Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

bleepingcomputer.com

Post reply on HN
Print view View original

621–630 of 1001 posts

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#621

Post by paulryanrogers »

ineedasername wrote: post #610
franciscop wrote: post #267

Earlier quoted context omitted.

I have a different opinion, but I respect yours; and that's the basis of open source. There's many, many vastly different reasons why people do open source, and partly probably why we haven't "banded together to get paid" so to speak. For me, if I got donations that'd be great, but it'd not create a different sense of responsibility for my work, I'd keep doing exactly the same (unless I was explicitly hired as a cont…

>donations I think there is a big psychological difference (and maybe a legal one?) between accepting donations for something you put up for public access vs. accepting payment for doing work.

If so would that also impact 'backing' like KickStarter and Patreon?

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#622

Post by viro »

iandanforth wrote: post #502
dariusj18 wrote: post #450

Earlier quoted context omitted.

malicious is it's own beast that should always be guarded against, but being MIT doesn't give someone the right to be malicious.

"THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR T…

No a license clause can't shield you from an intently malicious act. He's probably getting charged under the CFAA.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#623

Post by cardosof »

Urgh, that's horrible. Even if package authors feel like they should get some compensation, breaking code like this is never the way to go. Maybe they think most apps are "useless" anyway and could break, but there's a chance healthcare/wellness apps might break too, doing real harm to real people.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#624

Post by viro »

raesene9 wrote: post #7
dagmx wrote: post #4

Earlier quoted context omitted.

GitHub ToS allow terminating accounts for malicious behaviour, which I'd argue that purposefully breaking downstream code is.

That seems like a bit of a shaky ground to stand on for GH. If someone publishes code for themselves, and at no time asks anyone to take it as a dependency, then at a later date they change that code in a way that breaks other people's use of it, do GH then take over the account?

That's not what happened here. Author intentionally pushed malware.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#625

Post by balls187 »

zaroth wrote: post #604
drawkbox wrote: post #97

Earlier quoted context omitted.

Dependencies are a major attack vector now. Tread carefully with all the supply chain attacks out there, it might not even be the authors doing these. We are entering a dependency attack massive war. Dependencies are a balance but also a sign of weakness of a system in the modern day. There at least needs to be delayed, dependency bot like analysis before you integrate. Even then, they just leave your systems open to…

Crazy what happens when you decide to freeload off a stranger’s code who you have no contract or agreement with whatsoever, beyond a license you must accept to use the software which disclaims any warranty whatsoever, even fitness for any purpose. I have zero sympathy for anyone complaining they were hurt by this. I think Marak is teaching an important and principled lesson here.

> I think Marak is teaching an important and principled lesson here.

What lesson is that?

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#626

Post by viro »

esarbe wrote: post #10
dagmx wrote: post #4

Earlier quoted context omitted.

GitHub ToS allow terminating accounts for malicious behaviour, which I'd argue that purposefully breaking downstream code is.

Why would the developer of any software that comes explicitly without warranty be hold responsible for downstream breakages? It's not as if one could force people to upgrade to newer versions and they can always keep depending on the old releases.

> be hold responsible for downstream breakages

he's not, He's being held responsible for intentionally pushing malware

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#627

Post by Dylan16807 »

shaunpersad wrote: post #586
etchalon wrote: post #454

Earlier quoted context omitted.

There are people who think its reasonable to take all the pennies from the "take a penny leave a penny" plate because "that's what it's there for."

I assume you mean "take a penny" = "use the software for free" and "leave a penny" = "contribute back" (money or time). With the plate there's a sign that says both "take" and "leave". In this case there is also a sign (the license) which only says "take". The intent is clear in both. It's further not comparable because taking a literal penny deprives the next person of it, whereas here using the software for free co…

It's very normal for packages to have donation requests, and for developer pages to have donation links.

The metaphorical sign does say take and leave, and the take vastly outweighs the leave.

> Again, if he wanted to make money from his software, he should've put it in the license and charged the big users for it.

A developer shouldn't have to ruin the open-source nature of the software to get there.

Maybe if we could invent some standardized almost-open-source license that doesn't terrify companies we could get there, but we can't even seem to define "commercial" in a way that doesn't break everything. Better still it would be nice if we could use social pressure to get companies to donate a small fraction of the money open source saves them.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#628

Post by ajdude »

LAC-Tech wrote: post #491
kcb wrote: post #453

Earlier quoted context omitted.

Use a language where you don't need to pull in 100 dependencies to create a useful application/service.

It's not a language problem. It's a cultural problem. Last I checked create-react-app pulls around 1k transitive dependencies. Can't really blame JS for that, can we?

This whole situation reminds me of that post a little while ago

> I will pay you cash to delete your npm module

https://news.ycombinator.com/item?id=29240952

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#629

Post by blackoil »

notRobot wrote: post #21

Here's my $.02: Packages are literally remote code exec vulns in the hands of package authors. At the very least, it takes them under a minute to break your app, simply by deleting their package. Read the article. This is not the first time it's happened, and it's not going to be the last. [0] I write backends (mostly in PHP, although not exclusively), and I release a lot of my code under libre licenses. But I don't…

Extending your logic to extreme you'll not be able to use any OS, compiler, processor unless you build it. We can't build practically anything of use without any 3rd party library in any language/platform.

The problem here is not packages but lack of stdlib and tendency of package writers to have shit ton of further dependencies.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#630

Post by viro »

deadbunny wrote: post #53
not2b wrote: post #22

Earlier quoted context omitted.

In this case, the developer's behavior was malicious: they intentionally caused damage. This is very different than some good faith change that breaks stuff downstream. Sure, the license says "no warranty". But github can decide that they won't tolerate vandals on their platform. It would be within their right to revert the bad change from the git database they hold, go back to the last good change and lock the devel…

What damage did they cause?

It crashes the servers that use the package?
Post reply on HN