Oh no, not again a meditation on NPM supply chain attacks • Hacker News Board

Re: Oh no, not again a meditation on NPM supply chain attacks

#231

Post by sarchertech » Sat, Sep 20, 2025, 5:10 PM UTC

watwut wrote: post #191

sarchertech wrote: post #28

Earlier quoted context omitted.

Just because you can do something doesn’t mean you should. There’s also lot of pressure for devs not to use licenses that restrict use by large companies. Try adding something to your license that says companies making over $10 million per year in revenue have to pay, and half of the comments on show HN will be open source warriors either asking why you didn’t use a standard license or telling you that this isn’t ope…

The most likely and common result of releasing an open source project is that everyone ignores you. If they notice, you may get a question about license once in a while which you can ignore.

Take a look at any show HN where someone releases something with a mildly unique license that includes something that prevents big companies from charging for the software, the open source warriors come out of the woodwork. Every single time the discussion gets completely hijacked and moves away from what the software does to "why don't you stick to the ideologically approved pure licenses?" (btw approved by OSI who are funded by Google and MS).

Re: Oh no, not again a meditation on NPM supply chain attacks

#232

Post by Chris2048 » Wed, Sep 24, 2025, 1:48 PM UTC

sarchertech wrote: post #175

Chris2048 wrote: post #149

Earlier quoted context omitted.

> I can help someone out expecting nothing in return. Then if my situation changes It sounds like you did expect something in return, conditional on your circumstances. Maybe it's good-will or something, but some kind of social insurance in any case.

This is partly getting into questions about whether “pure” altruism is even possible, e.g., is an anonymous donation truly selfless if you do it because it makes you feel good. But in the example above it’s entirely possible that you helped someone out with no expectation of being paid back. Let’s say you’re rich and the person you helped is a chronic drug addict. You have no expectation of every needing help and no…

I don't think any of that relates to the topic and hand.

Are you saying you are entitled to the winning because you gave him the dollar Or because you gave him anything at all? Would you be happy to get $2 back?

If they spent the money on crack and overdose, are you to blame?

Re: Oh no, not again a meditation on NPM supply chain attacks

#233

Post by clbrmbr » Tue, Sep 30, 2025, 10:54 AM UTC

xrisk wrote: post #44

izacus wrote: post #39

Earlier quoted context omitted.

Yes, but even in those domains those projects are minorities and in many examples they make it effectively impossible to legally fund or contribute to them from the side of corporations.

Yeah I’m not buying it. If the corporations wanted to, they would.

As soon as you have more than one shareholder, unless it’s in your charter to support OSS, you need some justification. Corporations only “want” to make a profit unless they have another explicit mission at the highest level of governance.

Re: Oh no, not again a meditation on NPM supply chain attacks

#234

Post by clbrmbr » Tue, Sep 30, 2025, 10:54 AM UTC

Arch-TK wrote: post #64

clbrmbr wrote: post #30

Earlier quoted context omitted.

It depends on the domain. There are a lot of critical utilities in the systems space maintained by volunteers. The “xz” compression library was one recent infamous example where an exhausted volunteer maintainer was social engineered into a supply chain attack that briefly compromised OpenSSH. Not a lot of applications being maintained by altruists, but look under the hood in Linux/GNU/BSD and you fill find a lot of…

It briefly compromised the custom patched Debian version of OpenSSH. The issue had nothing to do with OpenSSH itself.

Thanks for the correction.

Re: Oh no, not again a meditation on NPM supply chain attacks

#235

Post by jamietanna » Tue, Sep 30, 2025, 4:14 PM UTC

deevus wrote: post #14

jamesnorden wrote: post #9

I think the cooldown approach would make this type of attack have practically no impact anymore, if nobody ever updates to a newly published package version until, say, 2-3 days have gone by, surely there will be enough time for owner of the package to notice he got pwnd.

I've never heard of this. It sounds like a solid default to me. If you _really_ need an update you can override it, but it should remain the default and not allow opting out.

We (Renovate maintainers) are also making this an inbuilt "best practice" that users who already opt into using the `config:best-practices` preset will start getting for free!

https://github.com/renovatebot/renovate/pull/37967