51 ms·
Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
- throwawayay02 5y ago> now what Now pin an older version and if you want fork it and develop it yourself. Whooptidoo.
- duxup 5y agoI get how they feel, but why shaft EVERYONE?
- deleted 5y ago[deleted]
- cerved 5y agobecause they're leet haxxxor dickwad
- wly_cdgr 5y agoLove to see it. About time open source devs started fighting back against the Silicon Valley techbro founder scum who've been shamelessly exploiting their idealism and naivete for decades
- viro 5y agoyou love to see people indiscriminately pushing malware to random servers without knowing what the server even does?
- bsagdiyev 5y agoYou’re running mission critical software without thoroughly parsing your chain of dependencies and then automatically deploying updates on top of it? I don’t think the author is at fault here, just bad practices of whoever broke their application.
- viro 5y agomalware is malware. shoulda coulda doesn't matter its still a crime. "All those people I scammed out of their life saving should have known better". You probably shouldn't advertise that you work at crowd strike with crazy takes like that.
- tibiapejagala 5y agoI love how you describe this as “pushing malware to random servers”. Maybe if he included a backdoor in previous versions and now dispatched infinite loop from his C&C server, sure. But he published a new version of his library, which was literally pulled by the affected parties. I’m pretty sure that was illegal in the US, but that’s multiple-felonies-a-day-land anyway.
- wly_cdgr 5y agoI love to see venture bros getting fucked in the ass like they deserve. They're choosing to pull the updates, so anything that happens on their end as a result is their risk, their responsibility, and their problem
- gfykvfyxgc 5y agoI don’t understand the mindset of open source developers who dedicate significant time energy and life to free software, unless there’s a tangible, quantifiable advantage to doing so. That advantage may well be indirect such as reputational or learning. I just don’t grasp why people do it for nothing, to the advantage of large companies.
- boxed 5y agoIt's quite simple: there IS a "tangible, quantifiable advantage to doing so". The problem is that you imply "...to the person writing the code". That's where your confusion lies. I am getting huge value from the people who built stuff before me. When I build stuff I can (hopefully) make the world better in the future. That's a "tangible, quantifiable advantage" to doing open source. It's just not an advantage to me personally. But lift your gaze an inch off the ground and you'll see we don't need to be ego centric sociopaths. We can build together. For the species. Everyone wins.
- arvinsim 5y ago> But lift your gaze an inch off the ground and you'll see we don't need to be ego centric sociopaths. We can build together. For the species. Everyone wins. I don't know in what fairy tale you live in but the ego-centric billionaire sociopaths that exploit this system wins.
- grammarnazzzi 5y ago> I don’t understand the mindset of open source developers who dedicate significant time energy and life to free software, unless there’s a tangible, quantifiable advantage to doing so. They get: meaning, status, influence, connections, reputation, and opportunities The free and open nature of their contribution makes it much easier to get all these benefits than they would with a paid and proprietary solution.
- andrew_ 5y agoBecause it's fun ya mook. That's it. That's the reason. It's fun to tinker. It's fun to put things out there into the ether. It's fun to exercise the brain and try new things and learn new ways to do things and publish things. The second it stops being fun, we stop.
- Osmose 5y agoIt's a bit wild that the sum total money spent on salaries for engineers handling potential problems stemming from this or defending against the possibility in the future could probably have covered paying the maintainer a living wage many times over.
- thefourthchime 5y agoLiving wage? haha, more like 100 peoples living wage.
- sillysaurusx 5y agoIn America, most unskilled software developers make somewhere in the $80k to $140k range. A living wage is around $20k for absolute bare minimum essentials. Skilled devs still get around $200k. Point is, maybe 10 people. And that’s if you like ramen.
- aiisjustanif 5y ago> Skilled devs still get around $200k. Moderately skilled it engineers other of backgrounds and devs can make much more than $200k, just go check levels.fyi To the parent comments point > It's a bit wild that the sum total money spent on salaries for engineers handling potential problems stemming from this or defending against the possibility in the future could probably have covered paying the maintainer a living wage many times over. The collective effort across numerous companies is much more than just $200k and you can bet your butt on that.
- llamataboot 5y agoI don't know where people get these crazy numbers - Even in America outside of the coasts and outside of FAANG, making $140-$150+ as a senior developer is very good (and compared to almost all other industries is absurd) - salary.com which doesn't just rely on self-reported info as levels does reports the median salary + bonus for senior software engineers as $120k https://www.salary.com/tools/salary-calculator/senior-software-engineer?type=bonus https://www.salary.com/tools/salary-calculator/senior-softwa... Outside of the US, even in more expensive places in the EU, even the equivalent of $100k for a super senior lead architect would be Very Good - I don't know a single SWE in the midwest in the US - including senior embedded systems engineers working on medical devices, senior firmware devs working on networking equipment, or any web engineer that makes more than $175k and I know plenty of Very Good senior full-stack web devs that make $125-$150 $125k a year is still a top of the top salary in the US, so don't cry for them tho
- Flocular 5y agoImagine they introduced something worse. Could any developer explain to a manager why you needed to import this package? "Why do we need colors there?", "Why can't we make that colored ourself?"
