What exactly happened here?
Many packages suddenly disappeared
341–350 of 520 posts
Re: Many packages suddenly disappeared
#342Earlier quoted context omitted.
And all this is happening just as after the public release of a serious exploit which allows malicious code to do all sorts of nefarious things when it is somehow installed on the target machine . Hmm. Given that there's hints, at least, that the problems were caused by some particular developer's actions, I wonder about the security model for package-managed platforms altogether now. If I were a big cybercrime ring,…
With cases like the current one, or the leftpad incident in 2016, I'm surprised package registries still allow recycling old package names after a package was deleted. Really seems like deleted packages should be frozen forever - if the original author never recreates it or transfers ownership, then people would have to explicitly choose to move to some new fork with a new id. But your point about pressuring or bribi…
Packages / projects being frozen. AFAIR that's how SourceForge works/worked. I remember a few years back being baffled that I couldn't delete my own project.
But it makes sense, other projects might depend on it, so it's archived.
Re: Many packages suddenly disappeared
#343Earlier quoted context omitted.
I am very surprised that a package manager of this calibre and impact abstains from best practices when it comes to authentication through code-signing. Other package managers are miles ahead of NPM. For example, Nix, which uses immutability and hashing to always produce the same artifact, regardless of changes of the sources.
So I know rpms and debs are signed, as I've setup repos for both. Docker repositories require a valid SSL key (or you have to manually allow untrusted repos). But do Python packages and Ruby gems have signature verification? How does pypy/pip and gem deal with validating a package is what it claims to be?
Ruby gems can be signed but the percentage of gems authors taking advantage of that is low.
At least we’ve got most people using https to transfer gems now!
Re: Many packages suddenly disappeared
#344Earlier quoted context omitted.
Left-bad, I mean, the left-pad fiasco should have been the wake up call.
How do you not feel embarrassed using such low quality insults..?
It was just a bad joke, but in all seriousness, that was a big wake up call for a lot of people about the tangled web of npm dependencies.
Re: Many packages suddenly disappeared
#345Earlier quoted context omitted.
And all this is happening just as after the public release of a serious exploit which allows malicious code to do all sorts of nefarious things when it is somehow installed on the target machine . Hmm. Given that there's hints, at least, that the problems were caused by some particular developer's actions, I wonder about the security model for package-managed platforms altogether now. If I were a big cybercrime ring,…
Wouldn't you need to install those packages as root for the code to have privileges to take advantage of that exploit?
No. Packages would not need to be installed as root. Additionally, many possible ways to use the exploit in GP could run as unprivileged users.
Re: Many packages suddenly disappeared
#346PSA: Please be cautious because this is an excellent opportunity for taking over packages and injecting malware by malicious people. Example: https://www.npmjs.com/package/duplexer3 which has 4M monthly downloads just reappeared, published by a fresh npm user. They published another two versions since then, so it's possible they've initially republished unchanged package, but now are messing with the code. Previously…
Shit. That's a good point, I downloaded the Heroku CALI during the attack and it uses duplexer3. I got a weird message that seemed "off" during postinstall.
Re: Many packages suddenly disappeared
#347Earlier quoted context omitted.
I take it that you've never had to work at a big organization? When you have multiple teams in different offices, it's incredibly difficult to constantly "herd cats" and point everyone to $latest_fad. And when you DO by some miracle get everyone (devs and management) to switch to $latest_fad, it's a huge pain to go back through and bug test/change every process to accommodate the new software. I don't think "people s…
Isn't this a case for a microservices, etc.? Independent teams providing business capabilities through APIs would mostly eliminate the need to keep consistent technologies as long as the interface design follows shared guidelines.
Most companies of any size are allergic to "pick your own toolchain" development strategies. The infrastructure team has to support them. Someone has to be responsible for hiring. Security needs to be able to review the environment. Employees should be able to be moved between teams. And so forth.
Sure, I suppose devops can mitigate the infrastructure support problem, but overall most companies strongly prefer standardization.
Re: Many packages suddenly disappeared
#348Earlier quoted context omitted.
And all this is happening just as after the public release of a serious exploit which allows malicious code to do all sorts of nefarious things when it is somehow installed on the target machine . Hmm. Given that there's hints, at least, that the problems were caused by some particular developer's actions, I wonder about the security model for package-managed platforms altogether now. If I were a big cybercrime ring,…
An ipfs model would help. People would use a strong hash if the package or something.
I'm not sure if it would help much. That means you either have to have users be able to recognize and eyeball-validate hashes ("sure, this is left-pad-5ffc991e; that's what I want! Wait, shit, it's actually left-pad-5ffd991e, never mind; wrong package), or you need pre-existing databases of trusted hashes (which either puts you right back at a registry a la NPM, or leaves you reliant on a package.lock file or similar, which doesn't cover many common use cases for secure package signing).
Re: Many packages suddenly disappeared
#349Earlier quoted context omitted.
The term "nazi" is not simply mildly offensive, there are likely legal implications if you want to serve users in Germany.
Even if (which it doesn't, the term is not forbidden), why should npm care?
>why should npm care
Name aside, the package as described is useless and serves no legitimate function.
If they're going to curate, they should do some quality control.
Re: Many packages suddenly disappeared
#350Earlier quoted context omitted.
Three developers on my team spent the last 4 years pushing for angular. Four years ago, I was 50/50 on it vs react, so whatever, but if my team's really for it, let's do it. Fast forward to angular 2, and we're down to two developers who are still for it. Fast forward to today, I'm down to one angular dev who's still for it, and two of the original three have left for react jobs. Meanwhile, I'm left with a bunch of a…
Curious, what would you rather do instead? Is there an opinionated React framework you could use?
>Curious, what would you rather do instead?
Moving away from SPAs seems like a dream at this point.