fact that distros are not some doing some hardcore security vetting. But the alternative is just to use whatever was pushed up to NPM, right? In that case, Debian packager+NPM push > NPM push by definition, unless the Debian packager somehow provides negative QA, which seems unlikely. (Also, on the incredibly unlikely offchance that some Debian…

> unless the Debian packager somehow provides negative QA, which seems unlikely

It has happened before. Last time there was anything major was over a decade ago though.

https://lists.debian.org/debian-security-announce/2008/msg00...

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#544

Post by mastazi »

junon wrote: post #463
mastazi wrote: post #430

My takeaway from this story is that I never really gave a thought about the fact that Github can close your account... And since on Github you are not allowed to have multiple accounts (e.g. personal vs work account), when that happens they are taking away your ability to work. I am going to set up a self hosted git server for my personal projects straight away. I am thinking about Gitea, any one can share their expe…

I've never heard of GitHub enforcing the multiple accounts thing, FWIW. This user was taking clearly malicious actions against millions of consumers of code, in a bait and switch style. GitHub rarely takes action against accounts like that, don't let a sample size of one define them. There are lots of reasons to be annoyed with GitHub but this isn't one of them. As for alternatives, check https://sr.ht

> GitHub rarely takes action against accounts

well, this just made the Hacker News front page a few minutes ago :-D

https://news.ycombinator.com/item?id=29870151

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#546

Post by heartbreak »

godDLL wrote: post #510
bogwog wrote: post #277

Earlier quoted context omitted.

Why is that scary? If you do bad things, you're going to get banned. This guy abused Github to distribute malicious code to thousands of projects. If losing your Github means losing your projects, that's on you for being lazy/irresponsible with them. Git is already decentralized, and anything important should be cloned on something you own.

"Abused Github to distribute malicious code" is a legal wording, not a EULA violation. A lawsuit, not an account ban. Let's decide how serious this is. Exactly. I am, for one, of the opinion that it is not at all serious. Not deserving of a lawsuit or an account ban. Not even newsworthy. I mean, this could easily become the new normal for OSS. You use it – you're not insured against anything, for there is no formal c…

You don’t need a contract to be protected against intentional harm.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#547

Post by vbezhenar »

Our build tools and overall approaches need to focus on reproducibility, offline builds, bundling of all dependencies (including source code when available) with release artifact. I think that big companies already have it with some tooling, but small companies usually use what's available off the shelf in default configuration and those practices are not very reliable when it comes to rogue dependencies changes.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#548

Post by shagie »

not2b wrote: post #435
mrtksn wrote: post #135

Earlier quoted context omitted.

The author apparently got political, had issues with the law enforcement: https://news.ycombinator.com/item?id=29839786

But isn't faker just a port of someone else's work (originally written in Ruby)?

The oldest version of it dates back to Perl ( https://metacpan.org/pod/Data::Faker ) - but yes.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#549

Post by tjpnz »

bogwog wrote: post #277
sillysaurusx wrote: post #195

Earlier quoted context omitted.

This is scary, and I don’t know why people here aren’t losing their minds. I think someone should make a big deal about this. What would be the first step? On the other hand, my GitHub was once suspended (and all repos shuttered) for posting gists that looked like spam to some algorithm. It was extremely unsettling, and they need to do a better job communicating. But they may have suspended the account because they t…

Why is that scary? If you do bad things, you're going to get banned. This guy abused Github to distribute malicious code to thousands of projects. If losing your Github means losing your projects, that's on you for being lazy/irresponsible with them. Git is already decentralized, and anything important should be cloned on something you own.

Where do you draw the line? I've learned the hard way that SemVer isn't universally respected in the Node ecosystem. What happens if the maintainer of a sufficiently popular package decides to push out a patch release overhauling the public facing API? Does Github ban them too?

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#550

Post by junon »

mastazi wrote: post #544
junon wrote: post #463

Earlier quoted context omitted.

I've never heard of GitHub enforcing the multiple accounts thing, FWIW. This user was taking clearly malicious actions against millions of consumers of code, in a bait and switch style. GitHub rarely takes action against accounts like that, don't let a sample size of one define them. There are lots of reasons to be annoyed with GitHub but this isn't one of them. As for alternatives, check https://sr.ht

> GitHub rarely takes action against accounts well, this just made the Hacker News front page a few minutes ago :-D https://news.ycombinator.com/item?id=29870151

DMCA notices have to be complied with else Github can get heavily penalized. This isn't Github's choice.

DMCA is an entirely different beast, and it's not Github's fault that whole system is broken.

Post reply on HN