Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Many packages suddenly disappeared

github.com

Post reply on HN
Print view View original

471–480 of 520 posts

Re: Many packages suddenly disappeared

#471

Post by naasking »

0x0 wrote: post #309
naasking wrote: post #298

Earlier quoted context omitted.

Signing won't help unless the end user specifies the signature or certificate that they expect (signing would only help ensure package upgrades are from the same author). If you're going to have clients specify a signature anyway, then you don't need to sign packages, you just need strong one way hash function, like SHA-1024 or something. User executes "pkg-mgr install [package name] ae36f862..." Either way, every tu…

"npm install packagename" could record the public key in package.json (or package-lock.json) on first save, and only accept installs (or upgrades) matching the same public key. Just like how android app code signing works, or similar to ssh known_hosts trust-on-first-use. Granted it wouldn't save those adding a new package to a project the first time, but it would save the bacon of anyone re-running "npm install" in…

> Granted it wouldn't save those adding a new package to a project the first time

Right, that's the real problem.

Re: Many packages suddenly disappeared

#472

Post by jasonkester »

antonkm wrote: post #276
jasonkester wrote: post #76

Earlier quoted context omitted.

Why would you allow that to happen? I don't think there is any part of my little software empire that is dependant on code for which I don't have the source or underlying .dll checked into source control. It's part of your project. You absolutely need a copy of it.

I take it you're replying to me? My little software empire also keep local copies, that kind of defeats the purpose of using git for teamwork or package management to keep dependencies in check. These are building blocks in a normal dev environment, and it would take me massive amounts of time to manage everything on my own. The local copies are fragile and not as easily shared.

You've lost me. Why would it take more time to check in your dependencies and have the rest of your team get them out of source control? All the package manager would do would be to download them off the internet to the same location. Might as well only have one guy do that once and be done with it.

You need to archive them somewhere anyway (to mitigate the issue we're discussing here), so why not keep them in the obvious place?

Re: Many packages suddenly disappeared

#473

Post by allover »

taurath wrote: post #123
sergiotapia wrote: post #9

Yikes, what is it about node/npm/javascript that makes it feel like a house of cards?

This in particular is a huge trust failure - working with mutable/replaceable libraries is like working with mutable/replaceable APIs.

Well they aren't mutable/replaceable, at least not since after the left-pad incident where npm announced new rules to prevent package unpublishing. It seems this was a operational bug at npm inc.

Re: Many packages suddenly disappeared

#474

Post by allover »

nanodano wrote: post #344
setr wrote: post #272

Earlier quoted context omitted.

How do you not feel embarrassed using such low quality insults..?

It was just a bad joke, but in all seriousness, that was a big wake up call for a lot of people about the tangled web of npm dependencies.

Disagree, it was mainly a wake up call that npm shouldn't allow package deletion, a policy they changed as a result.

Every other 'these kids and their dependencies' opinion over the left-pad incident was highly subjective.

Re: Many packages suddenly disappeared

#475

Post by allover »

prh8 wrote: post #333

As someone unfamiliar with NPM, why does it not lock package names for a certain period of time? Rubygems has a 90 day period, so if a package is completely removed, the name can't be used for that long. That seems like it would help with the security side of these problems.

> As someone unfamiliar with NPM, why does it not lock package names for a certain period of time?

From [1]:

> With the default registry (registry.npmjs.org), unpublish is only allowed with versions published in the last 24 hours. If you are trying to unpublish a version published longer ago than that, contact support@npmjs.com.

I am kinda assuming that if npm support were to help you unpublish a package that is depended upon (they might refuse), they would prevent someone else from re-publishing to that name (they might put up their own placeholder package, like they did during the left-pad incident), but granted I can't find this stated anywhere.

I think the reason re-publishing seemed to happen in this case was they weren't prepared for whatever vector allowed for the deletion of these packages.

[1] https://docs.npmjs.com/cli/unpublish

Re: Many packages suddenly disappeared

#476

Post by zbentley »

CaptSpify wrote: post #449
zbentley wrote: post #365

Earlier quoted context omitted.

"Wait, you're telling me these people rely on their ISP and the telco infrastructure being operational to deploy? Seriously?" "Wait, you're telling me these people need an internet-available Ubuntu mirror to install their development environments?" "Wait, you're telling me these people need their users to have specific, updated browsers in order to run the deployed software?" "Wait, you're telling me these people nee…

And? Most of these are things you absolutely should be thinking about

"You should be thinking about" and "You need this? Seriously?" are very different statements. Of course you should be aware of dependencies.

Re: Many packages suddenly disappeared

#477

Post by darkerside »

sillysaurus3 wrote: post #383
mrlatinos wrote: post #379

Earlier quoted context omitted.

It's unprofessional in circumstances such as this imo, but to each their own.

"The less confident you are, the more serious you have to act."

Seems to make the opposite case here. Why the need to swear? Seems not to indicate anything but disingenuous tribal signaling of outrage. At whom?

Re: Many packages suddenly disappeared

#478

Post by tbrock »

krzyk wrote: post #26

So they didn't learn anything from left-pad situation from 1.5 year ago? Packages that are published should be immutable, just like in maven repo case.

That’s fine but it doesn’t prevent newer packages from being published by new owners as is happening here.

Re: Many packages suddenly disappeared

#479

Post by jpalomaki »

didibus wrote: post #395
razorunreal wrote: post #366

Earlier quoted context omitted.

In case anyone was considering sending him $10, no, his hypothetical code would not be running on the Google login page. Google does not pull in external dependencies willy nilly like that.

I'd be surprised if they ran a thorough security audit on all code they import, but I'd rather believe they do.

On Google scale you quite certainly want to do that. Not just for security, but for legal reasons. You really don't want to end up using for example AGPL licensed stuff in wrong places and if you just blindly pull stuff with dependencies from package manager, this could easily happen.

Re: Many packages suddenly disappeared

#480

Post by edem »

zbentley wrote: post #382
edem wrote: post #323

I just don't understand how this can happen. In Maven Central for example (Java) if you publish a package it is immutable and stays there until nuclear fire immolates the Earth.

Unless I'm misunderstanding something about Central's architecture, it's not fundamentally different from NPM in this regard, though signing appears a bit more feasible. Which means that it's not a technical difference. Maybe Central has been compromised/had issues before, just long ago (it's certainly much older). Maybe there are things wrong with NPM-as-a-company even if NPM-as-a-technology is fine. Maybe it's just…

Maybe I'm a bit biased but I never heard of something like this in Javaland. So packages are supposed to be immutable on npm as well?
Post reply on HN