41 ms·
Major bank accidentally published a private package to the public NPM Registry
- symlinkk 8y agoI hate how there's no official way to run your own private NPM registry. So you have to either pay NPM or resort to third party solutions like verdaccio. It's such an obvious money grab by the NPM devs.
- zackbloom 8y agoThey're running a business. They offer an inordinate amount of service totally free to millions of developers, and they make their actual client open-source for your pleasure. Is your argument they also have to go to the trouble of making their infrastructure easily self-hosted? How would they make the money to pay the lawyers to respond to the very legal threat this tweet is about without revenue?
- iooi 8y agoPlease, it's arbitrary to run a private PyPi repository, all you need is a web server and a certain folder structure. If you want, you can even host everything on a private S3 and use a tiny Nginx configuration to authenticate the requests on behalf of pip [1]. Private npm repositories are an entirely different beast, and like GP mentions, there is no great option here. [1] https://www.guido.nyc/pypi-s3/ https://www.guido.nyc/pypi-s3/
- JdeBP 8y agoPotential users should be aware that the quoting in the shell commands on that page is faulty and requires attention.
- iooi 8y agoCan you give an example? Not sure what you're referring to.
- MaddAgent 8y agohttps://cloudsmith.io/l/npm-repository/ https://cloudsmith.io/l/npm-repository/ - no?
- tyrust 8y agoGotta pay the bills somehow. I think that providing enterprise support is a very good way to do so. There is nothing compelling them to develop an official solution and a third-party one already exists. It looks like this is a good example of open source WAI.
- winrid 8y agoJust put the package in a git repo like Github and point to it w/ package.json EDIT - I see what you are saying - your own registry with browser and all.
- hkchad 8y agoWhats wrong w/ nexus? https://blog.sonatype.com/using-nexus-3-as-your-repository-part-2-npm-packages https://blog.sonatype.com/using-nexus-3-as-your-repository-p... All our devs have our group repo configured as default. Any publishing is done to our private repo (via CI only) and any public package is pulled through the proxy repo, this way all packages are cached in our private repo so when npm registry goes down / someone unpublishes (which happens/ed?) our CI server doesn't die.
- sundvor 8y agoNexus is great, comes with an easy to use docker image - and also works as a Nuget repository and more.
- deleted 8y ago[deleted]
- unethical_ban 8y agoJFrog has an open-core/OSS repo for NPM, I believe.
- ungzd 8y agoThere are many ways to specify dependency except from central npm server: https://docs.npmjs.com/files/package.json#dependencies https://docs.npmjs.com/files/package.json#dependencies That includes tarballs on http, git repos and even freaking local directories. For companies where putting packages on smb mount is treated as non-enterprisey, npm have "npm enterprise" offering: https://www.npmjs.com/products/enterprise https://www.npmjs.com/products/enterprise
- barrystaes 8y agoIts not official, and not free, but GitLab can host NPM packages: https://about.gitlab.com/2019/01/22/gitlab-11-7-released/#npm-registry https://about.gitlab.com/2019/01/22/gitlab-11-7-released/#np...
- tracker1 8y agoThere's LOTS of solutions for your own NPM, not to mention you can use git over ssh or http(s)... there are proxies, self-publish software. Some of it open-source, other options not so much. IIRC, you can even run your own npm if you wanted to.
- draw_down 8y agoEvery legal/financial genius in the replies: "Just invoice them for your time and lawyer fees!" Yeah, it doesn't work that way.
- gauravphoenix 8y agoThis is more common than we think. At RedLock[1], we found several docker images which aren't supposed to be public. [1] https://redlock.io/blog/docker-repo-public-access https://redlock.io/blog/docker-repo-public-access
- aboutruby 8y agoAnd on a little website known as Github there is a lot more :) (and Google Search stays the #1 reliable source of private data followed by AWS S3).
- ronilan 8y agoNext tweet: “We sell a thing that prevents this kind of mistake ...” Just sayin.
- orblivion 8y agoHow would you prefer free software be funded? :-P
- pbarnes_1 8y agoOSS developers should just work for free, and live in destitution. Obviously. ;)
- downrightmike 8y agoEveryone should live in destitution. Then they'll be free, just like their OSS.
- ronilan 8y agoWe are a little tounge in cheek here, but I’ll take this question seriously. While it is great that NPM can develop new and more reliable products, is would also greatly benefit them and everyone else, if enerprises of certain size or stature would be required, legaly or regutoraly, to pay for software they already use. So say you are a bank, and there is a list of regulations that you have to comply with, so here is a new one. FTC (or California law makers) can figure out the mechanics and JP Morgan will write the check. Then NPM will already have a solid foundation to build on, some indie will have a windfall, and the big software guys might say hell yes, that’s a new business model. That’s what I’d prefer, but no one but you is asking me ;)
- seldo 8y agoThis really isn't news, folks. It happens every week. I was just grumpy this morning.
