Oh no, not again a meditation on NPM supply chain attacks • Hacker News Board

Re: Oh no, not again a meditation on NPM supply chain attacks

#41

Post by rkagerer » Wed, Sep 17, 2025, 11:34 AM UTC

giantg2 wrote: post #19

cube00 wrote: post #2

> The tools we use to build software are not secure by default, and almost all of the time, the companies that provide them are not held to account for the security of their products. The companies? More like the unpaid open source community volunteers who the Fortune 500 leech off contributing nothing in return except demands for free support, fixes and more features.

I remember joining my company right out of college. In the interview we started talking about open source since I had some open source Android apps. I asked if the company contributed back to the projects it used. The answer was no, but that they were planning to. Over a decade later... they finally created a policy to allow commits to open source projects. It's been used maybe 3 times in it's first year or so. Nobod…

That's such a self-harmful policy. I have a small business and I've been really supportive to both open source and small, paid-for commercial libraries and building blocks that I rely on. Also advocated this successfully at clients I've consulted with. We do a lot of technical vetting before adopting any particular dependency (vs. building out our own) and it just makes sense that we strive to foster the continued existence and excellence of our tools. Considering the incredible value companies get from open source, I have trouble understanding why they wouldn't throw some cash or idle cycles their way. Seemed to work out for the likes of Google while they were undergoing rapid growth.

Re: Oh no, not again a meditation on NPM supply chain attacks

#42

Post by [deleted] » Wed, Sep 17, 2025, 11:34 AM UTC

austin-cheney wrote: post #38

watwut wrote: post #22

Earlier quoted context omitted.

Per survey I read, majority of open source is created by people who are paid for it. The unpaid volunteer working full time on something is effectively a myth.

I don’t think that is correct. VS Code developers and the TypeScript team is paid by MS. Core of React is paid by Meta, or was. Java language is paid by Oracle as is the LiberaSuite and MySQL. Most of the Linux foundation projects, which includes Node are volunteers. Most of the Apache foundation software is from volunteers. Most NPM packages are from volunteers. OpenSSL is volunteers. There is also a big difference…

[deleted]

Re: Oh no, not again a meditation on NPM supply chain attacks

#43

Post by watwut » Wed, Sep 17, 2025, 11:34 AM UTC

austin-cheney wrote: post #38

watwut wrote: post #22

Earlier quoted context omitted.

Per survey I read, majority of open source is created by people who are paid for it. The unpaid volunteer working full time on something is effectively a myth.

I don’t think that is correct. VS Code developers and the TypeScript team is paid by MS. Core of React is paid by Meta, or was. Java language is paid by Oracle as is the LiberaSuite and MySQL. Most of the Linux foundation projects, which includes Node are volunteers. Most of the Apache foundation software is from volunteers. Most NPM packages are from volunteers. OpenSSL is volunteers. There is also a big difference…

> Linux foundation projects, which includes Node are volunteers.

The survey found that specifically linux code is dominated by people who are paid for it.

> Most of the Apache foundation software is from volunteers.

Large Apache project specifically are backed by companies per Apache rules. Each project must have at least three active backing companies. They contribute the most of the code.

Re: Oh no, not again a meditation on NPM supply chain attacks

#44

Post by xrisk » Wed, Sep 17, 2025, 11:35 AM UTC

izacus wrote: post #39

clbrmbr wrote: post #30

Earlier quoted context omitted.

It depends on the domain. There are a lot of critical utilities in the systems space maintained by volunteers. The “xz” compression library was one recent infamous example where an exhausted volunteer maintainer was social engineered into a supply chain attack that briefly compromised OpenSSH. Not a lot of applications being maintained by altruists, but look under the hood in Linux/GNU/BSD and you fill find a lot of…

Yes, but even in those domains those projects are minorities and in many examples they make it effectively impossible to legally fund or contribute to them from the side of corporations.

Yeah I’m not buying it. If the corporations wanted to, they would.

Re: Oh no, not again a meditation on NPM supply chain attacks

#45

Post by graemep » Wed, Sep 17, 2025, 11:35 AM UTC

izacus wrote: post #39

clbrmbr wrote: post #30

Earlier quoted context omitted.

It depends on the domain. There are a lot of critical utilities in the systems space maintained by volunteers. The “xz” compression library was one recent infamous example where an exhausted volunteer maintainer was social engineered into a supply chain attack that briefly compromised OpenSSH. Not a lot of applications being maintained by altruists, but look under the hood in Linux/GNU/BSD and you fill find a lot of…

Yes, but even in those domains those projects are minorities and in many examples they make it effectively impossible to legally fund or contribute to them from the side of corporations.

