Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

Post by CRConrad » Tue, Jan 11, 2022, 11:53 PM UTC

slavik81 wrote: post #362

bluefox wrote: post #341

Earlier quoted context omitted.

You are saying "scary", but I think "alarming" is more appropriate. It's an alarm that should be buzzing through sleepy programmer skulls. It should alert them to the fact that it's no longer the small company that respected programmers, where you felt your account was yours, and your repositories were yours. The rules have changed with that acquisition, and Microsoft exploited the good reputation of that small compa…

GitHub has always been about "social coding". This is a quote on their homepage on May 2008 (three months after GitHub was founded): > What’s amazing about Github is how it really brings the social aspect into play. Chris and Tom are showing us all visually how git development is supposed to work. I know I personally had some bing moments once I started pulling in commits from external git repos. https://web.archive.…

Post by CRConrad » Wed, Jan 12, 2022, 12:00 AM UTC

chii wrote: post #489

throw_m239339 wrote: post #416

Earlier quoted context omitted.

> ... it’s not obvious to me? If the source was maintained on Bitbucket, why the hell would bitbucket nuke the developer's account access? That's not their problem what happens on NPM. Github and NPM are defacto the exact same company on the other hand. Github actions are in retaliation of NPM "mispublishing".

> why the hell would bitbucket nuke the developer's account access? a counter-factual that isn't known or proven. May be bitbucket would also nuke the repo, if NPM asked them and show proof that it contains malicious code. It would prevent spread, and would prevent damage.

Post by CRConrad » Wed, Jan 12, 2022, 12:18 AM UTC

dragonwriter wrote: post #523

iandanforth wrote: post #502

Earlier quoted context omitted.

"THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR T…

> Unfit software that causes damage is covered, intent or no. Well, no, an assertion of nonliability isn’t a magical incantation; local law in whatever jurisdiction is applicable may limit the effect of such an assertion; in places with meaningful consumer protection laws there are limits on the ability to disclaim warranties, and even without decent consume protection law it's often impossible to disclaim liability…

Post by CRConrad » Wed, Jan 12, 2022, 12:35 AM UTC

torstenvl wrote: post #31

esarbe wrote: post #10

Earlier quoted context omitted.

Why would the developer of any software that comes explicitly without warranty be hold responsible for downstream breakages? It's not as if one could force people to upgrade to newer versions and they can always keep depending on the old releases.

The warranty issue is a red herring. A warranty is an affirmative guarantee of quality: you are (in essential concept of not in precise detail) agreeing to be held to a "strict liability" standard. If I buy real estate and I am granted a warranty deed, and the title to the property comes into question, the seller can be brought to account to make me whole or indemnify me, regardless of who is at fault for the title d…

Post by CRConrad » Wed, Jan 12, 2022, 12:43 AM UTC

mastazi wrote: post #430

My takeaway from this story is that I never really gave a thought about the fact that Github can close your account... And since on Github you are not allowed to have multiple accounts (e.g. personal vs work account), when that happens they are taking away your ability to work. I am going to set up a self hosted git server for my personal projects straight away. I am thinking about Gitea, any one can share their expe…