- tombert 8y agoHow much of them sending takedown notices was a desperate posturing of "omg please please please please don't use our code!!!" I can't possibly see how they would possibly have any case.
- Mikeb85 8y agoIf their code is proprietary, no one can use it. Even if they accidentally uploaded it to a public site.
- deleted 8y ago[deleted]
- kzrdude 8y agoHas it been tested in court? :)
- icebraining 8y agoYes, of course.
- Scoundreller 8y agoI’m not sure how universally true that is. When governments fail to redact documents, it’s on them. If you “accidentally” talk to a reporter about your solicitor-privileged comms, it’s not privileged anymore.
- JeremyBanks 8y agoThis isn't an open question. If you don't have a license from the copyright holder, you can't legally use it, except for fair use exemptions: perhaps you could write a blog post criticizing it.
- JustSomeNobody 8y agoAbused the DMCA also. SMH.
- syntheticcdo 8y agoHow is this DMCA abuse? A copyright owner is requesting that a site that has safe harbor protection remove an unauthorized copyrighted work. The employee that originally created the unauthorized package may no longer work for the bank, unable to be identified, or doesn't have the credentials anymore.
- cm2187 8y agoDoes the fact that the bank distributed the material in the first place change the situation?
- bdamm 8y agoNo. The Bank's intent is what matters, not the intent or actions of a single employee.
- RIMR 8y agoThat is absolutely not true, and it flies in the face of the notion of "due diligence". This bank uploaded their own code to the repo, and when they found it they didn't bother to do any investigating before they started sending legal demands. It was 100% their responsibility to ensure that they were not responsible for their own leak before they started making legal threats. They decided to skip due diligence, and they should pay the price for wasting others' time and energy, regardless of their "intentions".
- bdamm 8y agoThe upload itself does not constitute the Company's policy. It is not "The Bank's" action. There is a legal standard for a company's action, which is a signature by an executive or possibly a lower signing officer. The employee that uploaded this almost certainly is not an officer. Their failure to discover that the upload was their own error is their failure. Thus, a DMCA request is appropriate, as the GP points out, the original employee that did the action quite likely cannot undo that action.
- born2discover 8y agoIt took them no less than 3 years to actually notice... Holy moly! I wonder what package that is... Just out of curiosity...
- beager 8y agoYou'd think it's like, some proprietary trading algorithm, but in reality it's probably their own implementation of left-pad.
- taarushv 8y agoIt was a react package. Source: https://twitter.com/seldo/status/1105157348560007168?s=09 https://twitter.com/seldo/status/1105157348560007168?s=09
- skissane 8y agoJust guessing here, but probably something like some front-end UI components for their internet banking system. Which then probably got simplified to "someone has posted the source code to our internet banking system on the Internet"
- born2discover 8y agoMy bad, didn't see that one!
- deleted 8y ago[deleted]
- mstade 8y agoAnyone know what bank? Or what package?
- ionforce 8y agoIs there a thing that's like "by using this service you put your work in the public domain" kinda thing?
- icebraining 8y agoNo, npm only says you give them a license to allow them to serve the package to users; other than that, you're free to license it however you want.
- Wowfunhappy 8y agoSo the bank shouldn't be able to send DMCA takedown notices, right? Because they granted npm the license to redistribute the package.
- lgeorget 8y agoI think they can argue that the code is their property and that the employee that published it on NPM had no mandate from the company to do so. So it's effectively "stolen code" in a sense, just as if the employee had done it to harm the company on purpose.
- kccqzy 8y agoNo one would use such a thing. Very few open source code is in the public domain. The only one I can think of off the top of my head is SQLite.
- jessaustin 8y agoIn fairness, the bank in question might use such a thing, because they have difficulty making decisions that abide by their own policies.
- 0xfeba 8y agoThere is a `private` setting in the package.json to avoid this situation.
- deleted 8y ago[deleted]
- wolco 8y agoIs this client side code? Unless this is internal wouldn't it be available when visiting there website?
- cm2187 8y agoProbably an internal application. All internal systems are moving to the web.
- nwsm 8y agoProbably doesn't matter to their legal team. All code is company IP so they don't want it posted anywhere unnecessarily. Tweet thread says it's a react packaged which means it's probably usually transpiled and minified, so not technically available in its original form in its distributed application.
- schappim 8y agoWhich bank?
- z3t4 8y agoWhy not just take it down? What do you need a lawyer for ? Isnt there an option for deleting your own packages ?
- ahallock 8y agoYou would think so, but perhaps they didn't have the credentials.
