Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

bleepingcomputer.com

Post reply on HN
Print view View original

561–570 of 1001 posts

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#561

Post by viro »

godDLL wrote: post #510
bogwog wrote: post #277

Earlier quoted context omitted.

Why is that scary? If you do bad things, you're going to get banned. This guy abused Github to distribute malicious code to thousands of projects. If losing your Github means losing your projects, that's on you for being lazy/irresponsible with them. Git is already decentralized, and anything important should be cloned on something you own.

"Abused Github to distribute malicious code" is a legal wording, not a EULA violation. A lawsuit, not an account ban. Let's decide how serious this is. Exactly. I am, for one, of the opinion that it is not at all serious. Not deserving of a lawsuit or an account ban. Not even newsworthy. I mean, this could easily become the new normal for OSS. You use it – you're not insured against anything, for there is no formal c…

no its a criminal act. crashing RANDOM servers that you DONT know what they do is not a protest.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#562

Post by foxhop »

mastazi wrote: post #430

My takeaway from this story is that I never really gave a thought about the fact that Github can close your account... And since on Github you are not allowed to have multiple accounts (e.g. personal vs work account), when that happens they are taking away your ability to work. I am going to set up a self hosted git server for my personal projects straight away. I am thinking about Gitea, any one can share their expe…

I AM self hosting gitlab, I'm working on a blog post next week to show how to stand one up and keep it up, including backups & restores.

Check it out here: https://git.unturf.com/engineering

Related: https://russell.ballestrini.net/russell-open-sources-remarkb...

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#563

Post by etchalon »

lolinder wrote: post #487
etchalon wrote: post #454

Earlier quoted context omitted.

There are people who think its reasonable to take all the pennies from the "take a penny leave a penny" plate because "that's what it's there for."

The difference is that there aren't a finite number of pennies on this plate. Software can, by definition, be copied an infinite number of times.

I think you've missed the point.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#564

Post by mastazi »

junon wrote: post #550
mastazi wrote: post #544

Earlier quoted context omitted.

> GitHub rarely takes action against accounts well, this just made the Hacker News front page a few minutes ago :-D https://news.ycombinator.com/item?id=29870151

DMCA notices have to be complied with else Github can get heavily penalized. This isn't Github's choice. DMCA is an entirely different beast, and it's not Github's fault that whole system is broken.

I'm not trying to assess whose fault it is for something.

I'm reasoning about where my personal repos should be, and the answer is "not on Github", for the same reason that my email is not on Gmail: it's on someone else's server, they can close my account if they want, it happened before, might happen again.

Just because some things happen rarely, that doesn't mean you should not be prepared, as an example we know that airliners very rarely suffer from fatal accidents but that's not a good reason for you not to fasten the seat belt during certain phases of flight.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#565

Post by mastazi »

foxhop wrote: post #562
mastazi wrote: post #430

My takeaway from this story is that I never really gave a thought about the fact that Github can close your account... And since on Github you are not allowed to have multiple accounts (e.g. personal vs work account), when that happens they are taking away your ability to work. I am going to set up a self hosted git server for my personal projects straight away. I am thinking about Gitea, any one can share their expe…

I AM self hosting gitlab, I'm working on a blog post next week to show how to stand one up and keep it up, including backups & restores. Check it out here: https://git.unturf.com/engineering Related: https://russell.ballestrini.net/russell-open-sources-remarkb...

Thank you! Looking forward to your blog post! I want to learn more about advantages and disadvantages of GitLab

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#566

Post by kristjansson »

umvi wrote: post #194
cerved wrote: post #145

Earlier quoted context omitted.

You're using a VCS I presume? Why not just rollback?

Rollback what? You can't rollback someone else's dependencies.

But you can roll back your dependencies until your entire dependency graph avoids a bad version.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#567

Post by viro »

pmlnr wrote: post #248
mirekrusin wrote: post #231

Earlier quoted context omitted.

Adding this kind of disclaimer notice doesn't mean you can do whatever you want. If you perform action in obviously bad faith, your account will be suspended – it's very simple. Github's terms of service must have somewhere detailed description about it.

> Github's terms of service must have somewhere detailed description about it. Please, point me to the part where bugs, intentional or not, are disallowed. Taking over someone's account is not justified; for this, definitely, but I'd say it's never is. Block the account yes; take over, no.

the fact that this is literally a criminal act. he pushed code KNOWING it would crash every server that pulled it. Its NOT a bug, its malware.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#568

Post by foxhop »

StopHammoTime wrote: post #488

This raises some excellent points about code-ownership. Because I believe they should have at least forked rather than just restore his repo. On the other hand if brother wants to get paid and stop people exploiting his work, maybe don't use the MIT license? There's always AGPL. Of course, as with Elastic, these projects would never get off the ground (in terms of support) without actually using a commercial-complian…

This is called activism, get used to it, he is not spoiling open source, he is fighting for our freedoms. I applaud him.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#569

Post by umvi »

kristjansson wrote: post #566
umvi wrote: post #194

Earlier quoted context omitted.

Rollback what? You can't rollback someone else's dependencies.

But you can roll back your dependencies until your entire dependency graph avoids a bad version.

Yeah but in this case you might not be directly dependent on colors. You might be dependent on http-server, which is in turn dependent on colors. You can only roll back http-server, and unless http-server rolls back colors, you are stuck.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#570

Post by viro »

betwixthewires wrote: post #501
not2b wrote: post #424

Earlier quoted context omitted.

That doesn't give him the right to commit sabotage. If as the developer of a FOSS program I deliberately introduce something that will harm users, a "no warranty" clause won't protect me from the consequences. The guy knew full well how npm worked, and new full well that he was deliberately breaking lots of sites. "No warranty" just means he isn't liable for accidents.

No warranty means he isn't liable for any behavior of the software at all. You don't have to like it but it is true.

no it does not mean you can legally change your software to malware.
Post reply on HN