Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

bleepingcomputer.com

Post reply on HN
Print view View original

901–910 of 1001 posts

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#901

Post by oblio »

throw_m239339 wrote: post #249
oblio wrote: post #217

Earlier quoted context omitted.

There are package exclusions, package forcing and of course, full dependency tree checks where you review what everything pulls in. The JS ecosystem will probably have to change but because it's so decentralized, that change will be orders of magnitude harder than, for example, PHPs transition from 3 (4, 5) to 7.

> The JS ecosystem will probably have to change but because it's so decentralized, Is it? Everybody is pulling from Microsoft owned servers now, as Microsoft owns both Github and NPM.

You're right in the package storage sense.

I don't think you're right in the builder/building practices sense.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#902

Post by leshenka »

sam_goody wrote: post #844

While I disagree with his move. 1.It is totally in his prerogative to mess up the package he manages, but not to install into it malware. I am on the fence if this would count as malware. (Because of the open loop, but my leaning is that this is not malware.) 2. Github is, IMO, breaking any trust that I might have had by assuming control of the package, removing the last commit and keeping it online. If they feel the…

I wholeheartedly agree with everything except 5)

Faker has (had?) MIT license that basically has no restrictions. $megacorps have all rights to use it any way they want.

Why not change the license then? Why not amend the LICENSE file with "free to use unless you're big tech" clause? Correct me if I'm wrong.

"big tech should be paying for all the work that is being done to help them" -- They do offer their services and usually you don't need to pay for them _directly_, rather with personal data and opensource libs. Whether or not is it fair trade -- each one decides for their own.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#904

Post by [deleted] »

broknbottle wrote: post #675

This guy again? Last time I seen something posted they were being looked into for bomb making after some kind of fire. https://nypost.com/2020/09/16/resident-of-nyc-home-with-susp... The irony is that the guy was once banned on here for spamming their startup Nodejitsu https://en.m.wikipedia.org/wiki/Nodejitsu

[deleted]

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#905

Post by gitgrump »

notatoad wrote: post #98
commandlinefan wrote: post #85

> now what stop trying to save a couple of bucks by reusing functionality that's not that hard to just develop in-house maybe?

only helps if people developing the functionality that is difficult to develop in-house do the same. i'm not going to build my own AWS cdk.

This wasn't AWS CDK, it was a package to fake data and a package with some ANSI escape sequence constants. The comparison doesn't make sense. The problem is that developers apparently can't even differentiate between when you should use a library and when you shouldn't; they just pull in the first result from an NPM search. You can probably trust AWS, which is good because CDK is complicated. You can't necessarily trust random NPM package authors, which is good because rewriting `colors` is not a Herculean task.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#906

Post by chmod775 »

maxwell86 wrote: post #110
laurowyn wrote: post #79

Earlier quoted context omitted.

Pin all you want, if the repo/vendor/maintainer pulls the release then you're not getting access to your dependencies at all. If anything, this is the reason you use pull-through proxies. Your proxy will hold the version you depend on, regardless of upstream drama. Keep your proxy backed up and you'll be able to use those dependencies until the end of time, or you finally decide to migrate to an alternative.

> if the repo/vendor/maintainer pulls the release If your package system allows this switch to another one, like, right now. NPM, Cargo, etc. don't allow this (they "unlist" versions, but they don't "remove" them, i.e. you can't search for them, but they are still there).

> NPM, Cargo, etc. don't allow this

I'd say the likelihood is about 50% you have a NPM package in your dependencies right now that pulls some binary or whatever from a random S3 bucket during installation.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#907

Post by DandyDev »

pkgland wrote: post #646
junon wrote: post #455

Maintainer of Chalk[0][1] here, a very popular alternative to colors. Happy to help anyone that would like to port away from colors to chalk, or who might just have general questions about terminal colors. Just reply here and I'll see them. [0] https://GitHub.com/chalk/chalk [1] https://npmjs.org/package/chalk

Not a question but just want to help developers who needs it: pkg.land (beta) finds similar packages on NPM. Here are the links for colors and faker: https://pkg.land/package/colors (chalk is top suggestion!) https://pkg.land/package/faker

This is very cool. Sad that it only works for NPM packages. Would love this for PyPI packages

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#909

Post by godDLL »

prepend wrote: post #787
godDLL wrote: post #494

Earlier quoted context omitted.

But completely sane to base your project on a package of code you don't control? Or to lock up his Github account for exercising his prerogative onto his own code? His behaviour is unusual, but that, you know, could change easily. It could become the normal just like that. Puff.

> But completely sane to base your project on a package of code you don't control? Yes, certainly. I think this is sane because with OSS you can control it if you need to. Until then use what exists. It’s sane to use Linux in my project even though I don’t control that. I suppose it’s also sane to use Windows even though I don’t control that.

So you just leave Windows update on in production?

Brave man.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#910

Post by gnubison »

sam_goody wrote: post #844

While I disagree with his move. 1.It is totally in his prerogative to mess up the package he manages, but not to install into it malware. I am on the fence if this would count as malware. (Because of the open loop, but my leaning is that this is not malware.) 2. Github is, IMO, breaking any trust that I might have had by assuming control of the package, removing the last commit and keeping it online. If they feel the…

> Eg. Perhaps he would have been able to change the license and demand compensation from all non-profits? That would provide both cash and publicity.

Then everyone would use the old code under the old license and he’d have even less of a chance to get funding.

Post reply on HN