Why is it legally impossible to fund or contribute? Do they turn down contributions from paid developers? Do they refuse donations or just have no no mechanism for accepting them? Do they not have any form of commercial services or licence?

I think there are very few projects that do not accept support in any form.

Re: Oh no, not again a meditation on NPM supply chain attacks

#46

Post by davedx » Wed, Sep 17, 2025, 11:35 AM UTC

watwut wrote: post #22

cube00 wrote: post #2

> The tools we use to build software are not secure by default, and almost all of the time, the companies that provide them are not held to account for the security of their products. The companies? More like the unpaid open source community volunteers who the Fortune 500 leech off contributing nothing in return except demands for free support, fixes and more features.

Per survey I read, majority of open source is created by people who are paid for it. The unpaid volunteer working full time on something is effectively a myth.

Post the survey please, that's an extraordinary claim

Re: Oh no, not again a meditation on NPM supply chain attacks

#47

Post by sarchertech » Wed, Sep 17, 2025, 11:35 AM UTC

ricardobeat wrote: post #35

sarchertech wrote: post #28

Earlier quoted context omitted.

Just because you can do something doesn’t mean you should. There’s also lot of pressure for devs not to use licenses that restrict use by large companies. Try adding something to your license that says companies making over $10 million per year in revenue have to pay, and half of the comments on show HN will be open source warriors either asking why you didn’t use a standard license or telling you that this isn’t ope…

> Just because you can do something doesn’t mean you should. This implies some kind of fairness/moral contract in a license like MIT. There is none. It’s the closest thing to donating code to the public domain, and entirely voluntary. There are plenty of standard licenses with similar clauses restricting commercial use, no need to create a custom one. But indeed, the truth is that a restrictive license will massively…

> This implies some kind of fairness/moral contract in a license like MIT.

The license tells you what you are legally allowed to do. It doesn’t supersede basic concepts of fairness.

The average person would say that if you directly make millions of someone else’s work, the fair thing to do is to pay that person back in some way.

Calling someone a leech is just saying that they aren’t following the the accusers model of fairness. That’s all. There’s no legal definition.

We say things like “my company screwed me over when they fired me right before my RSUs vested” despite that being perfectly legal.

Re: Oh no, not again a meditation on NPM supply chain attacks

#48

Post by MrGilbert » Wed, Sep 17, 2025, 11:36 AM UTC

giantg2 wrote: post #19

cube00 wrote: post #2

> The tools we use to build software are not secure by default, and almost all of the time, the companies that provide them are not held to account for the security of their products. The companies? More like the unpaid open source community volunteers who the Fortune 500 leech off contributing nothing in return except demands for free support, fixes and more features.

I remember joining my company right out of college. In the interview we started talking about open source since I had some open source Android apps. I asked if the company contributed back to the projects it used. The answer was no, but that they were planning to. Over a decade later... they finally created a policy to allow commits to open source projects. It's been used maybe 3 times in it's first year or so. Nobod…

> Nobody has the time

I'd erase that part entirely, as it is not true, from my point of view. My day, as has every other person's day, has exactly 24 hours. As an employee, part of that time is dedicated to my employer. In return, I receive financial compensation. It's up to them to decide how they want to spend the resources they acquired. So yes, each and every company could, in theory, contribute back to Open Source.

But as there is no price tag attached to Open Source, there is also no incentive. In a highly capitalized world, where share holder value is more worth than anything else, there are only a few companies that do the right call and act responsible.

Re: Oh no, not again a meditation on NPM supply chain attacks

#49

Post by tcoff91 » Wed, Sep 17, 2025, 11:37 AM UTC

cube00 wrote: post #2

> The tools we use to build software are not secure by default, and almost all of the time, the companies that provide them are not held to account for the security of their products. The companies? More like the unpaid open source community volunteers who the Fortune 500 leech off contributing nothing in return except demands for free support, fixes and more features.

20 of the packages were from Crowdstrike

Re: Oh no, not again a meditation on NPM supply chain attacks

#50

Post by graemep » Wed, Sep 17, 2025, 11:38 AM UTC

cube00 wrote: post #32

watwut wrote: post #22

Earlier quoted context omitted.

Per survey I read, majority of open source is created by people who are paid for it. The unpaid volunteer working full time on something is effectively a myth.

I'd be keen to see that survey given how many projects I see with so few GitHub sponsors that I can't see how you'd derive a full time wage.

A lot of FOSS is developed by people who do it as part of their paid employment, that is what the GP is referring to, not Github sponsorship (which is tiny by comparison).