231–240 of 1001 posts
Earlier quoted context omitted.
Bad faith?
"this software comes with no warranties" ?
If you perform action in obviously bad faith, your account will be suspended – it's very simple.
Github's terms of service must have somewhere detailed description about it.
Working on Open Source a lot myself, I have absolutely no sympathy for the developer. If you do not like others to use your work, then don't do it. Whether the "other" is a large corporation or not is immaterial.
Now, this does point a problem which has bothered me before: The commoditization of every little aspect of functionality. That leads to 1000's or 10000's of dependencies that are impossible to track.
Earlier quoted context omitted.
I couldn't help but think the same thing. Seems like an incredibly immature way to handle it. He could have easily set an end date and state nothing will be maintained beyond that date. It's not a good look.
I don't think he cares at this point. I think this is a person that has been driven to the absolute end of their patience. If he's really barely been getting by, then I can only imagine the sheer frustration he must be feeling. Not only are there swathes of fortune 500 companies which depend on his package but don't contribute a dime, but he also had a company with millions of dollars in funding look at his idea and…
How is it not a legal issue to intentionally DOS customers servers? I would send a complaint to the California DA’s office for hacking; the laws against which in CA are very liberal.
Here's my $.02: Packages are literally remote code exec vulns in the hands of package authors. At the very least, it takes them under a minute to break your app, simply by deleting their package. Read the article. This is not the first time it's happened, and it's not going to be the last. [0] I write backends (mostly in PHP, although not exclusively), and I release a lot of my code under libre licenses. But I don't…
Are these really RCE vulnerabilities? Looking at it systematically I only see this as an RCE vector if you're doing one or more things very wrong. This assumes that packages are immutable and an author can't update a version that's already there. This is how NuGet works, and IMO is how any remotely sane package manager will work. There's no reason for a version to be mutable in this context. Pegging to a specific ver…
Personally I think we should be auditing our packages' dependency chains to ensure they're not reliant upon this developer.
[0]: https://web.archive.org/web/20220109232136/https://github.co...
Earlier quoted context omitted.
How about using dependencies but pinning the version and only updating if you know what the update contains? I'm still continually baffled that we ended up in a world where automatically accepting updates from every dev and their dog is not just the norm but recommended practice.
You also have to rely on all of your dependencies doing that for their dependencies and so on. It’s really a mindset/vigilance you need for the whole ecosystem.
Whether or not this would be compatible with the way dependencies are used today is another question.
Earlier quoted context omitted.
Are these really RCE vulnerabilities? Looking at it systematically I only see this as an RCE vector if you're doing one or more things very wrong. This assumes that packages are immutable and an author can't update a version that's already there. This is how NuGet works, and IMO is how any remotely sane package manager will work. There's no reason for a version to be mutable in this context. Pegging to a specific ver…
The tool should take some blame here. I agree that it’s ultimately the developers fault for allowing code to be automatically injected from not fully trusted sources on minor updates, but the package manager makes it way too easy to do. For example, when I npm install a package, it defaults to specifying a semver compatible version in package.json, rather than doing the secure thing and pinning a version. But whether…
This is why you pin all dependencies and upgrade (and test) when it's convenient for _you_, not when the author pushes a new version.
Here's my $.02: Packages are literally remote code exec vulns in the hands of package authors. At the very least, it takes them under a minute to break your app, simply by deleting their package. Read the article. This is not the first time it's happened, and it's not going to be the last. [0] I write backends (mostly in PHP, although not exclusively), and I release a lot of my code under libre licenses. But I don't…
Why do some JS devs import tiny packages to do simple things? I don’t feel like I’ve seen this behavior in Python. Is it because browsers are an awful environment?