18 ms·

Note that this wasn't careless programming. The developer who was publishing the module pulled the release because he was threatened by a company named Kik who

by edem 5y ago

Note that this wasn't careless programming. The developer who was publishing the module pulled the release because he was threatened by a company named Kik who wanted to take over his namespace. After pulling it Joyent had no choice but to restore the module to prevent the whole ecosystem from collapsing. I think the core problem here is that releases should be immutable, just like with Java (Maven Central). Once you put something out there it should stay there until nuclear fire destroys the world, otherwise you risk bringing down the whole ecosystem, just like how it happened with `left_pad`.

tgv 5y ago
Or people copy dependencies to their own repos and build from there. You can't rely on a company, even one like github/MS, to exist until end of times.
ezoe 5y ago
What if it contains copyright infringement, Government classified information, Child pornography, personal data, and all the data the law prohibit to distribute? Our society cannot stand the immutability yet. Our build process shouldn't relies on somebody else's server over the Internet for each minor deploys to the web server.
- amingilani 5y ago
  > Our society cannot stand the immutability yet. I hate to point it out, but we already have immutability. If you add something to, say, the Bitcoin blockchain, it'd take erasing the entire blockchain to destroy that information. That's a tall order.
  - georgyo 5y ago
    Since Bitcoin allows for storing small amounts arbitrary data in a transaction. Seems like an attack vector is to put illegal content into the Blockchain.
    - amingilani 5y ago
      See Illegal Content and the Blockchain by Bruce Schneier: https://www.schneier.com/blog/archives/2021/03/illegal-content-and-the-blockchain.html https://www.schneier.com/blog/archives/2021/03/illegal-conte...
    - blockchain615 5y ago
      Bitcoin BTC has very limited capacity, and high cost per byte. But I wonder why more capable blockchains aren't used as mass doxbins and leaks storage yet. There are many popular blockchains where anyone can upload many megabytes per dollar.
  - ezoe 5y ago
    Bitcoin has not been famous for trafficking platform for the illegal data(yet). But it has its potential. All we need is a visualization tool. A tool that display the interesting data or automatically download data if it looks like URL. Complete with upload feature which spend BTC to record the user supplied data(or upload to somewhere resistent and record URL of it) to the Bitcoin blockchain, it can be a practical platform to trafficking illegal data. Actually, I think Bitcoin blockchain has accumulated enough illegal data so just a fool-proof visualization tool is enough to make authorities serious enough to prohibit the Bitcoin. It's more of a presentation than technical though.
    - edem 5y ago
      It would make no sense since contrary to popular belief you can be easily tracked through the use of the blockchain. And you also can't erase evidence.
- chriswarbo 5y ago
  > What if it contains copyright infringement, Government classified information, Child pornography, personal data, and all the data the law prohibit to distribute? I think content-addressing is a good solution to this problem: it separates the identification of a thing from the retrieval of a thing. In this example, software can depend on '<cryptohash>-left_pad-1.2.3', without having to know or care where that comes from (NPM, bittorrent, IPFS, sneakernet, etc.). Build tools can try to fetch these dependencies from a bunch of different sources, including caches on the local machine, on a company intranet, on well-known mirror services, etc. and verify that it got the correct file by matching the hash. A nice aspect of this is that it's resilient for things that people want to host (like left_pad, for example), but nobody is under any obligation to host everything. Mirrors are free to ignore/delete anything with illegal/malicious/spammy content.
- edem 5y ago
  You check all of that __before__ the deploy. You don't let that stuff in. And once you have something up it stays up. Otherwise a single idiot can bring down the whole system.

by edem 5y ago

tgv 5y ago

Or people copy dependencies to their own repos and build from there. You can't rely on a company, even one like github/MS, to exist until end of times.

ezoe 5y ago

What if it contains copyright infringement, Government classified information, Child pornography, personal data, and all the data the law prohibit to distribute? Our society cannot stand the immutability yet. Our build process shouldn't relies on somebody else's server over the Internet for each minor deploys to the web server.

amingilani 5y ago
> Our society cannot stand the immutability yet. I hate to point it out, but we already have immutability. If you add something to, say, the Bitcoin blockchain, it'd take erasing the entire blockchain to destroy that information. That's a tall order.
- georgyo 5y ago
  Since Bitcoin allows for storing small amounts arbitrary data in a transaction. Seems like an attack vector is to put illegal content into the Blockchain.
  - amingilani 5y ago
    See Illegal Content and the Blockchain by Bruce Schneier: https://www.schneier.com/blog/archives/2021/03/illegal-content-and-the-blockchain.html https://www.schneier.com/blog/archives/2021/03/illegal-conte...
  - blockchain615 5y ago
    Bitcoin BTC has very limited capacity, and high cost per byte. But I wonder why more capable blockchains aren't used as mass doxbins and leaks storage yet. There are many popular blockchains where anyone can upload many megabytes per dollar.
- ezoe 5y ago
  Bitcoin has not been famous for trafficking platform for the illegal data(yet). But it has its potential. All we need is a visualization tool. A tool that display the interesting data or automatically download data if it looks like URL. Complete with upload feature which spend BTC to record the user supplied data(or upload to somewhere resistent and record URL of it) to the Bitcoin blockchain, it can be a practical platform to trafficking illegal data. Actually, I think Bitcoin blockchain has accumulated enough illegal data so just a fool-proof visualization tool is enough to make authorities serious enough to prohibit the Bitcoin. It's more of a presentation than technical though.
  - edem 5y ago
    It would make no sense since contrary to popular belief you can be easily tracked through the use of the blockchain. And you also can't erase evidence.
chriswarbo 5y ago
> What if it contains copyright infringement, Government classified information, Child pornography, personal data, and all the data the law prohibit to distribute? I think content-addressing is a good solution to this problem: it separates the identification of a thing from the retrieval of a thing. In this example, software can depend on '<cryptohash>-left_pad-1.2.3', without having to know or care where that comes from (NPM, bittorrent, IPFS, sneakernet, etc.). Build tools can try to fetch these dependencies from a bunch of different sources, including caches on the local machine, on a company intranet, on well-known mirror services, etc. and verify that it got the correct file by matching the hash. A nice aspect of this is that it's resilient for things that people want to host (like left_pad, for example), but nobody is under any obligation to host everything. Mirrors are free to ignore/delete anything with illegal/malicious/spammy content.
edem 5y ago
You check all of that __before__ the deploy. You don't let that stuff in. And once you have something up it stays up. Otherwise a single idiot can bring down the whole system.