4 ms·

I'm completely baffled how people work. Something like that can't actually happen. At least if you assume people working on software can read. But it seems not

I'm completely baffled how people work. Something like that can't actually happen. At least if you assume people working on software can read. But it seems not even this can be safely assumed nowadays. How can someone include some dependency without checking the license? That's actually the very first thing to do, before you can even consider using something! Not doing this is extremely unprofessional. Additionally it's stupid and very dangerous: You can bring yourself and/or your company into serous trouble. Really serous trouble. Do people really pull in some random stuff without even looking a little bit what it is? This would make the old write-up¹ about someone placing the ultimate backdoor everywhere a certainty by now. Sorry for ranting but this whole thing is a real-world satire, imho. The license was a joke, OK. But that it didn't fool only some random hobby hacker but alleged professionals at big corps is truly egregious. I can't stop shaking my head… ¹ https://medium.com/hackernoon/im-harvesting-credit-card-numbers-and-passwords-from-your-site-here-s-how-9a8cb347c5b5 https://medium.com/hackernoon/im-harvesting-credit-card-numb...

mdoms 5y ago
A valid license does nothing to prevent supply chain attacks.
gpas 5y ago
The npm circus is crazy. How anyone can consider himself a dev and then depend on packages like is-odd, 486.139 downloads weekly is-even, 206.628 is-windows, 17.329.418 is-empty, 176.643 true, 504 too many false, circa 700 is-number, 46.806.043 (!!!) is-promise, 10.282.368 left-pad, 3.014.769 These are the one I hate more, but it's full of unnecessary one-line packages. Some of them are even used by the big players. I just don't understand...
Macha 5y ago
I highly doubt most devs check the license of every dependency 3 layers deep from their UI framework. create-react-app, vue-cli sets up several hundred dependencies. If you tell me >50% of devs investigate each dependency manually, or run a license checker on that, I don't believe you. Where I work for we have automated license scanners for this reason. They would flag such a use. But this open source project, and apparently 467 other cases, missed that. Maybe the contributors assumed the author had done their due diligence, maybe they just don't check in general, it's hard to know.
- still_grokking 5y ago
  Automation is of course very helpful. But my point wasn't about transitive deps (directly). The point is about pulling something new into your project. At the point you include something that something needs to tell you the license for itself and for all its dependencies. If it doesn't that's already fishy in its own rights (and you should turn back or start investigating for real). You need to look at the provided license lists of course. Yes, I see more and more projects that don't list licenses for their deps. But that's usually already a license volition on its own! You can't use something like that, it's obviously problematic. Having some tools that download random stuff form the internet may be OK when you're doing something for yourself. But at the moment you want to publish that something you're obligated to check the licenses. That's a know thing. If you don't that's very shoddy work, and actually you could get sued for all resulting damages. So no matter what it's actually impossible to include code with a problematic license, given no botchers were involved anywhere deeper in the chain. And here we're at the core of what I've said: It's completely baffling to me how something like that could possibly happen. At least as long as I try to believe that no complete idiots work in the industry, people who aren't even capable of reading, and don't know even the most basic things about the job they try to do. People that therefore shouldn't be allowed to touch anything as they could create great danger for their surroundings and for themself! But OK, maybe I just have to accept that the software industry is not different to this here: https://www.youtube.com/watch?v=FfyPLTIn2D8 https://www.youtube.com/watch?v=FfyPLTIn2D8

mdoms 5y ago

A valid license does nothing to prevent supply chain attacks.

gpas 5y ago

The npm circus is crazy. How anyone can consider himself a dev and then depend on packages like is-odd, 486.139 downloads weekly is-even, 206.628 is-windows, 17.329.418 is-empty, 176.643 true, 504 too many false, circa 700 is-number, 46.806.043 (!!!) is-promise, 10.282.368 left-pad, 3.014.769 These are the one I hate more, but it's full of unnecessary one-line packages. Some of them are even used by the big players. I just don't understand...

Macha 5y ago

I highly doubt most devs check the license of every dependency 3 layers deep from their UI framework. create-react-app, vue-cli sets up several hundred dependencies. If you tell me >50% of devs investigate each dependency manually, or run a license checker on that, I don't believe you. Where I work for we have automated license scanners for this reason. They would flag such a use. But this open source project, and apparently 467 other cases, missed that. Maybe the contributors assumed the author had done their due diligence, maybe they just don't check in general, it's hard to know.

still_grokking 5y ago
Automation is of course very helpful. But my point wasn't about transitive deps (directly). The point is about pulling something new into your project. At the point you include something that something needs to tell you the license for itself and for all its dependencies. If it doesn't that's already fishy in its own rights (and you should turn back or start investigating for real). You need to look at the provided license lists of course. Yes, I see more and more projects that don't list licenses for their deps. But that's usually already a license volition on its own! You can't use something like that, it's obviously problematic. Having some tools that download random stuff form the internet may be OK when you're doing something for yourself. But at the moment you want to publish that something you're obligated to check the licenses. That's a know thing. If you don't that's very shoddy work, and actually you could get sued for all resulting damages. So no matter what it's actually impossible to include code with a problematic license, given no botchers were involved anywhere deeper in the chain. And here we're at the core of what I've said: It's completely baffling to me how something like that could possibly happen. At least as long as I try to believe that no complete idiots work in the industry, people who aren't even capable of reading, and don't know even the most basic things about the job they try to do. People that therefore shouldn't be allowed to touch anything as they could create great danger for their surroundings and for themself! But OK, maybe I just have to accept that the software industry is not different to this here: https://www.youtube.com/watch?v=FfyPLTIn2D8 https://www.youtube.com/watch?v=FfyPLTIn2D8