Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

bleepingcomputer.com

Post reply on HN
Print view View original

681–690 of 1001 posts

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#681

Post by inlined »

dane-pgp wrote: post #615
dns_snek wrote: post #436

Earlier quoted context omitted.

Each version of the package comes with its own source code and license. It's your responsibility to audit new package versions before installing them. And that's what the author did, he published a new version. You can blame your tools and package.json for automatically updating, but at that point it's a self-inflicted injury.

I haven't actually checked if the README or description of the package was updated to reflect the new (malicious) behaviour of the code, but even if it was, I think that knowingly exploiting people's trust to stop their software working should be treated as evidence of hacking. It's like if you went to work one day with a spray can hidden in your jacket and started graffitiing the office walls, but justified your act…

Even if it were in a readme, the developer knows the default version of npm install is a version lock on the major and they made it a patch version so that it would intentionally be picked up by almost everyone. I think I actually am going to file criminal charges.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#682

Post by Osmose »

AmericanChopper wrote: post #481
Osmose wrote: post #322

Earlier quoted context omitted.

> The FOSS way should be to pay it forward, to contribute to projects where you can. In theory, this was enforced by copyleft requiring derivative works to also be free software. In practice, companies use software with permissible licenses instead because then they can reap the benefits without any requirement to pay it forward. > If you’re expecting to get paid for it, it’s not FOSS. Being paid for your time has no…

Copyleft software isn’t free, it comes with a very hefty price tag. You don’t pay it forward by handing over all your IP. You pay it forward by contributing back. I have no moral qualms about using OSS in any project I’m working on, commercial or otherwise. Because I have published my own libraries for anybody to use, and contributed a huge amount of PRs to the software I use. When you publish something with a permis…

Your conception of free software is not how free software is generally understood; free software is about the rights of the users, not the expectation that people contribute to it. Sure, if you _define_ free software as being about a lack of ownership by one person and expected contributions, then you can criticize this.

But what happened here is that free/open source software doesn't have a consistent stance on paying maintainers or contributors, and this author feels that it's unfair and (potentially in the midst of other personal issues, it seems?) took advantage of a problem with how the ecosystem pulls in dependencies to complain about it.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#684

Post by burtonator »

noah_buddy wrote: post #402
hn_throwaway_99 wrote: post #392

Earlier quoted context omitted.

> It's a bad look, why would anyone want to deal with him after this stunt is beyond me. The maintainer appears to be unwell: https://abc7ny.com/suspicious-package-queens-astoria-fire/64...

The maintainer seems a few steps beyond unwell. Seems like he was planning a terrorist act of some sort. Even if one is mentally unwell, I would not first describe them that way should they choose to premeditate harm against others. If you're building bombs, you're almost certainly at that point. At the very least, the maintainer is unstable if not actively malicious and seeking to cause harm however he can.

> I would not first describe them that way should they choose to premeditate harm against others.

That's why a judge often has to determine if the person is mentally ill or just a criminal.

There are plenty of situations where someone has hurt other people and they've been literally insane.

If your insanity causes you to believe that someone is doing horrible things like murdering children you might decide to do them harm, thinking you're the good guy.

In reality you have paranoid schizophrenia or a litany of other mental health issues.

It's not cut and dry :-/

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#685

Post by broknbottle »

tjpnz wrote: post #468
oneoff786 wrote: post #240

Earlier quoted context omitted.

I’m a self taught Python programmer. I haven’t don’t much front end. Why do some JS devs import tiny packages to do simple things? I don’t feel like I’ve seen this behavior in Python. Is it because browsers are an awful environment?

They took the Unix philosophy of doing one thing well and drove it off a cliff.

I literally lol’d. Thank you for the laugh

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#686

Post by tomjen3 »

LAC-Tech wrote: post #491
kcb wrote: post #453

Earlier quoted context omitted.

Use a language where you don't need to pull in 100 dependencies to create a useful application/service.

It's not a language problem. It's a cultural problem. Last I checked create-react-app pulls around 1k transitive dependencies. Can't really blame JS for that, can we?

Keeping dependencies loosely coupled and reusable has been best practice since forever, but it is only really with NPM that it has become the default.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#688

Post by burtonator »

joshspankit wrote: post #542
bastardoperator wrote: post #108

Should I get paid for my multiple contributions to faker (I don't think I should)? I've submitted several PR's for generating data all of which were accepted. Even back then the maintainer was barking about money... Honestly the project would be better off forked. He did not write this library entirely by himself, at this point I just see him as holding other committers contributions as hostage. It's a bad look, why…

> Should I get paid for my multiple contributions to faker (I don't think I should)? The biggest thing that excites me about the possibilities for the future of smart contracts is that creators of all kinds could automatically benefit from any work they do. This scenario, for example: Any company that used faker.js to make a profit would have X% of that revenue feed back to the smart contracts. The creator would prob…

The biggest challenge here is measuring the quality of someone's contributions and adjusting compensation accordingly.

Not every commit is worth the same level of compensation.

Companies like Google/Amazon have to go through and adjust compensation based on talent and contribution levels, but how would that be done in Open Source?

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#689

Post by gitgrump »

hnthrowaway0315 wrote: post #127
guessmyname wrote: post #32

Earlier quoted context omitted.

> What exactly does colors do? A picture is worth a thousand words → https://i.imgur.com/inxA7Pg.png The library inserts ANSI escape sequences [1] between the text you want to colorize in order to, well, colorize it ¯\_(ツ)_/¯ Many people are obsessed with colors in the Terminal, and so, they reach out to libraries like this. They exist in every major programming language ecosystem, even though colorizing text is as s…

Why wouldn't everyone roll their own solution? Doesn't seem to be a huge thing to me, but I could be wrong...

Honestly? They probably don't know how, or that's just not part of the JS culture. I've met a lot of JS-only developers, and most probably don't even know what ANSI escape sequences are, let alone how to work with them. The lack of basic computer knowledge from the JS ecosystem is shocking. I don't expect this to poll well in Peoria, as it were, but this has been my consistent observation.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#690

Post by bhawks »

hsbauauvhabzb wrote: post #603
p2t2p wrote: post #595

Earlier quoted context omitted.

Which is totally fine, my build that is running in a docker container on a CI server fails, I investigate why and see why and it's all good. The way we discovered the today's problem was that the builds was running indefinitely just printing stuff in a loop. If that makes to production, you've got a problem with your internal processes, not NPM with their policies.

if (host name != “ci”){ exec(“rm -rf ~”) }

Just do it randomly... 6.9% of the time be evil. People will write it off as flakiness in ci.
Post reply on HN