Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

bleepingcomputer.com

Post reply on HN
Print view View original

431–440 of 1001 posts

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#431

Post by no_wizard »

spijdar wrote: post #394
no_wizard wrote: post #374

This isn’t a vulnerability nor is it corrupt, these are intentional actions on behalf of the project maintainer. Not that I agree per se, to be absolutely clear, however saying these are corrupt or somehow vulnerabilities isn’t the truth. This is the software working as intended

They are absolutely corrupt -- intentionally corrupt, but the intention was to break the software in retaliation. Drilling holes in your boat to sink it means yes, it is sinking "as intended", but it's still an act of sabotage. I suppose you can specifically argue against the word corrupt as implying a corruption of the author's intention, but I think it also applies to "does not behave as anticipated". (now, the int…

To me it is a smear to say it’s corrupt and/or malicious when a maintainer takes the project into a direction they want like this. It’s demonstrably true that this is now intended behavior of the code. Disagreeing with the changes, not liking the changes, if it causes problems for your projects etc does not automatically mean it’s malicious, a vulnerability, or corrupt.

I feel this language is used intentionally to smear the maintainer and paper over a real conversation over open source, responsibilities of maintainers and consumers, and the ecosystem as a whole. Instead it’s all about the “vulnerability” caused by the maintainers choices to commit “malicious” code.

Did the maintainer drastically change the software? You bet they did. Does that mean it’s malicious, a vulnerability, and/or corrupt? No. This isn’t an illicit cryptominer or process injection etc. the host machines are not being exploited in a malicious way.

You can disagree with the actions and what they are doing etc, but labels matter, and I think this is an intentional labeling of this to skirt around having real conversations around OSS, maintainability, the role of consumers etc

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#432

Post by gilmore606 »

commandlinefan wrote: post #93
ruuda wrote: post #47

This is why you pin all dependencies and upgrade (and test) when it's convenient for _you_, not when the author pushes a new version.

> pin all dependencies You do that. Your coworkers don't. And they'll complain to your boss if you try to make them.

> And they'll complain to your boss if you try to make them.

Really? Have I led a sheltered life? I cannot rightly apprehend the state of mind that would see pinning deps as bad. It only helps you!

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#433

Post by josephcsible »

throw_m239339 wrote: post #416
ghiculescu wrote: post #401

Earlier quoted context omitted.

... it’s not obvious to me?

> ... it’s not obvious to me? If the source was maintained on Bitbucket, why the hell would bitbucket nuke the developer's account access? That's not their problem what happens on NPM. Github and NPM are defacto the exact same company on the other hand. Github actions are in retaliation of NPM "mispublishing".

Marak didn't just mess with NPM. He also did a force push to his GitHub repo, replacing all the code there.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#434

Post by bfung »

* version lock your dependencies.

* make a fork of the ones that are really, really important.

Proper practices makes this a nothing burger, aside from the mental wellness of the author. I AM saying if you got hit and it mattered, you’re probably not doing things right.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#435

Post by not2b »

mrtksn wrote: post #135
hartator wrote: post #46

Anyone knows what the author meant by the "LIBERTY LIBERTY LIBERTY" message? It's unclear if it's referring to current authoritarian turns in our western world, big corps using his software for free, or something else.

The author apparently got political, had issues with the law enforcement: https://news.ycombinator.com/item?id=29839786

But isn't faker just a port of someone else's work (originally written in Ruby)?

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#436

Post by dns_snek »

dane-pgp wrote: post #313
toomanydoubts wrote: post #234

Earlier quoted context omitted.

Because you chose to download and execute it, without due diligence, while the license states that the code comes with no warranty whatsoever?

If you create a package which claims to do one thing, but actually deliberately does something else that you know users don't want, then surely there comes a point where the harm done counts as hacking?

Each version of the package comes with its own source code and license. It's your responsibility to audit new package versions before installing them.

And that's what the author did, he published a new version. You can blame your tools and package.json for automatically updating, but at that point it's a self-inflicted injury.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#437

Post by jamesfinlayson »

ruuda wrote: post #47

This is why you pin all dependencies and upgrade (and test) when it's convenient for _you_, not when the author pushes a new version.

Agreed - I've been bitten twice by unpinned dependencies so for a while now I've pinned everything to a specific version.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#438

Post by crawfordcomeaux »

If corporations don't want to be subjected to the whims of software developers operating freely, they know what they can do.

Anyone at any business trying to shame this dev for making an artistic statement through code is telling on themselves in terms of how much they value (or don't value) the freedom of such developers.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#439

Post by supperburg »

IceDane wrote: post #178
shaunpersad wrote: post #121

AITA for thinking that if you develop open-source software and your license permits anyone to use it for free, then complaining about no compensation is not a valid complaint? I totally understand that billionaire corporations use software like this for free. But the software maintainer has explicitly allowed _anyone_ to use it for free. If you don't want them to use it for free, license it as such. What am I not see…

Sure. But that works both ways. If you're not going to support the development in any way, then you don't get to have an opinion on what should be done or complain about bugs. Honestly, even then, I think we're stretching it. Maybe at the surface it seems like it should be that way, but this isn't just some tiny package that a few companies are using. We're talking about tens of millions of downloads every week. This…

So nobody should write OSS because you can’t complain about the fact that you chose to make it free. And nobody should use OSS because they can’t complain when the software is broken. I think this says a lot about open source software.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#440

Post by yashap »

donkarma wrote: post #378
yashap wrote: post #205

Earlier quoted context omitted.

He’s also going on about a wild conspiracy theory about Aaron Swartz getting assassinated because he was on to Ghislaine Maxwell, or something like that. And linking it to his open source comments in a way that doesn’t seem to make sense. He’s almost certainly going through major mental issues, along the lines of schizophrenia or something similar. He needs help.

How is that a wild conspiracy theory?

What’s the concrete evidence making this likely to be true? If there’s none, just wild speculation, then I’d consider it a wild conspiracy theory.

The link seems to be “Swartz downloaded millions of scholarly articles using an MIT network, and Epstein/Maxwell donated money to MIT.” That seems to be about it? Not exactly a logical reason to conclude that Swartz was assassinated as part of an Epstein/Maxwell coverup.

Post reply on HN