Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NPM package compromised by author: erases files on RU / BY computers on install

snyk.io

Post reply on HN
Print view View original

121–130 of 188 posts

Re: NPM package compromised by author: erases files on RU / BY computers on install

#121

Post by naugtur »

kelnos wrote: post #108
neilv wrote: post #66

I think a helpful guide is to ask myself: what would admired US and RU astronauts/cosmonauts do? I imagine that they are scientists, engineers, and colleagues, and will treat each other with support, as people of goodwill. There are other people who are active combatants right now, whether or not they want to be, and it is tragic beyond words. I believe that one of the ways that we non-combatants can help is to set a…

This is the sad thing about all of this. Many people are demonizing average Russian citizens for the actions of their government. When the US invaded Iraq in 2003, I was very much against it, but felt powerless to change the course of my government. (And the US government kept on doing what it felt like, no matter how unjust its actions.) While I was ashamed of my country's actions, I didn't think it would be fair fo…

I agree with the sentiment here.

Theoretically though in representative democracy you choose the government to represent you and be an agent for making your decisions. You are responsible for what your government does in part that equals 1/Population

Re: NPM package compromised by author: erases files on RU / BY computers on install

#122

Post by quinnjh »

paxys wrote: post #13
chizhik-pyzhik wrote: post #6

Regardless of your political position, this falls well within the definition of malware. It's irresponsible for the maintainer to allow this: https://github.com/RIAEvangelist/node-ipc/issues/233

Yup. Although if you do want to get political, I'd say this falls under the definition of cyber warfare. Also the maintainer didn't only "allow" it, it seems he is the author of the malicious module as well.

Whats painful is that in terms of cyberwarfare, allied systems maintain dominance of global grid with innovation and open source. If we had allies in russia, im sure we have fewer now. This sort of DOS attack is effective in first order effects but the second order effects could be increased resentment and new systems developed in isolation.

Re: NPM package compromised by author: erases files on RU / BY computers on install

#123

Post by quinnjh »

vimax wrote: post #32
btreecat wrote: post #5

I don't know how I feel about this. One hand, this is a seemingly non-violent and subtle way to protest. On the other, the potential collateral damage is huge and just burns all trust with this developer, and is a net harm to the ecosystem as a whole. FOSS is great, because we were actually able to track the changes here. But it also points out how many packages go un-checked and just installed into a container runni…

Its childish. Striking out maliciously at random web developers surrounded by state propaganda is counter-productive. This just annoys them and feeds the narrative that they're under attack by the West who hates them. I would imagine web developers over there, being more educated, technical, and exposed to the West, would be the ones less likely to support the war. There's nothing subtle about wiping files, why not p…

100%

> why not provide news and information that's being blocked?

Radio free europe style. I like it

Re: NPM package compromised by author: erases files on RU / BY computers on install

#124

Post by slim »

naugtur wrote: post #121
kelnos wrote: post #108

Earlier quoted context omitted.

This is the sad thing about all of this. Many people are demonizing average Russian citizens for the actions of their government. When the US invaded Iraq in 2003, I was very much against it, but felt powerless to change the course of my government. (And the US government kept on doing what it felt like, no matter how unjust its actions.) While I was ashamed of my country's actions, I didn't think it would be fair fo…

I agree with the sentiment here. Theoretically though in representative democracy you choose the government to represent you and be an agent for making your decisions. You are responsible for what your government does in part that equals 1/Population

everybody knows that representative democracy is not representative. so, no, even theoretically you're not responsible for that reason. although you may be responsible for not doing anything to put in place a more representative democracy in your country (ie. be more involved in politics)

Re: NPM package compromised by author: erases files on RU / BY computers on install

#125

Post by bobobob420 »

encryptluks2 wrote: post #95
ctvo wrote: post #84

Earlier quoted context omitted.

Quoted post unavailable.

Little text to say that you support the malicious actions and hope that nothing is done.

