Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

bleepingcomputer.com

Post reply on HN
Print view View original

611–620 of 1001 posts

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#611

Post by sbt567 »

joshspankit wrote: post #542
bastardoperator wrote: post #108

Should I get paid for my multiple contributions to faker (I don't think I should)? I've submitted several PR's for generating data all of which were accepted. Even back then the maintainer was barking about money... Honestly the project would be better off forked. He did not write this library entirely by himself, at this point I just see him as holding other committers contributions as hostage. It's a bad look, why…

> Should I get paid for my multiple contributions to faker (I don't think I should)? The biggest thing that excites me about the possibilities for the future of smart contracts is that creators of all kinds could automatically benefit from any work they do. This scenario, for example: Any company that used faker.js to make a profit would have X% of that revenue feed back to the smart contracts. The creator would prob…

This sounds like a dream to me. How can it happen with open source software (where anyone can build and modify the software freely)?

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#612

Post by oauea »

bogwog wrote: post #277
sillysaurusx wrote: post #195

Earlier quoted context omitted.

This is scary, and I don’t know why people here aren’t losing their minds. I think someone should make a big deal about this. What would be the first step? On the other hand, my GitHub was once suspended (and all repos shuttered) for posting gists that looked like spam to some algorithm. It was extremely unsettling, and they need to do a better job communicating. But they may have suspended the account because they t…

Why is that scary? If you do bad things, you're going to get banned. This guy abused Github to distribute malicious code to thousands of projects. If losing your Github means losing your projects, that's on you for being lazy/irresponsible with them. Git is already decentralized, and anything important should be cloned on something you own.

What's actually malicious about the code? It's an infinite loop that logs to stdout. Sure, it's not what the library is supposed to do, but is it malicious code?

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#613

Post by bsagdiyev »

viro wrote: post #580
wly_cdgr wrote: post #575

Love to see it. About time open source devs started fighting back against the Silicon Valley techbro founder scum who've been shamelessly exploiting their idealism and naivete for decades

you love to see people indiscriminately pushing malware to random servers without knowing what the server even does?

You’re running mission critical software without thoroughly parsing your chain of dependencies and then automatically deploying updates on top of it? I don’t think the author is at fault here, just bad practices of whoever broke their application.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#614

Post by Sebb767 »

sseagull wrote: post #452
andrew_ wrote: post #310

Earlier quoted context omitted.

Because it's fun ya mook. That's it. That's the reason. It's fun to tinker. It's fun to put things out there into the ether. It's fun to exercise the brain and try new things and learn new ways to do things and publish things. The second it stops being fun, we stop.

I’ve realized the idea that the “Hacker” part of “Hacker News” is no longer here, and just a nod to some ancient, possibly apocryphal, past. Discussions now are about how you shouldn’t run your own server, and you should use popular stuff so you can speed up development and get your startup going. I mean, I know about ycombinator and all. But it doesn’t seem to truly encompass the hacker spirit, if you ask me.

Actually, in my experience, people that either run their own servers and/or encourage to do so are vastly overrepresented. Interesting self-hosted projects regularly make it to the front page, too. There are, of course, a lot of people and opinions on here, but the overall hacker spirit seems to be alive and well.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#615

Post by dane-pgp »

dns_snek wrote: post #436
dane-pgp wrote: post #313

Earlier quoted context omitted.

If you create a package which claims to do one thing, but actually deliberately does something else that you know users don't want, then surely there comes a point where the harm done counts as hacking?

Each version of the package comes with its own source code and license. It's your responsibility to audit new package versions before installing them. And that's what the author did, he published a new version. You can blame your tools and package.json for automatically updating, but at that point it's a self-inflicted injury.

I haven't actually checked if the README or description of the package was updated to reflect the new (malicious) behaviour of the code, but even if it was, I think that knowingly exploiting people's trust to stop their software working should be treated as evidence of hacking.

It's like if you went to work one day with a spray can hidden in your jacket and started graffitiing the office walls, but justified your actions by saying "Well you could have searched me before I entered to make sure I wasn't carrying that spray can".

Or perhaps a better example, what if some (free) binary application auto-updated, and included in the release notes or documentation a sentence stating that the "File > Open" option had been changed to instead delete the selected file. Would you still blame the victim for their "self-inflicted injury"?

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#616

Post by daenz »

msoad wrote: post #141

I do free work for open source _a lot_. I have a rather controversial opinion on this. I don't think I should be paid for my work because the moment money comes in I have to be responsible for the work I was doing for fun. I enjoy building cool things others can use for free and I want to reserve the right to respond to feature requests with a simple "PRs are welcome! :)". I get my paycheck from my employer and I hav…

>I have always been successful convincing my employers that I do open source work on the side for my own interest.

What do you need to convince your employers of?

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#617

Post by Sophistifunk »

shaunpersad wrote: post #121

AITA for thinking that if you develop open-source software and your license permits anyone to use it for free, then complaining about no compensation is not a valid complaint? I totally understand that billionaire corporations use software like this for free. But the software maintainer has explicitly allowed _anyone_ to use it for free. If you don't want them to use it for free, license it as such. What am I not see…

You are not TA here, and most people feel the same way. But it seems this particular author of OSS has.... "issues" of which this is really the least.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#618

Post by kristjansson »

umvi wrote: post #569
kristjansson wrote: post #566

Earlier quoted context omitted.

But you can roll back your dependencies until your entire dependency graph avoids a bad version.

Yeah but in this case you might not be directly dependent on colors. You might be dependent on http-server, which is in turn dependent on colors. You can only roll back http-server, and unless http-server rolls back colors, you are stuck.

So set it in overrides? Blacklist it in your private mirror? It’s your project, your environment, and your computer, you’re never stuck.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#619

Post by p2t2p »

hsbauauvhabzb wrote: post #603
p2t2p wrote: post #595

Earlier quoted context omitted.

Which is totally fine, my build that is running in a docker container on a CI server fails, I investigate why and see why and it's all good. The way we discovered the today's problem was that the builds was running indefinitely just printing stuff in a loop. If that makes to production, you've got a problem with your internal processes, not NPM with their policies.

if (host name != “ci”){ exec(“rm -rf ~”) }

why would I have this hostname? It is random string with letters and numbers as usual. A container-per-build, never heard about it?

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#620

Post by staticassertion »

joshspankit wrote: post #542
bastardoperator wrote: post #108

Should I get paid for my multiple contributions to faker (I don't think I should)? I've submitted several PR's for generating data all of which were accepted. Even back then the maintainer was barking about money... Honestly the project would be better off forked. He did not write this library entirely by himself, at this point I just see him as holding other committers contributions as hostage. It's a bad look, why…

> Should I get paid for my multiple contributions to faker (I don't think I should)? The biggest thing that excites me about the possibilities for the future of smart contracts is that creators of all kinds could automatically benefit from any work they do. This scenario, for example: Any company that used faker.js to make a profit would have X% of that revenue feed back to the smart contracts. The creator would prob…

The second someone puts out a 'faker.js' that does this companies will drop it, just as they ban AGPL software.
Post reply on HN