Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NPM won't publish packages containing the word keygen

mamot.fr

Post reply on HN
Print view View original

191–200 of 269 posts

Re: NPM won't publish packages containing the word keygen

#191

Post by oefnak »

ezekg wrote: post #58
xavxav wrote: post #49

Earlier quoted context omitted.

Unrelated, but your homepage has very bad FPS using firefox on mac due to the animation. Once I manage to scroll it works quite well.

Thanks. That shader doesn't seem to play nicely with some GPUs and I'm still working on edge cases. If possible, could you look at your console logs and email me your specs? They should be logged. Email is in bio. It should be doing automatic categorization of the GPU to determine render quality, but maybe something's still incorrect there.

Also runs terrible on my Pixel 5 with Firefox. As for your design choices, they remind me of the Mezmo landing page...

Re: NPM won't publish packages containing the word keygen

#192

Post by oefnak »

ezekg wrote: post #181
Daneel_ wrote: post #149

Earlier quoted context omitted.

I appreciate you engaging with commenters on this, it’s nice to see. From my perspective I agree with a lot of the other commenters - it’s just design for design’s sake. It’s an expensive way to add minor visual flair that heavily degrades the experience for a sizeable number of users. In terms of value provided to the user: it’s basically zero, or often worse than zero. Personally, it feels over-designed, which the…

I spent weeks on the typography and on choosing a font. Went through so many different styles. I ended up on Owners by MCKL [^0] because I personally like the ultra-wide font trend, and I liked its Text variant as well. Bummed to hear that others aren't a fan of it. Oh well, design is pretty subjective. And it may be over-designed. It was my first foray back into design since switching careers to programming about 10…

That wide font is on purpose?! No offense, but I was sure something went wrong with rendering the page.

Re: NPM won't publish packages containing the word keygen

#193

Post by _a_a_a_ »

jbinto wrote: post #168
georgyo wrote: post #154

Earlier quoted context omitted.

I only recently learned that my username for 20 years has "orgy" in it, and I've been getting blocked by many games

20+ years of this handle online without problems, and I found out trying to sign up for Stern Pinball Insider that "bint" is a dirty word: https://en.wiktionary.org/wiki/bint

Really isn't, it's about the same as calling a woman a cow.

Re: NPM won't publish packages containing the word keygen

#194

Post by piperswe »

hunter2_ wrote: post #165
tobiasSoftware wrote: post #158

Earlier quoted context omitted.

Fun fact. Several years ago I started getting charges from NPM, which although I am a software developer I have never used. I cancelled my credit card multiple times, but they kept appearing each month. I went to my bank, Bank of America, and they claimed that there was nothing they could do because NPM was using some sort of option they had to follow me when I got new credit cards. I don't know what kind of option t…

Ok, I'll bite. There is no way a merchant can learn a new card number other than from the cardholder, or from a thief who got it from the card/cardholder. Not from any upstanding entity. If you merely got a new expiration date, security code, etc. without also changing the card number, they could "follow" that by submitting a transaction without those extra pieces of information, at greater cost and risk to themselve…

According to Stripe,

"Stripe works with card networks and automatically attempts to update saved card details whenever a customer receives a new card (for example, replacing an expired card or one that was reported lost or stolen)."

https://stripe.com/docs/saving-cards#:~:text=Automatic%20car...).

Re: NPM won't publish packages containing the word keygen

#195

Post by politelemon »

ta1243 wrote: post #180
franky47 wrote: post #20

Earlier quoted context omitted.

The Scunthorpe problem all over again. https://en.wikipedia.org/wiki/Scunthorpe_problem

Make sure you travel via Penistone on your way there

I assume that's near Scunthorpe

Re: NPM won't publish packages containing the word keygen

#196

Post by dns_snek »

smashah wrote: post #167
marcosdumay wrote: post #157

Earlier quoted context omitted.

Postinstall scripts run without any interaction before the developer has any chance of reviewing the code. They are a very bad thing.

"any chance"??? I can't square this circle of someone being paranoid about postinstall script but at the same time thinks the first chance to review dependency code is after doing a `npm i`. Check the git repo of the library you are installing beforehand if you're so paranoid about postinstall. And above that, never install any library for which the source is not readily available. This is the most basic first line o…

> Check the git repo of the library you are installing beforehand if you're so paranoid about postinstall.

> And above that, never install any library for which the source is not readily available.

Whether source is available or not is mostly irrelevant when you're potentially dealing with malicious code, you need to review artifacts that are being fetched from NPM since those can differ from source code on Github.

Attackers aren't going to announce their malicious code through meaningful git commit messages in a prominently displayed GitHub repository. They will make innocent-looking commits on Github, then publish a new version containing a single additional line of malicious code on NPM.

Re: NPM won't publish packages containing the word keygen

#198

Post by efdee »

zo1 wrote: post #182
joostdecock wrote: post #109

Earlier quoted context omitted.

Don't get me started

Shouldn't it be spelled "de Kok" if that's a surname?

De Kok, De Cock, De Kock, De Cok, ... All the same. Surname spelling was highly volatile before the French took over.

Re: NPM won't publish packages containing the word keygen

#199

Post by evv »

Oh. As the creator and reluctant maintainer of npm's "ssh-keygen", this is awkward!

First question: does this mean I won't be able to publish patches to the package?

Why do I not want this package under my control? The original package simply calls spawn for your real `ssh-keygen` with the appropriate arguments. No real problem, (although there is very little value here). But a contributor added support for Windows by uploading opaque binary builds for Windows. While I have no reason to distrust the contributor, it is scary to be "responsible" for opaque executables that I did not personally produce.

So, what should I do with this package? Assuming npm lets me do anything?

Fortunately this package is "only" downloaded ~1600 times/week, miniscule for npm. If you are tempted to use ssh-keygen, I recommend you learn how to use execFile/spawn, and use the native program directly.

For context, I published this 10 years ago, as one of my earliest contributions to open source. I probably wouldn't have gone near any security-essential contributions if I had more experience at the time.

Re: NPM won't publish packages containing the word keygen

#200

Post by EvanDotPro »

nomel wrote: post #189
franky47 wrote: post #20

Earlier quoted context omitted.

The Scunthorpe problem all over again. https://en.wikipedia.org/wiki/Scunthorpe_problem

Related, here's a pretty impressive attempt to detect bad words, to allow a talking banana on a Twitch live stream, without being banned: https://www.youtube.com/watch?v=bJ5ppf0po3k

I use the same method for a Twitch TTS system I built and it works very, very well.
Post reply on HN