Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NPM won't publish packages containing the word keygen

mamot.fr

Post reply on HN
Print view View original

151–160 of 269 posts

Re: NPM won't publish packages containing the word keygen

#151

Post by Dwedit »

y-curious wrote: post #121
ezekg wrote: post #19

I run a business called Keygen [^0], and own the @keygen namespace on npm. We’re working on a Node SDK, so this isn’t good to hear. I’ll open up a discussion with them and see what we can do. [^0]: https://keygen.sh

I didn't know there was a name for this, what a fun Wikipedia rabbit hole[1]. Pretty entertaining that censors still don't get it right decades later. [1]: https://en.wikipedia.org/wiki/Scunthorpe_problem

The solution is to examine all words that contain that substring and explicitly whitelist them.

Nowadays though, we have a different Scunthorpe problem. I call it the "Hidden Garfield" problem, because that phrase is detected as a racial slur after you run Double Metaphone on it and throw out spaces.

Re: NPM won't publish packages containing the word keygen

#152

Post by 40yearoldman »

Every time npm comes up I remind everybody that npm is shit, and nobody should use it. They have a bad track record of doing things right and bad attitude when told.

But you keep using it.

I refuse to use it at work and refuse to use it in personal life. It’s not real software and will cause you harm.

Re: NPM won't publish packages containing the word keygen

#153

Post by jjgreen »

hinkley wrote: post #141
_ugfj wrote: post #15

I thought buttbuttination taught everyone how incredibly stupid this is 25-30 years or so ago already? But no. Just a few years ago I tried to enter an answer into a Hungarian Q&A site recommending to take the Algeciras-Tangier ferry and the answer was refused. https://en.wiktionary.org/wiki/geci

At the dawn of the search engine age I was in Japan, and so I spent some time not being able to learn about shitake mushrooms, as was a common western spelling at the time (they are not shi-ta-ke mushrooms, they are in fact shi-i-ta-ke mushrooms, hence the spelling change, even though we still pronounce them wrong). You couldn’t say shit on the internet. I mean what the fuck.

... the dirty bastards https://www.youtube.com/watch?v=ndcPtU6Imc0

Re: NPM won't publish packages containing the word keygen

#154

Post by georgyo »

franky47 wrote: post #20
_ugfj wrote: post #15

I thought buttbuttination taught everyone how incredibly stupid this is 25-30 years or so ago already? But no. Just a few years ago I tried to enter an answer into a Hungarian Q&A site recommending to take the Algeciras-Tangier ferry and the answer was refused. https://en.wiktionary.org/wiki/geci

The Scunthorpe problem all over again. https://en.wikipedia.org/wiki/Scunthorpe_problem

I only recently learned that my username for 20 years has "orgy" in it, and I've been getting blocked by many games

Re: NPM won't publish packages containing the word keygen

#155

Post by tzs »

hbn wrote: post #25
withinboredom wrote: post #8

keyword moderation is terrible and only affects the language(s) you know about. It doesn't actually prevent the content (the goal of these types of filters) from being served. It'd be like a virus scanner preventing a program from running because it had the name 'virus' in it ... which would prevent itself from running -- probably.

My favorite is the online name censoring in video games. Dark Souls infamously just does a straight check of any string match within the name against a big list of no-no words. So in this fantasy game where everyone is running around as a knight, anyone who has "knight" in their game will appear as "k***ht" to other players. There's also a famous image I've seen online from another game where the guy's name was Nasse…

> My favorite is the online name censoring in video games.

I don't know what the filters are like in EverQuest nowadays [1], but back in 2000 EQ didn't allow "cock" in chat. Then in April 2000 the expansion "The Ruins of Kunark" came and some of the zones that pretty much everyone making their first trips to Kunark would visit contained a variety of hostile cockatrices, and the chat filter would not let you mention them because of the "cock" at the start of their names.

I once had occasion to implement a chat system for a small online gaming service and was supposed to filter out bad language. What I did was something like this:

1. Split the message into words.

2. For each word that is in /usr/share/dict/words or our own list of good words and is not on our bad words list, mark each character in that word as being good.

3. Concatenate all the words.

4. Find all places where words from the bad list appear as substrings of that concatenated string.

5. For any such bad words in the concatenated string mask the corresponding characters in the original message with asterisks unless all of the bad word's characters in the concatenated string are marked as good.

For example the word "cockatrice" would have been uncensored even if "cock" was on our bad list because "cockatrice" is in /usr/share/dict/words and would not have been on the bad list. On the other hand "cocksucker" would have had the "cock" masked.

