Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

bleepingcomputer.com

Post reply on HN
Print view View original

911–920 of 1001 posts

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#911

Post by gnubison »

dcow wrote: post #887
sam_goody wrote: post #844

While I disagree with his move. 1.It is totally in his prerogative to mess up the package he manages, but not to install into it malware. I am on the fence if this would count as malware. (Because of the open loop, but my leaning is that this is not malware.) 2. Github is, IMO, breaking any trust that I might have had by assuming control of the package, removing the last commit and keeping it online. If they feel the…

I pretty much agree with you especially on the point that there are far more effective and nuanced ways to for the maintainer to have made their point, like relicensing (imagine what would happen if the license suddenly became AGPL and everyone at big corps automatically updated without checking the new license—it would be a raucous for both legal and engineering, author could offer a non-gpl version for money and pr…

> Our society very much puts a premium on protecting victims.

… is this a bad thing?

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#912

Post by saltminer »

tjpnz wrote: post #549
bogwog wrote: post #277

Earlier quoted context omitted.

Why is that scary? If you do bad things, you're going to get banned. This guy abused Github to distribute malicious code to thousands of projects. If losing your Github means losing your projects, that's on you for being lazy/irresponsible with them. Git is already decentralized, and anything important should be cloned on something you own.

Where do you draw the line? I've learned the hard way that SemVer isn't universally respected in the Node ecosystem. What happens if the maintainer of a sufficiently popular package decides to push out a patch release overhauling the public facing API? Does Github ban them too?

I'm reminded of Mongoid, which was at one point using SemVer, but stopped, and at least one company was caught off guard by breaking changes in (seemingly) minor releases (https://news.ycombinator.com/item?id=29845724).

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#913

Post by ThrashBeard »

0x0nyandesu wrote: post #772
mid-kid wrote: post #749

Earlier quoted context omitted.

Not really, individual package developers don't have as much inmediate control over the repository's state as they do with NPM. Packages go through a review by one of the trusted developers and sometimes automated QA and testing (including as of late reproducibility testing, i.e. does the source match the binary?), before being uploaded to the repository. If you can't trust the team behind the distro, then sure, your…

I use Gentoo which uses portage the package manager and the way portage works is it pulls source then compiles. Source is rarely checked by everyone. Small packages exist as well. Many Linux distro simply barrow binaries from "trusted" sources. The entire eco system is really a deck of cards.

> Many Linux distro simply barrow binaries from "trusted" sources.

The crappy ones maybe. Proper distros build everything from source.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#915

Post by esarbe »

pritambaral wrote: post #881
esarbe wrote: post #865

Earlier quoted context omitted.

> vandals on their platform. Since it is his code; can you vandalize your own property? > go back to the last good change and lock the developer out. That's one reason for not using GitLab as source management tool. It gives them way too much power.

> GitLab Surely, you mean GitHub.

Absolutely! Thanks for pointing that out.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#916

Post by notwedtm »

asddubs wrote: post #745
hn_throwaway_99 wrote: post #392

Earlier quoted context omitted.

> It's a bad look, why would anyone want to deal with him after this stunt is beyond me. The maintainer appears to be unwell: https://abc7ny.com/suspicious-package-queens-astoria-fire/64...

is this actually the same guy or some other person named marak who happens to be a software dev? The article appears to be from september 2020

The article names Marak Squires, and the colors.js repo has 'Marak Squires' as the author.

The author's twitter also commented about loosing their possessions in a house fire in October 2020.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#917

Post by cmckn »

sibit wrote: post #816
oneoff786 wrote: post #240

Earlier quoted context omitted.

I’m a self taught Python programmer. I haven’t don’t much front end. Why do some JS devs import tiny packages to do simple things? I don’t feel like I’ve seen this behavior in Python. Is it because browsers are an awful environment?

As someone who does front-end JS stuff and uses a bunch of packages here is why I do it: I got tired of copying and pasting the same classes between projects. The worse part was I'd add new features to the newer projects and when I would have to go back to work on something from a year or two ago I'd have to spend time backporting all the new code. I also don't like how bloated a bunch of the "popular" packages are.…

> I got tired of copying and pasting the same classes between projects. The worse part was I'd add new features to the newer projects and when I would have to go back to work on something from a year or two ago I'd have to spend time backporting all the new code.

Why not create your own common library and publish it to a private repo? There's a lot of options between using a stranger's package and what you're describing.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#918

Post by amyjess »

kodemager wrote: post #775
amyjess wrote: post #713

Earlier quoted context omitted.

GitHub is private property, and they have the right to eject anyone from their property for any reason or even no reason at all. And the code is open-source under the MIT license, so GitHub can do with it as they see fit.

The MIT license doesn’t give you the right to claim ownership over someone else’s code. You can copy it and claim ownership over that, but it doesn’t allow you to remove the author from their work and then keep the work as your own. The author has a right to delete it if they want to.

Are you saying that it's a violation of the MIT license to distribute MIT-licensed code if the author asks that you take it down? Because I can assure you, that's not how the MIT license works.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#920

Post by notatoad »

gitgrump wrote: post #905
notatoad wrote: post #98

Earlier quoted context omitted.

only helps if people developing the functionality that is difficult to develop in-house do the same. i'm not going to build my own AWS cdk.

This wasn't AWS CDK, it was a package to fake data and a package with some ANSI escape sequence constants. The comparison doesn't make sense. The problem is that developers apparently can't even differentiate between when you should use a library and when you shouldn't; they just pull in the first result from an NPM search. You can probably trust AWS, which is good because CDK is complicated. You can't necessarily tr…

It wasn't a comparison.

As the article states, AWS CDK depends on colors, if I want to use AWS CDK, I have to use colors too. I don't get the choice to re-implement that myself unless I want to stop using the official CDK library

Post reply on HN