- benatkin 8y agoThey never contacted a human at npm, they just went straight over their heads.
- kevin_thibedeau 8y agoNpm should have a forced arbitration clause for anyone posting code under US jurisdiction. Then they can pull a procedural power play.
- bachmeier 8y agoThat wouldn't help. The bank's accusing them of publishing stolen code.
- kevin_thibedeau 8y agoThe bank, as a corporate entity, posted the disputed code. It doesn't matter that the right hand doesn't know what the left hand did.
- Klathmon 8y agonpm doesn't allow you to delete a package once it has some downloads to prevent another left pad incident. I'm sure they can make exceptions, but it's not as simple as a quick CLI command.
- ahallock 8y agoSlightly off topic, but my experience with lawyers and technology has been mostly discouraging. For example, one lawyer wanted to sue a client of ours for using an open-source JS dropdown menu that we were also using--he said they stole our code. He was also concerned that we were letting people 'View Source' our web pages and stealing our IP.
- skissane 8y agoMaybe that's the difference between a specialist and a generalist. A lawyer who has experience and expertise working with the software industry is unlikely to make those kinds of silly mistakes. A lawyer who has no software industry experience, who just does general business law, contracts, real estate, wills, etc, who maybe even has some industry-specific experience in other industries like finance or manufacturing or construction, and thinks "software can't be that different"–that is the kind of lawyer who is far more likely to demonstrate that species of ignorance.
- linsomniac 8y agoThat reminds me of a hosting client I used to have, which we got a DMCA takedown notice for: "They are using our software without a license." I replied: "They are a local reputable University, have you tried contacting them?" "I wasn't able to get ahold of them." "You weren't able to get ahold of a UNIVERSITY?!?" "Well, I didn't really try. I'm a subcontractor, in another country, and can't afford to make phone calls about it." I had also reached out to our client contact. They contacted the CMS company, provided them with the license information, and then switched to another CMS.
- userbinator 8y agoI think lawyers need to talk amongst themselves more; there are certainly even ones who specialise in open-source. He was also concerned that we were letting people 'View Source' our web pages and stealing our IP. ...and here is where the DRM advocacy comes in. Don't let them ruin the Internet...
- elliekelly 8y agoI couldn't agree more. I've yet to attend a meeting between legal and tech ops that hasn't been traumatizing for just about everyone involved.
- tuxracer 8y agohttps://docs.npmjs.com/files/package.json#private https://docs.npmjs.com/files/package.json#private anyone hoping to avoid the same fate
- jordache 8y agoit's probably just a data visualizer component.
- vortico 8y ago"Ignorance" is not having knowledge about a certain field. Everyone has it. "Stupidity" is having ignorance about a field but pretending not to. These lawyers may have 7 years of law school education, but they are still "stupid".
- elliekelly 8y agoOption C: Easy "billable hours"
- linsomniac 8y ago"Now I get to spend money on a lawyer to explain this to them."
- koolba 8y agoHere’s a pro tip: Enable 2FA for your NPM account Not only do you get additional security for 2FA, you also get a prompt for the TOTP pin that makes you question what and where you’re publishing.
- landr0id 8y agoEven with this, people are dumb. It's probably not a case of "we didn't realize we were publishing to" and instead a case of "some dev didn't realize this was a bad idea".
- pbhjpbhj 8y ago>some dev didn't realize Surely in a bank, when publishing, the decisions aren't down to a single dev. Either many people made a mistake together or many people made lots of small mistakes separately that added up to one big one?? FWIW, I don't know, I'm a small time potter, just how I imagine things happen in banks (I do know a couple of devs who work/worked for banks).
- mnutt 8y agoTo partially mitigate this issue, I scope all private packages to @corp-internal/, then use a .npmrc directive to push all packages in @corp-internal/ to packagecloud.io. The @corp/ scope is used for open source packages, @corp-internal scope does not exist on the public npm registry so no chance of config issues causing mistaken pushes.
- gautamdivgi 8y agoAs long as the code doesn’t contain credentials and hard coded urls it should be fine. Probably just regular old logic
- jhare 8y agoTell them it's a $35 fee for every erroneous publish. They understand fees.
- koolba 8y agoThey wouldn’t believe it’s real at $35. Maybe $35/byte. Then the lawyers could haggle, get it reduced to $35/non-white space byte, and feel like they accomplished something.
- FlowNote 8y agoI did my part in preventing such outcomes because I own goldmansachs npm install goldmansachs
- rdlecler1 8y agoThis should be renamed: Employee at major bank accidentally published a private package to the public NPM registry.
- AlexTWithBeard 8y agoIn our company access to public repos is blocked. I was upset about it when it was introduced, but now I start to see the point...
- tln 8y agoYou can't install from npm?