If someone had tried to slip "cocksucker" by by inserting spaces such as "c o c k s u c k e r" the "cock" part would have still been masked, because the "c o c k" would have ended up as "cock" in the concatenated string, and not marked as good.

Note that you would have been able to call someone a "peacock sucker" just fine, because "peacock" is in /usr/share/dict/words. Misspell that as "peecock sucker" though and then the "cock" part would have been masked.

I was fine with that. I figured it encouraged good spelling among those who want to insult others. :-)

(There was a little more, such as dealing with tricks like using 3 for e or \/\/ for w but those aren't really relevant to the general idea).

[1] Yes, EQ is still around...and with the changes it has undergone over the years it is actually a pretty nice solo or small group game even on a free play account, especially if you have an old account to reactive so you get veteran rewards. Here's a description of some of the major changes [2]. When I returned to EQ a few years ago, I had no trouble playing a solo Bard to around level 60 on free play. Things got a bit slow then and I switched to paid. I then made reasonable progress up until I had finally satisfied my

[2] https://news.ycombinator.com/item?id=31368588

Re: NPM won't publish packages containing the word keygen

#156

Post by Kiro »

retrocryptid wrote: post #74
franky47 wrote: post #20

Earlier quoted context omitted.

The Scunthorpe problem all over again. https://en.wikipedia.org/wiki/Scunthorpe_problem

wait... are you implying that "k*ygen" is a dirty word?

You're getting downvoted but I also don't understand the relevance here. Parent seems to imply this is a mistake by npm relying on partial censorship but aren't they literally banning this exact word?

Re: NPM won't publish packages containing the word keygen

#157

Post by marcosdumay »

smashah wrote: post #64
insanitybit wrote: post #60

Earlier quoted context omitted.

That sounds completely different. Blocking the word 'keygen' accomplishes absolutely nothing and is clearly stupid. Blocking build scripts absolutely stops a major attack vector.

Malicious unchecked code in postinstall can just be moved to runtime so blanket blocking postinstall is as effective a solution to supply chain attacks as the solution of blocking npm packages with the word "keygen" in them is to the problem of .... js based keygens??? There are many legitimate purposes for postinstall scripts yet the anti-postinstall crowd acts like they solved security issues with this one easy ste…

Postinstall scripts run without any interaction before the developer has any chance of reviewing the code.

They are a very bad thing.

Re: NPM won't publish packages containing the word keygen

#158

Post by tobiasSoftware »

40yearoldman wrote: post #152

Every time npm comes up I remind everybody that npm is shit, and nobody should use it. They have a bad track record of doing things right and bad attitude when told. But you keep using it. I refuse to use it at work and refuse to use it in personal life. It’s not real software and will cause you harm.

Fun fact. Several years ago I started getting charges from NPM, which although I am a software developer I have never used. I cancelled my credit card multiple times, but they kept appearing each month.

I went to my bank, Bank of America, and they claimed that there was nothing they could do because NPM was using some sort of option they had to follow me when I got new credit cards. I don't know what kind of option that is, as every time I get a new credit card I have to update it with literally every other company. I also don't know how a bank wouldn't have some sort of manual override. Nevertheless, I called NPM, who said I had to talk with my bank. Eventually, after months of dealing with this loop, I threatened to leave my bank, and my bank advised me to call them and threaten to get the BBB involved if they didn't fix it, and a few days later NPM admitted it was an error on their end and reversed all of the charges.

To this day I wonder what kind of shady thing NPM was doing to not just charge someone who had never been a customer of theirs, but to follow them across cancelled credit cards.

Re: NPM won't publish packages containing the word keygen

#159

Post by sebastialonso »

franky47 wrote: post #20
_ugfj wrote: post #15

I thought buttbuttination taught everyone how incredibly stupid this is 25-30 years or so ago already? But no. Just a few years ago I tried to enter an answer into a Hungarian Q&A site recommending to take the Algeciras-Tangier ferry and the answer was refused. https://en.wiktionary.org/wiki/geci

The Scunthorpe problem all over again. https://en.wikipedia.org/wiki/Scunthorpe_problem

This page is a delight to read.

Re: NPM won't publish packages containing the word keygen

#160

Post by marcosdumay »

sebzim4500 wrote: post #68
devmor wrote: post #17

Reminds me of the times I've seen junior devs changing "password" to "wordpass" to bypass automated commit checks for sensitive data. These kinds of checks are so trivially defeated, the only people they actually stop is people trying to do legitimate work.

Presumably some of those devs will see the warning and think "oh yeah, I probably shouldn't commit the password" rather than find a workaround.

I really hope their password isn't literally "password", so I can't see how blocking that word improves anything.
Post reply on HN