Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Major bank accidentally published a private package to the public NPM Registry

twitter.com

Post reply on HN
Print view View original

201–210 of 236 posts

Re: Major bank accidentally published a private package to the public NPM Registry

#201

Post by sascha_sl »

madeofpalk wrote: post #126
lugg wrote: post #104

Earlier quoted context omitted.

Please don't think this way. This is such a solvable problem. Doesn't package.json have an is private repo flag? Why not just respect that? Why does everyone everyone in this thread think a pop up is the solution? Pop ups are a code smell. They mean your application does not correctly match user intent with the action so badly you had to specifically get your user to tell you what they meant to do. Did you mean to do…

> Doesn't package.json have an is private repo flag? Why not just respect that? npm does reflect that flag. If you set private in package.json, npm won't publish it publicly. From docs: > private > If you set "private": true in your package.json, then npm will refuse to publish it. > This is a way to prevent accidental publication of private repositories. If you would like to ensure that a given package is only ever…

>publishConfig

https://github.com/yarnpkg/yarn/issues/5310

oops

Re: Major bank accidentally published a private package to the public NPM Registry

#202

Post by Ndymium »

nukeop wrote: post #200
Ndymium wrote: post #188

A recent experience tells me this is a very easy mistake to do, though. I was using Yarn to publish a package to an internal package repository (so setting `private: true` was not an option). I did not know at the time that Yarn would not honor `publishConfig` in the `package.json` file, and it would also ignore the package's organisation set in `.yarnrc` (which is used to direct read operations to the internal repos…

Wouldn't `npm unpublish --force` revert this? If you provided an email you'd get a notification about a published package so you'd notice immediately even if you didn't at first.

It's not relevant to my post if it can be reverted. Once it's out there, it's out there. There are bots scouring all new GitHub commits for API tokens, I would not be surprised to see bots auto-downloading all new NPM packages.

For the original tweet's company, there was probably some kind of incompetency involved in not noticing that the code was public for years. But I can't comment on that further as I don't know the circumstances. I only wrote my anecdote about the accidental publishing side.

Re: Major bank accidentally published a private package to the public NPM Registry

#203

Post by oblio »

jeswin wrote: post #194
ljm wrote: post #103

Earlier quoted context omitted.

This is going to be cynical, but as far as I understand it people are looking for usability through vanity. Why not install `com.facebook.react’? Reverse domain notation is remarkably elegant given our internet. You are not typing ‘npm i com.facebook.react’ so often that it’s a pain. You probably use ‘create-react-app’ which is even worse. Instead, every language creates a new cash grab for common names. And made it…

> Why not install `com.facebook.react’? That would be a bad idea, and it's not just brevity. - If com.facebook.hr has previously been published, would it mean that facebook can never have a division named HR? - Once a company goes belly up, the domain often ends up with squatters/spammers. Domains with published packages will sell for a lot more in the underground market - for pure exploitation of rights to publish a…

Regarding your concerns, some friction is necessary. Without friction I can skate, but I can't drive.

Re: Major bank accidentally published a private package to the public NPM Registry

#204

Post by oblio »

thinkharder wrote: post #133
arkades wrote: post #112

Earlier quoted context omitted.

Property rights don’t go away because someone made it easy for you to violate them. Mints are put out explicitly for you to take. Property right intentionally transferred.

Actually, in the US "Abandoned Vehicle" is a legal thing and depending on local laws you might very well be able to claim, and get title to a vehicle that has been abandoned on your property. And the abandonment period can be really short, 48 hrs in some states. It depends on your state's definition of "abandoned vehicle", and local laws, and it will probably require a few trips to the DMV and might require filing in…

It's older than that, it's a Roman legal principle, usucapio: https://en.wikipedia.org/wiki/Usucapio

Re: Major bank accidentally published a private package to the public NPM Registry

#205

Post by alkonaut »

What is the risk/problem with this, assuming the bank didn't have anything sensitive or security critical? (If they had Keys, personal info etc in their source then that's the problem isn't it?)

If someone finds a module of BankX's boring backend code, what is the risk/problem for the bank?

Re: Major bank accidentally published a private package to the public NPM Registry

#206

Post by icebraining »

benj111 wrote: post #181
icebraining wrote: post #142

Earlier quoted context omitted.

Public domain: any software made to run on current machines is too new to have expired copyright; the author(s) may have dedicated it to the PD, but you have to find that dedication, which is equivalent to a license. Good faith: that may affect the amount of damages the copyright holder can extract, but it's still illegal to use the software. Copyright notices: haven't been required for 30 years.

Copyright older than 30 years still requires the notice (and this is banking software). My underlying point though was that it was an unreasonable answer, to just copy paste the previous answer. No one here that I've seen has claimed to be a lawyer, and no one I've seen has defined what nations laws we are talking about. At that level of discourse, the question posed, deserved a reasonable answer.

> Copyright older than 30 years still requires the notice

Nope, only on works published over 30 years ago. This package was published only three years ago, regardless of when it was created.

There really isn't much nuance under the copyright rules almost universally agreed under treaties like Berne, UCC and TRIPS. This kind of what-ifing a clear statement just sounds like a bad movie trope.

Re: Major bank accidentally published a private package to the public NPM Registry

#207

Post by uberswe »

alkonaut wrote: post #205

What is the risk/problem with this, assuming the bank didn't have anything sensitive or security critical? (If they had Keys, personal info etc in their source then that's the problem isn't it?) If someone finds a module of BankX's boring backend code, what is the risk/problem for the bank?

Some companies like to practice security through obscurity. So you might be worried that someone trying to exploit the system would have an easier time testing effective exploits.

Another thing is the code itself, you don't want competitors seeing your implementation if you feel that it gives your company an advantage over others. There may be data structures or algorithms that are internal company knowledge only and defined in the code.

Re: Major bank accidentally published a private package to the public NPM Registry

#208

Post by [deleted] »

Ndymium wrote: post #195
rounce wrote: post #193

Earlier quoted context omitted.

> What saved me was that the package was inside an organisation ("@foo/bar") and those are not free on NPM... (Public) Orgs _are_ free on NPM (at least nowdays) so maybe even that wouldn't have saved you.

Then I am not sure what did prevent publishing, but it was not published.

[deleted]

Re: Major bank accidentally published a private package to the public NPM Registry

#210

Post by jhare »

uberswe wrote: post #207
alkonaut wrote: post #205

What is the risk/problem with this, assuming the bank didn't have anything sensitive or security critical? (If they had Keys, personal info etc in their source then that's the problem isn't it?) If someone finds a module of BankX's boring backend code, what is the risk/problem for the bank?

Some companies like to practice security through obscurity. So you might be worried that someone trying to exploit the system would have an easier time testing effective exploits. Another thing is the code itself, you don't want competitors seeing your implementation if you feel that it gives your company an advantage over others. There may be data structures or algorithms that are internal company knowledge only and…

Hide the embarrassingly ugly, also.
Post reply on HN