- AlexTWithBeard 8y agoNope. Only from the internal mirrors.
- deleted 8y ago[deleted]
- woutr_be 8y agoMost likeley they have an internal npm repository that mirrors all the packages, only available through a proxy. At least that's how it works where I work, other than having to set up your proxy settings once, there's no noticable difference.
- orthoxerox 8y agoThat's the best practice that should really be implemented everywhere. The proxy can even filter the packages by license, so you don't put AGPL code into your e-banking solution by negligence.
- burfog 8y agoIt is part of best practice. You really should have an air gap. Consider the problem of malware connecting out and then giving an attacker a VPN into your network.
- snazzycalynx 8y agoThis is annoying. Maybe npm can consider adding a confirmation prompt to publish if a new package is about to be created. Not sure if it'd prevented such ignorance though.
- Ndymium 8y agoA recent experience tells me this is a very easy mistake to do, though. I was using Yarn to publish a package to an internal package repository (so setting `private: true` was not an option). I did not know at the time that Yarn would not honor `publishConfig` in the `package.json` file, and it would also ignore the package's organisation set in `.yarnrc` (which is used to direct read operations to the internal repository). What it did was ask me to "log in" (there was no prompt to sign up), which I did with our internal credentials. It also asked for an email address, which in retrospect was foolish of me to provide, but that was the only indicator that something was not right. It did not tell me where I would be publishing to. When it was done it said the package was published. I checked the internal repository and it was not there. Instantly felt that horrible feeling in my stomach that everyone knows. I went to npmjs.com and found out that it had helpfully created an account with the internal credentials I provided, the credentials that were given in a prompt that said "npm login". What saved me was that the package was inside an organisation ("@foo/bar") and those are not free on NPM, so the package was not published, even though Yarn said so. The user account was created, though, so I had to recycle that password and send email to NPM support to get the account deleted (there is no way to delete your account yourself, sadly). The moral of this post is that when I saw this tweet I did not laugh at the company's foolishness in publishing internal code on NPM, because I almost did that myself and saw how easy the mistake is to make. (Of course, the rest of the tweet with the DMCA stuff is foolishness.)
- rounce 8y ago> What saved me was that the package was inside an organisation ("@foo/bar") and those are not free on NPM... (Public) Orgs _are_ free on NPM (at least nowdays) so maybe even that wouldn't have saved you.
- Ndymium 8y agoThen I am not sure what did prevent publishing, but it was not published.
- deleted 8y ago[deleted]
- redshat 8y agoI work at a large bank and a majority (if not 98.98989%) of the employees are morons. This doesn't surprise me one bit. I hope we find out which bank it is, I would bet money on it being the one I am employed at. Banks do security through obscurity and worry more about COMPLIANCE than they do actual security and that is a fact.
- huffstler 8y agoAs someone who also works at a bank (though not a large national one) I get the same feeling, though I understand it to an extent. Not complying to bank standards means you get dinged if you get audited. Getting dinged means you will most likely get your budget cut by an amount next quarter. Or get the group "reorganized".
- mstade 8y agoI also work at one of the top tier banks but I’m not quite as doom and gloom as you. (Maybe I’m one of the 1.01011% – finally!) It’s certainly true that some security practices within our organization seems more like security theater than anything else, but overall I think they have pretty reasonable standards and requirements set. It is very true though that the culture is almost entirely focused on compliance more than anything else, so there’re few proactive measures taken by teams. Lord knows no team I’ve ever seen outside of security wants to budget for it. Maybe it’s a damned if you, damned if you don’t kind of situation. If you don’t set compliance regulations you’ll get no security (move fast and break things, yay!) but if you do you end up with people ticking boxes saying “the thing is secure and stuff yo” and then play the blame game when it isn’t. My feeling though, having worked with top tier banks in the financial industry for the last 8 years or so, is that more people are competent than not, but process stifles creativity and drive a lot of the time. It’s a very special kind of environment to work in.
- Halluxfboy009 8y agoI hope he send them the bill for his lawyer.
- alkonaut 8y agoWhat is the risk/problem with this, assuming the bank didn't have anything sensitive or security critical? (If they had Keys, personal info etc in their source then that's the problem isn't it?) If someone finds a module of BankX's boring backend code, what is the risk/problem for the bank?
- uberswe 8y agoSome companies like to practice security through obscurity. So you might be worried that someone trying to exploit the system would have an easier time testing effective exploits. Another thing is the code itself, you don't want competitors seeing your implementation if you feel that it gives your company an advantage over others. There may be data structures or algorithms that are internal company knowledge only and defined in the code.
- jhare 8y agoHide the embarrassingly ugly, also.
- orian 8y agoSo, they're free riding on NPM and threatening it with lawyers. Seems legit.