3 ms·
Author of the post here. According to a tweet [1], the user @nj48 seems to be non-malicious. I updated the blog post. Nevertheless I find his actions dangerou
by drinchev 11y ago
Author of the post here. According to a tweet [1], the user @nj48 seems to be non-malicious.
I updated the blog post.
Nevertheless I find his actions dangerous and irresponsible.
[1] https://twitter.com/seldo/status/712673227630313472 https://twitter.com/seldo/status/712673227630313472
- callmevlad 11y agoGiven the conversation in yesterday's thread [1], I think a known (and personally identified) non-malicious person defensively reserving these packages is less dangerous than some unknown entity taking over these packages later. I personally think the best course of action would have been for the NPM team to immediately blacklist these names (aside from left-pad, that's a separate conversation) after the entire list of unpublished packages was shared, and then make them available on a case-by-case basis. https://news.ycombinator.com/item?id=11340510 https://news.ycombinator.com/item?id=11340510
- tombrossman 11y agoCurious, should those of us using their Linux PPAs disable them until this is sorted? The idea of re-using disabled package names is out there now and I wonder how long it is before someone malicious tries this. Is this an unreasonable concern?
- drinchev 11y agoNot sure about that. I'm away of the PPA's + NodeJS's NPM packaging model.