5 ms·

Handing over a popular software project to a random stranger you've never spoken to who asks to take it over is just irresponsible. Nothing is preventing that s

Handing over a popular software project to a random stranger you've never spoken to who asks to take it over is just irresponsible. Nothing is preventing that stranger from adding malicious code and potentially compromising millions of devices, which is exactly what happened.

trickstra 8y ago
exactly, transferring a package to an unknown person is not only giving them access to the code but also to all the people who already trust that code
- AnaniasAnanas 8y ago
  To be honest that kind of your fault for trusting that code. Heck, the commits were not even signed as far as I know, had they been signed the change of "ownership" would have been clear.
  - meowface 8y ago
    Makes no difference if they were signed or not. He handed over the NPM package, not the GitHub repo. NPM doesn't show commit history or authors and has no connection to GitHub; you can easily have a GitHub repo for your NPM package with benign code in the GH repo and completely different, malicious code in the package.
    - AnaniasAnanas 8y ago
      > not the GitHub repo He did that too actually. > you can easily have a GitHub repo for your NPM package with benign code in the GH repo and completely different, malicious code in the package This is one of the biggest issues that NPM has, along with not enforcing packages to be signed. If the package was signed this would not be an issue as people would see that the signer changed.
kurtisc 8y ago
Dominic is the same kind of random stranger to most of the people whose codebases he's in.
- dwild 8y ago
  Sure but he earned the trust of the community by building everything he did. It took times and effort, unlike that other strangers, which does give more credence to what he does. Sadly he didn't deserved that trust.
jsd1982 8y ago
Explain how you would be able to evaluate the trustworthiness of a person asking to transfer ownership to.
- xvector 8y ago
  If you can't evaluate the trustworthiness who you're handing the package over to, just don't hand it over. Mark it as deprecated and call it a day. This is Open Source 101.
  - Ayesh 8y ago
    GitHub has a Read Only option, and package managers of most languages have a way to convey that the project is abandoned or provided security fixes only. You don't have to feel guilty to abandon the projects. Most us do it, every day.
- meowface 8y ago
  At the very least, a few years of regularly contributing to Node projects on GitHub. The account he handed it over to has essentially zero history: https://github.com/right9ctrl https://github.com/right9ctrl. The one repo they have is just a copy of https://github.com/barrysteyn/node-scrypt https://github.com/barrysteyn/node-scrypt. I'm not against handing over projects, but some vetting has to be done.
- trickstra 8y ago
  Actually, it's not as hard as you make it sound: 1. - don't transfer - mark your repo Abandoned, tell people to use that other person's fork if you have to 2. - does that person have any other online presence? Long running? 3. - does he also put his face in front of the crowd? Talk at conferences? This creates accountability - someone like that wouldn't pull out the same kind of injection, because he could be caught for that and his "brand" would be destroyed.
  - jsd1982 8y ago
    This is a reasonable response. I'm not sure why you're down voted but I gave you a up vote.
tclancy 8y ago
Have you ever created a package that people started to use, which you then had to maintain for purposes that didn't do anything for you and then no longer even need the package? Pretty much any rando offering to take over maintenance is going to be welcome to it compared to the dozens of requests and insults offered as bug reports.
- meowface 8y ago
  Yes, I am in this situation right now, actually. I have a project with around 700 stars on GitHub with over a million downloads per month (according to PyPI) which I no longer have the time, interest, or willpower to continue maintaining. I placed an open call to find a new maintainer months ago, and have received many requests. Every single request I've received has been roughly as shady as the request sent to event-stream. I've declined them all due to their shadiness. I know exactly what could happen (this situation right here) if I give it to the wrong person.
  - Ayesh 8y ago
    This is good maintainership right here! For outsiders, it looks like the maintainer is greedy to keep the project to themselves. The bug reports pile up, and dozens of people are offerring to maintain. And then insults start to come up, because it looks like you don't want to hand it over. If you want to take over a project, you just earn the trust if the current maintainer, be it patches for existing PRs, finding security vuons, etc over the time. Linux has gotten this right.
    - meowface 8y ago
      Thank you. Exactly.

