Live data from Hacker News

NPM won't publish packages containing the word keygen

mamot.fr

61–70 of 269 posts

Re: NPM won't publish packages containing the word keygen

#61

Earlier quoted context omitted.

Time to change the name of your business to kexgen I guess.

GenKey?

Our CLI already uses genkey as a command so unfortunately that's no bueno:

    keygen genkey
Can't do genkey genkey. That's just weird...

Re: NPM won't publish packages containing the word keygen

#63
post #39
post #25

Earlier quoted context omitted.

My favorite is the online name censoring in video games. Dark Souls infamously just does a straight check of any string match within the name against a big list of no-no words. So in this fantasy game where everyone is running around as a knight, anyone who has "knight" in their game will appear as "k***ht" to other players. There's also a famous image I've seen online from another game where the guy's name was Nasse…

I remember a conversation with some using an in-house file transfer system “Oh you won’t be able to send more than X GBytes, at that point the chances that the base64 encoding contains a banned rude word become too high, and the transfer will fail”

Maybe it's time to convert base64 to high UTF8-areas. I guess there won't be any keyword-filter yet for ancient egyptian hieroglyphs. I'm curious whether there are already emoji-filters...

Re: NPM won't publish packages containing the word keygen

#64
post #30

This reminds me of the supply chain attack experts who's only solution seems to be blocking postinstall scripts.

That sounds completely different. Blocking the word 'keygen' accomplishes absolutely nothing and is clearly stupid. Blocking build scripts absolutely stops a major attack vector.

Malicious unchecked code in postinstall can just be moved to runtime so blanket blocking postinstall is as effective a solution to supply chain attacks as the solution of blocking npm packages with the word "keygen" in them is to the problem of .... js based keygens???

There are many legitimate purposes for postinstall scripts yet the anti-postinstall crowd acts like they solved security issues with this one easy step.

Re: NPM won't publish packages containing the word keygen

#65
post #56

Earlier quoted context omitted.

unrelated to your question: Your website's very pretty, but doesn't scroll horizontally on mobile. It also looks like there might be a bug in the code sample - where does "fingerprint" come from?

Why would you want to scroll horizontally? Or are you referring to the code samples? It's only a code "sample" (i.e. non-working just to show off the platform), so fingerprint would likely come from something like https://github.com/denisbrodbeck/machineid . Full examples are available in the Go SDK docs [^0]. [^0]: https://github.com/keygen-sh/keygen-go

The functionality makes sense given this response. The code sample is not fully viewable without a horizontal scroll; it's cut off about 20 columns in. It's as if you're presenting 2/3 of your website, but not allowing the user to see anything else.

Re: NPM won't publish packages containing the word keygen

#66
post #58
post #49

Earlier quoted context omitted.

Unrelated, but your homepage has very bad FPS using firefox on mac due to the animation. Once I manage to scroll it works quite well.

Thanks. That shader doesn't seem to play nicely with some GPUs and I'm still working on edge cases. If possible, could you look at your console logs and email me your specs? They should be logged. Email is in bio. It should be doing automatic categorization of the GPU to determine render quality, but maybe something's still incorrect there.

Just turn it off.

Re: NPM won't publish packages containing the word keygen

#67
post #66
post #58

Earlier quoted context omitted.

Thanks. That shader doesn't seem to play nicely with some GPUs and I'm still working on edge cases. If possible, could you look at your console logs and email me your specs? They should be logged. Email is in bio. It should be doing automatic categorization of the GPU to determine render quality, but maybe something's still incorrect there.

Just turn it off.

[deleted]

Re: NPM won't publish packages containing the word keygen

#68
post #17

Reminds me of the times I've seen junior devs changing "password" to "wordpass" to bypass automated commit checks for sensitive data. These kinds of checks are so trivially defeated, the only people they actually stop is people trying to do legitimate work.

Presumably some of those devs will see the warning and think "oh yeah, I probably shouldn't commit the password" rather than find a workaround.

Re: NPM won't publish packages containing the word keygen

#69
post #58
post #49

Earlier quoted context omitted.

Unrelated, but your homepage has very bad FPS using firefox on mac due to the animation. Once I manage to scroll it works quite well.

Thanks. That shader doesn't seem to play nicely with some GPUs and I'm still working on edge cases. If possible, could you look at your console logs and email me your specs? They should be logged. Email is in bio. It should be doing automatic categorization of the GPU to determine render quality, but maybe something's still incorrect there.

No problems here with firefox on x11 and amdgpu/mesa drivers fwiw

Re: NPM won't publish packages containing the word keygen

#70
post #17

Reminds me of the times I've seen junior devs changing "password" to "wordpass" to bypass automated commit checks for sensitive data. These kinds of checks are so trivially defeated, the only people they actually stop is people trying to do legitimate work.

Tbh in this case that check is useful. It prevents devs from accidentally including passwords in their commits.
Post reply on HN