Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

bleepingcomputer.com

Post reply on HN
Print view View original

891–900 of 1001 posts

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#891

Post by Chris2048 »

ahtihn wrote: post #714
Beldin wrote: post #697

Earlier quoted context omitted.

> I agree that it’s ultimately the developers fault for allowing code to be automatically injected Let's not do victim blaming here. This is ultimately the fault of the person deliberately updating their package to break other people's software.

Nah, open source software is "use at your own risk" and there's 0 guarantee for anything. All responsibility lies with the user. If you don't like that responsibility, don't use open source software without reviewing it first.

"0 guarantee" might apply to accidental bugs, but a developer maliciously sabotaging their packages?

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#892

Post by Chris2048 »

zaroth wrote: post #604
drawkbox wrote: post #97

Earlier quoted context omitted.

Dependencies are a major attack vector now. Tread carefully with all the supply chain attacks out there, it might not even be the authors doing these. We are entering a dependency attack massive war. Dependencies are a balance but also a sign of weakness of a system in the modern day. There at least needs to be delayed, dependency bot like analysis before you integrate. Even then, they just leave your systems open to…

Crazy what happens when you decide to freeload off a stranger’s code who you have no contract or agreement with whatsoever, beyond a license you must accept to use the software which disclaims any warranty whatsoever, even fitness for any purpose. I have zero sympathy for anyone complaining they were hurt by this. I think Marak is teaching an important and principled lesson here.

freeload is a fairly loaded term. "disclaims any warranty" isn't the same as malicious action; I don't have to pay you if your house burns down if you don't have an insurance policy (contract) with me but I'm still liable if I commit arson.

Also, AFAIK, Marak is not the original author; Is he also a freeloader for attempting to commercialise this code?

> teaching an important and principled lesson here

The history of this issue speaks differently to their intentions, but even so, there is a way to "teach lessons" and that's by doing something alarming but harmless. AFAIK Marak wanted to cause harm, and acted in a way to do so.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#893

Post by pcj-github »

Guy with history of mental illness is marking commits as "endgame" and making references to Aaron Schwartz. Hope someone is reaching out with professional help for him, or I fear there will be one final HN post about this story in the near future.

I think he has a right to torpedo his own projects, and GitHub should stay out of it. Pin your deps, folks.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#895

Post by [deleted] »

Chris2048 wrote: post #890
detaro wrote: post #826

Earlier quoted context omitted.

How does a maintenance contract make the software not-FLOSS? It's a working option if you need more promises than the license gives you.

Because you haven't solved the problem for FLOSS, you've solved the problem for non-FLOSS that might also happen to also be FLOSS aka contribute somehow to a FLOSS version of the project - but the solution doesn't help those under the FLOSS licence, and complicates incentives to contribute to FLOSS/"community" versions. Great for corporates who can buy the support contract, but is also suspiciously similar to the "fr…

[deleted]

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#896

Post by a3w »

ajdude wrote: post #628
LAC-Tech wrote: post #491

Earlier quoted context omitted.

It's not a language problem. It's a cultural problem. Last I checked create-react-app pulls around 1k transitive dependencies. Can't really blame JS for that, can we?

This whole situation reminds me of that post a little while ago > I will pay you cash to delete your npm module https://news.ycombinator.com/item?id=29240952

So finally F.L.O.S. Software pays out. Shame that the dev did not apply for some compensation. All in all, not very rational of him.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#897

Post by Dylan16807 »

slibhb wrote: post #840
Dylan16807 wrote: post #520

Earlier quoted context omitted.

> That would involve exchanging his labor for currency. That's the goal. Or at least one goal. But you can't just press a button and do that. Being in charge of and an expert on open source software can be a way get people to buy your labor, but it's much harder than it should be. Instead many companies will demand you work for free, because it's open source! Also trying to do something good for the world shouldn't m…

> Being in charge of and an expert on open source software can be a way get people to buy your labor, but it's much harder than it should be. Instead many companies will demand you work for free, because it's open source! It's hard to get paid when you decide to give your work away. If only there was some way a person could enter into a contract in order to guarantee payment in exchange for their work. What a radical…

1. Why is it so hard to sell additional labor on the open source project? That's the purest form of exchanging money for services.

2. You shouldn't have to take the option that hurts everyone else just to get paid.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#898

Post by alexwebb2 »

esarbe wrote: post #867
viro wrote: post #626

Earlier quoted context omitted.

> be hold responsible for downstream breakages he's not, He's being held responsible for intentionally pushing malware

I don't think he pushed malware, did he? He just broke his own project and published the broken version. That's not pushing malware. I don't get why people don't just pin versions, honestly. I'm not saying he did a good thing. But neither did he push malware nor has he any obligation to publish unbroken packages. If you're using FOSS projects without a service contract, don't whine if something breaks.

"Not pushing malware", _wink wink_.

Let's say I set up a lemonade stand in my neighborhood every weekend, where I pour a bunch of cups for people to take, put up a sign that says it's free, and I set out a tip jar.

After a few weeks, I get upset that people have been taking the lemonade without leaving tips, so the next time I set up the stand I add a toxin that I know will cause immediate damage to anyone who ingests it. To protect myself, I have of course been posting a sign every weekend that says the lemonade is provided as-is.

So – did I do something wrong, or not? Will a court look at this situation and say, "gee, he just poisoned his _own_ lemonade and set it out for public use, it's not like he forced anybody to drink it"?

This feels like 100% black-and-white criminal conduct, and I would hope anyone who pulls a malicious stunt like this would be held liable for it.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#899

Post by withinboredom »

Sander_Marechal wrote: post #879
heurisko wrote: post #839

Earlier quoted context omitted.

In the context of PHP, the package source is put under vendor/ and in my IDE is automatically indexed. It's very easy to view the source code. You can even experiment with the packages directly, by editing the files in vendor/.

It would be nice if Composer can give me a `diff` of before/after an update though.

Git submodule with vendor packages checked in? Delete the module after the upgrade and you’ve inspected it.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#900

Post by fold_left »

Using a lockfile and checking in your dependency tarballs [1] can help insulate you from these problems until you're ready to face them.

I created shrinkpack before left-pad and thankfully it meant that we were unaffected.

A lot of developers, understandably, baulk at checking in dependencies, but there is a concrete benefit in being able to continue uninterrupted during outages.

[1] https://github.com/JamieMason/shrinkpack

Post reply on HN