Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

bleepingcomputer.com

Post reply on HN
Print view View original

501–510 of 1001 posts

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#501

Post by betwixthewires »

not2b wrote: post #424
nomdep wrote: post #335

Earlier quoted context omitted.

And per the MIT license, he offers it “WITHOUT WARRANTY OF ANY KIND (…) INCLUDING BUT NOT LIMITED TO (…) FITNESS FOR A PARTICULAR PURPOSE”

That doesn't give him the right to commit sabotage. If as the developer of a FOSS program I deliberately introduce something that will harm users, a "no warranty" clause won't protect me from the consequences. The guy knew full well how npm worked, and new full well that he was deliberately breaking lots of sites. "No warranty" just means he isn't liable for accidents.

No warranty means he isn't liable for any behavior of the software at all. You don't have to like it but it is true.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#502

Post by iandanforth »

dariusj18 wrote: post #450
Miner49er wrote: post #412

Earlier quoted context omitted.

This goes both ways. Don't blindly use MIT licensed code if you aren't okay with the risk of something breaking or something malicious being inserted.

malicious is it's own beast that should always be guarded against, but being MIT doesn't give someone the right to be malicious.

"THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE."

Unfit software that causes damage is covered, intent or no.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#503

Post by mizzao »

hn_throwaway_99 wrote: post #392
bastardoperator wrote: post #108

Should I get paid for my multiple contributions to faker (I don't think I should)? I've submitted several PR's for generating data all of which were accepted. Even back then the maintainer was barking about money... Honestly the project would be better off forked. He did not write this library entirely by himself, at this point I just see him as holding other committers contributions as hostage. It's a bad look, why…

> It's a bad look, why would anyone want to deal with him after this stunt is beyond me. The maintainer appears to be unwell: https://abc7ny.com/suspicious-package-queens-astoria-fire/64...

> Squires is a software developer and early Bitcoin investor

Or maybe his crypto bet went in a poor direction...?

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#504

Post by arvinsim »

boxed wrote: post #6
gfykvfyxgc wrote: post #3

I don’t understand the mindset of open source developers who dedicate significant time energy and life to free software, unless there’s a tangible, quantifiable advantage to doing so. That advantage may well be indirect such as reputational or learning. I just don’t grasp why people do it for nothing, to the advantage of large companies.

It's quite simple: there IS a "tangible, quantifiable advantage to doing so". The problem is that you imply "...to the person writing the code". That's where your confusion lies. I am getting huge value from the people who built stuff before me. When I build stuff I can (hopefully) make the world better in the future. That's a "tangible, quantifiable advantage" to doing open source. It's just not an advantage to me p…

> But lift your gaze an inch off the ground and you'll see we don't need to be ego centric sociopaths. We can build together. For the species. Everyone wins.

I don't know in what fairy tale you live in but the ego-centric billionaire sociopaths that exploit this system wins.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#505

Post by ThunderSizzle »

rlyshw wrote: post #228
tailspin2019 wrote: post #95

Earlier quoted context omitted.

> If npm had paid plans that would essentially mop up larger corporations they could then auto-distribute funds Spotify style based on “number of listens”. This seems like a pretty decent idea…

Except the Spotify model is also rife with issues. Artists generally hate Spotify and hardly make a living off of “pay per stream”. Most of them still very much depend on tours, merch, and, at the higher level, brand deals to make any money off of their craft.

Spotify isn't a replacement for tours. It's a replacement for cds and/or radio, both of which make artists similar amounts of miniscule amounts of money.

For programmers, you'd be correct. That only really be a replacement for patreons, tips, and donations, which would typically be a miniscule amount. It just redistribute it instead. (Your $x subscription just automatically gets allotted instead of manually allotted).

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#506

Post by josephcsible »

betwixthewires wrote: post #495
not2b wrote: post #419

Earlier quoted context omitted.

It isn't your own if you host it with them, and they aren't obliged to help you commit sabotage.

It's not yours? Really. They own it now because they host it for you? So some ToS could override the software license for your project? In that case I don't see why anyone would use github, ever.

Be specific about what you mean by "it". The code you wrote is yours, but their copy of the repository is not yours. And GitHub's TOS does require that you give them certain rights to use the code you put in their repositories, regardless of whether your chosen license would have given them those rights anyway.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#507

Post by arvinsim »

linuxhansl wrote: post #232

Either you work on Open Source - which allows everyone to use it within the scope of the respective license; or you do not. Working on Open Source a lot myself, I have absolutely no sympathy for the developer. If you do not like others to use your work, then don't do it. Whether the "other" is a large corporation or not is immaterial. Now, this does point a problem which has bothered me before: The commoditization of…

> Now, this does point a problem which has bothered me before: The commoditization of every little aspect of functionality. That leads to 1000's or 10000's of dependencies that are impossible to track.

It just points out to the glaring need for the JS/Web STL library to grow.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#508

Post by zamadatix »

thr0wawayf00 wrote: post #445
not2b wrote: post #418

Earlier quoted context omitted.

This wasn't a "protester". It was deliberate sabotage, done with full knowledge that it would cause major damage. GitHub is with its rights to kick this guy off. It would even be within its rights to take over that account and fix the introduced bug (by reverting the change or otherwise). That wouldn't prevent the original developer from maintaining their own broken version, but npm and GitHub could eliminate it if t…

> It was deliberate sabotage, done with full knowledge that it would cause major damage. That's how protesting often works. Deliberately interfering in normal affairs is a very common protest tactic. Just look at the interstate shutdowns after the George Floyd killing, or going back to Rosa Parks and the Montgomery bus boycott, worker strikes, etc. etc. That's exactly how protest works. Forcing application code to pr…

Protesting in that manner isn't without consequence even if the thing being protested for is right or something else is worse to do. "It was in protest" is a reasoning not an absolution.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#509

Post by Dylan16807 »

dariusj18 wrote: post #447
Dylan16807 wrote: post #375

Earlier quoted context omitted.

That's the point. If the dev complaints are invalid because the contract doesn't say so, then the downstream complaints should also be invalid.

Except the license does say so

The license does say what?

The license doesn't say any payment is necessary.

The license doesn't say new versions will still work.

The license doesn't say anything about complaints.

If it's valid to complain about code breaking, it should also be valid to complain about lack of payment. These complaints are outside of the legal mandates of the license.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#510

Post by godDLL »

bogwog wrote: post #277
sillysaurusx wrote: post #195

Earlier quoted context omitted.

This is scary, and I don’t know why people here aren’t losing their minds. I think someone should make a big deal about this. What would be the first step? On the other hand, my GitHub was once suspended (and all repos shuttered) for posting gists that looked like spam to some algorithm. It was extremely unsettling, and they need to do a better job communicating. But they may have suspended the account because they t…

Why is that scary? If you do bad things, you're going to get banned. This guy abused Github to distribute malicious code to thousands of projects. If losing your Github means losing your projects, that's on you for being lazy/irresponsible with them. Git is already decentralized, and anything important should be cloned on something you own.

"Abused Github to distribute malicious code" is a legal wording, not a EULA violation. A lawsuit, not an account ban.

Let's decide how serious this is. Exactly.

I am, for one, of the opinion that it is not at all serious. Not deserving of a lawsuit or an account ban. Not even newsworthy.

I mean, this could easily become the new normal for OSS. You use it – you're not insured against anything, for there is no formal contract.

Post reply on HN