Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

bleepingcomputer.com

Post reply on HN
Print view View original

571–580 of 1001 posts

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#571

Post by mlyle »

labster wrote: post #387
josephcsible wrote: post #209

Earlier quoted context omitted.

> I don't think you can make a DMCA request on behalf of a copyright holder without their permission In theory, you're right. In practice, there's never any actual consequences for filing a false DMCA claim. Worst case is that the thing doesn't get taken down, but that's no worse than if they didn't file it at all.

Corps don’t care about DMCA takedowns from natural persons. I sent a takedown once, the CEO replied that he was sorry it had come to that, but they still distributed it for years under a license I did not grant. This CEO is licensed to practice law in California, btw.

Anyone is free to ignore DMCA notifications.

Some parties that are distributing other peoples' stuff lose a safe-harbor protection from liability themselves if they ignore it.

This means intermediaries who don't benefit much directly from distributing a given bit of content will immediately comply with the DMCA takedown process. But this does nothing if you send the notice to someone who is actually using it.

The correct move is to send DMCA to the infringer's ISP/host. Then the ISP has to take it down unless counter-notified that they say they're not infringing. In turn, that counter-notification improves your position for any litigation that may ensue.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#572

Post by evouga »

josephcsible wrote: post #246
joshuaissac wrote: post #117

GitHub has now suspended the maintainer: https://nitter.net/marak/status/1479200803948830724

People who are upset that GitHub suspended him: would you still be upset if the contents of the new package were "require('child_process').exec('rm -rf /*');"? If not, then how malicious does code have to be before a suspension is okay in your opinion?

I think a suspension is okay if the code breaks the GitHub frontend or backend itself, or exposes Microsoft to legal liability (because the code embeds copyright material, etc.)

In no other circumstances do I want GitHub patrolling what users commit to their own repositories.

Of course, if you pull my code and run it sight-unseen, and are damaged by it, you have a right to be upset at me (and possibly sue me) but that's not something I want GitHub to (try to) police.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#573

Post by challenger-derp »

Osmose wrote: post #322
AmericanChopper wrote: post #263

Earlier quoted context omitted.

Most of the companies that I’ve worked for have funded the FOSS that we used. By allowing me and my colleagues to contribute features we needed, or fix bugs that were affecting us. The core maintainers probably never knew these PRs were funded at an hourly rate paid for by some big bank, and sadly quite a few of the projects that I’ve contributed to have rug-pulled into some sort of non-FOSS enterprise product. We al…

> The FOSS way should be to pay it forward, to contribute to projects where you can. In theory, this was enforced by copyleft requiring derivative works to also be free software. In practice, companies use software with permissible licenses instead because then they can reap the benefits without any requirement to pay it forward. > If you’re expecting to get paid for it, it’s not FOSS. Being paid for your time has no…

I like these arguments.

As a matter of practicality, commercial entities using a maintainers' work should donate to maintainers to incentive them to, well, at least not go rogue, or to be on their good side when they rogue. Companies pay their employees to incentive them to function in the interests of the company. While this isn't fool-proof (principal-agent problem), it lowers the odds of a pissed off employee having the will/self-righteous fury to pursue something more aggressive than resigning in a huff.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#574

Post by pverghese »

noah_buddy wrote: post #402
hn_throwaway_99 wrote: post #392

Earlier quoted context omitted.

> It's a bad look, why would anyone want to deal with him after this stunt is beyond me. The maintainer appears to be unwell: https://abc7ny.com/suspicious-package-queens-astoria-fire/64...

The maintainer seems a few steps beyond unwell. Seems like he was planning a terrorist act of some sort. Even if one is mentally unwell, I would not first describe them that way should they choose to premeditate harm against others. If you're building bombs, you're almost certainly at that point. At the very least, the maintainer is unstable if not actively malicious and seeking to cause harm however he can.

Let's not start claiming people are planning terrorist acts without any proof. Those claims are extremely hard to get rid of, especially on the internet.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#576

Post by Sebb767 »

mastazi wrote: post #467
junon wrote: post #463

Earlier quoted context omitted.

I've never heard of GitHub enforcing the multiple accounts thing, FWIW. This user was taking clearly malicious actions against millions of consumers of code, in a bait and switch style. GitHub rarely takes action against accounts like that, don't let a sample size of one define them. There are lots of reasons to be annoyed with GitHub but this isn't one of them. As for alternatives, check https://sr.ht

> I've never heard of GitHub enforcing the multiple accounts thing, FWIW correct they don't enforce it but they make it such a royal PITA to switch accounts that I eventually gave up trying. They don't have an account switcher like Google etc. > As for alternatives, check https://sr.ht thank you! Checking it out. Edit: it seems that sr.ht is not self-hosted though? I can see the link to create an account but I can't…

> correct they don't enforce it but they make it such a royal PITA to switch accounts that I eventually gave up trying.

If you are ever in need again, Firefox containers are great for this. They also allow you to bundle other corporate accounts, so you don't need any site-dependent switchers at all.

> Edit: it seems that sr.ht is not self-hosted though? I can see the link to create an account but I can't find instructions on how to install it on my own server.

SourceHut is a SaaS. It's created by a very open source friendly person, though.

Self-hosted alternatives are GitLab or Gitea/Gogs, if you are in need of something more lightweight.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#577

Post by foxhop »

sys_64738 wrote: post #34

Obviously he has this right to do what he wants and he did. But the consequences are that his reputation is in tatters. Probably doesn't bother him but equally the repos will be forked and utilization continues of the predecessor. Might not be a maintainer mind you so the dependent repos will quickly find alternates.

This is called activism, his reputation is growing.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#578

Post by jwalton »

junon wrote: post #534
feupan wrote: post #476

Earlier quoted context omitted.

Is a codemod available for anyone who wants to migrate?

Not at the moment, but the migration should be pretty straightforward if you don't use the more elaborate color functions from `colors` (e.g. we don't have things like "zebra"). If you use `require('colors/safe')` and only use the basic colors, then Chalk is more or less a drop-in replacement. If you use the property values (e.g. `"my string".green`) then you'll need to change that to `chalk.green("my string")`.

One thing worth noting is that chalk 5 is ESM only, so if you’re using commonjs, you’ll need to use chalk 4, or transpire it with Babel, or something…

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#579

Post by mastazi »

Sebb767 wrote: post #576
mastazi wrote: post #467

Earlier quoted context omitted.

> I've never heard of GitHub enforcing the multiple accounts thing, FWIW correct they don't enforce it but they make it such a royal PITA to switch accounts that I eventually gave up trying. They don't have an account switcher like Google etc. > As for alternatives, check https://sr.ht thank you! Checking it out. Edit: it seems that sr.ht is not self-hosted though? I can see the link to create an account but I can't…

> correct they don't enforce it but they make it such a royal PITA to switch accounts that I eventually gave up trying. If you are ever in need again, Firefox containers are great for this. They also allow you to bundle other corporate accounts, so you don't need any site-dependent switchers at all. > Edit: it seems that sr.ht is not self-hosted though? I can see the link to create an account but I can't find instruc…

Yes! I'm a big fan of Firefox containers and in the past I actually used it for this specific use case, among others. Unfortunately I had to switch from Firefox to another browser for unrelated reasons.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#580

Post by viro »

wly_cdgr wrote: post #575

Love to see it. About time open source devs started fighting back against the Silicon Valley techbro founder scum who've been shamelessly exploiting their idealism and naivete for decades

you love to see people indiscriminately pushing malware to random servers without knowing what the server even does?
Post reply on HN