That is not the position ctvo is making at all. He never said he was in support of malware. He is stating that there should be no legal ramifications. The person who added the malware is definitely a piece of shit but i also agree he should not face legal ramifications. This is his code and he is allowed to do with it whatever he wants. It is the consumer to safe guard against external code. Legal ramifications would cause a legal precedent to be set for open source code and ownership that is a very dangerous path. I understand the anger and frustration, i feel it too. However it is still his code

Re: NPM package compromised by author: erases files on RU / BY computers on install

#126

Post by MikusR »

kelnos wrote: post #108
neilv wrote: post #66

I think a helpful guide is to ask myself: what would admired US and RU astronauts/cosmonauts do? I imagine that they are scientists, engineers, and colleagues, and will treat each other with support, as people of goodwill. There are other people who are active combatants right now, whether or not they want to be, and it is tragic beyond words. I believe that one of the ways that we non-combatants can help is to set a…

This is the sad thing about all of this. Many people are demonizing average Russian citizens for the actions of their government. When the US invaded Iraq in 2003, I was very much against it, but felt powerless to change the course of my government. (And the US government kept on doing what it felt like, no matter how unjust its actions.) While I was ashamed of my country's actions, I didn't think it would be fair fo…

The average russian citizen supports the war

Re: NPM package compromised by author: erases files on RU / BY computers on install

#127

Post by lobocinza »

Our phones have all kinds of spyware on it from the vendor, from Google and from 3rd party apps. They probably also have, as well as routers, tons of vulnerabilities know but not fixed due to the lack of interest from the vendors. Sometimes Google cancel accounts blocking access to all of it's data without giving reason or recourse.

It's 'funny' and hypocritical (as many folks here work for Google and other companies related to aforementioned issues) that we're condemning a dude for getting emotional and causing limited damage on cyberspace while a crazy dude is wrecking destruction on meatspace, killing thousands and threatening the World with nuclear war.

I understand the fears that this can undermine this nice thing we have that is opensource. Though the nice thing is that individuals voluntarily share code for whatever intrinsic reasons they have. MIT provides no warranty of any kind and there's no moral obligation to serve and make it corp-friendly. As developers our code is generally the only 'real' power we have and we can't deny that guy his agency.

RIAEvangelist was sloppy and probably will suffer consequences for his activism. Being banned from Github and NPM registry are expected and fair due to probable ToS violations and the interest of the organizations in preserving trust. But I fail to see how what he did is more or less ethical than financial sanctions like those recent applied to Russia. If he were to make it look like a mistake it would save him the trouble because ignorance/incompetence are socially accepted.

Re: NPM package compromised by author: erases files on RU / BY computers on install

#128

Post by iudqnolq »

MikusR wrote: post #126
kelnos wrote: post #108

Earlier quoted context omitted.

This is the sad thing about all of this. Many people are demonizing average Russian citizens for the actions of their government. When the US invaded Iraq in 2003, I was very much against it, but felt powerless to change the course of my government. (And the US government kept on doing what it felt like, no matter how unjust its actions.) While I was ashamed of my country's actions, I didn't think it would be fair fo…

The average russian citizen supports the war

Maybe, but you can't prove that with polls. It's illegal to oppose the war in Russia. The polls everyone is citing were conducted by state TV.

Presuming they didn't just make up their data, imagine you got a call from state TV asking "if you support the special military operation to denazify Ukraine". Your friend just told you they know someone who knows someone who was arrested and charged with oppositing the war for holding up a blank piece of paper in public. Do you tell them the truth?

Edit: Here's an anecdote from Russian social media. A person asks why prices are so unstable. The entire shop looks at the ground, mumbles, and ignores them. Does that sound like enthusiastic support or terror to you? https://therussianreader.com/2022/03/16/dixie/

Re: NPM package compromised by author: erases files on RU / BY computers on install

#129

Post by kbart »

kelnos wrote: post #108
neilv wrote: post #66

I think a helpful guide is to ask myself: what would admired US and RU astronauts/cosmonauts do? I imagine that they are scientists, engineers, and colleagues, and will treat each other with support, as people of goodwill. There are other people who are active combatants right now, whether or not they want to be, and it is tragic beyond words. I believe that one of the ways that we non-combatants can help is to set a…

This is the sad thing about all of this. Many people are demonizing average Russian citizens for the actions of their government. When the US invaded Iraq in 2003, I was very much against it, but felt powerless to change the course of my government. (And the US government kept on doing what it felt like, no matter how unjust its actions.) While I was ashamed of my country's actions, I didn't think it would be fair fo…

Majority of average Russian citizens support their goverment actions against Ukraine. So in my book, they are also responsible.

Re: NPM package compromised by author: erases files on RU / BY computers on install

#130

Post by sva_ »

labster wrote: post #98
sva_ wrote: post #42

Earlier quoted context omitted.

But that shouldn't be an excuse to sink to their level.

They haven’t really sunk to their level unless there’s an npm module to bomb hospitals I don’t know about. Still bad to target civilians, though.

Well I meant the level of ransomware authors and the like.
Post reply on HN