trickstra 8y ago

exactly, transferring a package to an unknown person is not only giving them access to the code but also to all the people who already trust that code

AnaniasAnanas 8y ago
To be honest that kind of your fault for trusting that code. Heck, the commits were not even signed as far as I know, had they been signed the change of "ownership" would have been clear.
- meowface 8y ago
  Makes no difference if they were signed or not. He handed over the NPM package, not the GitHub repo. NPM doesn't show commit history or authors and has no connection to GitHub; you can easily have a GitHub repo for your NPM package with benign code in the GH repo and completely different, malicious code in the package.
  - AnaniasAnanas 8y ago
    > not the GitHub repo He did that too actually. > you can easily have a GitHub repo for your NPM package with benign code in the GH repo and completely different, malicious code in the package This is one of the biggest issues that NPM has, along with not enforcing packages to be signed. If the package was signed this would not be an issue as people would see that the signer changed.

kurtisc 8y ago

Dominic is the same kind of random stranger to most of the people whose codebases he's in.

dwild 8y ago
Sure but he earned the trust of the community by building everything he did. It took times and effort, unlike that other strangers, which does give more credence to what he does. Sadly he didn't deserved that trust.

jsd1982 8y ago

Explain how you would be able to evaluate the trustworthiness of a person asking to transfer ownership to.

xvector 8y ago
If you can't evaluate the trustworthiness who you're handing the package over to, just don't hand it over. Mark it as deprecated and call it a day. This is Open Source 101.
- Ayesh 8y ago
  GitHub has a Read Only option, and package managers of most languages have a way to convey that the project is abandoned or provided security fixes only. You don't have to feel guilty to abandon the projects. Most us do it, every day.
meowface 8y ago
At the very least, a few years of regularly contributing to Node projects on GitHub. The account he handed it over to has essentially zero history: https://github.com/right9ctrl https://github.com/right9ctrl. The one repo they have is just a copy of https://github.com/barrysteyn/node-scrypt https://github.com/barrysteyn/node-scrypt. I'm not against handing over projects, but some vetting has to be done.
trickstra 8y ago
Actually, it's not as hard as you make it sound: 1. - don't transfer - mark your repo Abandoned, tell people to use that other person's fork if you have to 2. - does that person have any other online presence? Long running? 3. - does he also put his face in front of the crowd? Talk at conferences? This creates accountability - someone like that wouldn't pull out the same kind of injection, because he could be caught for that and his "brand" would be destroyed.
- jsd1982 8y ago
  This is a reasonable response. I'm not sure why you're down voted but I gave you a up vote.

tclancy 8y ago

Have you ever created a package that people started to use, which you then had to maintain for purposes that didn't do anything for you and then no longer even need the package? Pretty much any rando offering to take over maintenance is going to be welcome to it compared to the dozens of requests and insults offered as bug reports.

meowface 8y ago
Yes, I am in this situation right now, actually. I have a project with around 700 stars on GitHub with over a million downloads per month (according to PyPI) which I no longer have the time, interest, or willpower to continue maintaining. I placed an open call to find a new maintainer months ago, and have received many requests. Every single request I've received has been roughly as shady as the request sent to event-stream. I've declined them all due to their shadiness. I know exactly what could happen (this situation right here) if I give it to the wrong person.
- Ayesh 8y ago
  This is good maintainership right here! For outsiders, it looks like the maintainer is greedy to keep the project to themselves. The bug reports pile up, and dozens of people are offerring to maintain. And then insults start to come up, because it looks like you don't want to hand it over. If you want to take over a project, you just earn the trust if the current maintainer, be it patches for existing PRs, finding security vuons, etc over the time. Linux has gotten this right.
  - meowface 8y ago
    Thank you. Exactly.