3 ms·

So, if you accidentally publish a repo with sensitive information, you shouldn't be allowed to correct the mistake by removing the version and uploading a fixed

by Osiris 11y ago

So, if you accidentally publish a repo with sensitive information, you shouldn't be allowed to correct the mistake by removing the version and uploading a fixed version? That seems like a completely legitimate and compelling reason to allow unpublishing.

chadly 11y ago
If you publish sensitive information (even if you immediately remove it), that sensitive info is compromised. All the "unpublish" feature does is lull users who don't know any better into a false sense of security (I don't need to reset any passwords, I unpublished it).
kibwen 11y ago
Services that don't offer an automatic "unpublish" action require you to contact the service in order to remove packages completely, which, moving forward, is exactly what npm will require one to do if you don't realize your mistake within 24 hours.
ufmace 11y ago
The linked post makes the point that if that repo was published for even a second, then the info may have, and probably has already been, copied by any number of people. Might as well leave it up as a reminder to change any of that info ASAP.
- laughinghan 11y ago
  Sensitive information is not in a binary state of "public" or "private". There are no meaningful degrees of difficulty of access to "public" information. Consider doxxing. Regardless of who you think is perpetrating it, we can all agree it's real and does real harm, right? Sometimes they're from hacking into people's accounts, but often they're from scouring the public Internet for information on a person and putting it together, making information that is technically "public" more accessible. Even if you change the password you accidentally published, knowing your expired password tells me about the kind of password you're likely to use next and for your other services. Having to find someone who was mirroring NPM's firehose of new packages at just the right time is one more barrier to that.

by Osiris 11y ago

chadly 11y ago

If you publish sensitive information (even if you immediately remove it), that sensitive info is compromised. All the "unpublish" feature does is lull users who don't know any better into a false sense of security (I don't need to reset any passwords, I unpublished it).

kibwen 11y ago

Services that don't offer an automatic "unpublish" action require you to contact the service in order to remove packages completely, which, moving forward, is exactly what npm will require one to do if you don't realize your mistake within 24 hours.

ufmace 11y ago

The linked post makes the point that if that repo was published for even a second, then the info may have, and probably has already been, copied by any number of people. Might as well leave it up as a reminder to change any of that info ASAP.

laughinghan 11y ago
Sensitive information is not in a binary state of "public" or "private". There are no meaningful degrees of difficulty of access to "public" information. Consider doxxing. Regardless of who you think is perpetrating it, we can all agree it's real and does real harm, right? Sometimes they're from hacking into people's accounts, but often they're from scouring the public Internet for information on a person and putting it together, making information that is technically "public" more accessible. Even if you change the password you accidentally published, knowing your expired password tells me about the kind of password you're likely to use next and for your other services. Having to find someone who was mirroring NPM's firehose of new packages at just the right time is one more barrier to that.