- iainmerrick 5y ago“Why are you writing all this stuff by hand? Isn’t there a package for that?”
- chrisshroba 5y agoAn easy answer would be "we import thousands of packages either directly or recursively, so while we may be able to replicate the work of any one of those (which is unlikely to be true in the first place), it would take thousands+ of engineer hours to replicate all of them, and there was no way of knowing that this one among thousands would be sabotaged."
- Beta-7 5y agoAt my last job we (InfoSec) had the devs fill out "ownership" forms for when they want to include something third-party into the product. Other than forcing the team to do due diligence on the third-party it also made them responsible for keeping it secure and them the people "at fault" if something went wrong due to it. While it was seen as an unnecessary hurdle set up by us I hope it started some meaningful conversations in the teams and maybe even end up with them "reinventing" the wheel for the better.
- Flocular 5y agoAt my current job I'm trying to establish the same. Have to say, the recent news are water on my mills!
- aahortwwy 5y agoThese sorts of "security" measures kill productivity and ultimately accrue (along with others) to the point where your organization moves so slowly that its lunch gets eaten by upstart competitors who aren't burdened by self-imposed make-work. I've seen it happen.* EDIT: * While working in infosec, I'll add.
- cardosof 5y agoUrgh, that's horrible. Even if package authors feel like they should get some compensation, breaking code like this is never the way to go. Maybe they think most apps are "useless" anyway and could break, but there's a chance healthcare/wellness apps might break too, doing real harm to real people.
- Comevius 5y agoGitHub suspended access to their account for a commit to their own software, because it caused a problem for all these companies. For one it shouldn't have, like pinning a dependency and auditing all changes should be done ideally. These libraries are always licensed in a way that excludes warranty of any kind. But I honestly don't care if companies "exploit" open-source software by making money using them and not donating to the developer. That may be unhealthy for the ecosystem, but neither side is entitled to anything. I would donate, but not expect a donation, and poisoning the well the way these developers did is not going to help any of us.
- dagmx 5y agoGitHub ToS allow terminating accounts for malicious behaviour, which I'd argue that purposefully breaking downstream code is.
- raesene9 5y agoThat seems like a bit of a shaky ground to stand on for GH. If someone publishes code for themselves, and at no time asks anyone to take it as a dependency, then at a later date they change that code in a way that breaks other people's use of it, do GH then take over the account?
- pmontra 5y agoI happened to create an infinite loop in some of my programs but not intentionally like the author did. Furthermore he intentionally pushed the infinite loop with the result to DoS everybody knowingly or unknowingly using his software. This is malicious behavior IMHO.
- ulimn 5y agoIf they wanted to publish it for themselves, wouldn't they make a private repo? I'm (honestly) trying to understand why GitHub can't just go ahead and remove any account as they see fit. Edit: Am I being downvoted for asking a question?
- oneeyedpigeon 5y ago> This trains people not to update, 'coz stuff might break. What it should be training you to do is test updates first rather than blindly applying them in a production environment...
- hulitu 5y agoTesting ? Even MS lets the users test its SW. Testing is expensive and takes a lot of time and we know for sure that our SW works. /s
- esarbe 5y agoIt's his software and he can do with it as he pleases. It's an MIT license, so there's no warranty whatsoever. I'm not convinced that GitHub has any business suspending his account.
- ulimn 5y agoIf he can do as he pleases, can't GitHub as well?
- not2b 5y agoGitHub also has rights. They can choose to boot vandals off. They can choose not to host intentional malware.
- foxhop 5y agoHow does one vandalized her own property? Isn't that just called using it?
- throwawayay02 5y agoThey can and they did, but it still feels malicious because they intentionally reverted the maintainer's latest version, which is the author's will on their creation. It's a bit like me going to my bank to close the account and instead they throw me out and keep my money. Honestly I don't understand why microsoft did anything at all. Can't people just pin a version?
- fault1 5y agodoesn't npm have policies for packages to follow semvar? I could see why they would have policies to rollback broken minor versions that are distributed via npm.
- esarbe 5y agoYes, fair enough.
- scotty79 5y agoSo people learned basically nothing from leftPad.js ?
- ajkjk 5y agoWhat were they supposed to learn? "Don't have dependencies"?
- Narretz 5y agoPin your dependencies and only update them manually, or if you do it automatically, only after running tests. Also use a registry mirror.
- scotty79 5y agoAdd a layer of indirection between you and the source of your dependancies so you can control them? Just a proxy that delays new version availability for a week would protect you from this. But yarn add directly from the account of a madman who made your dependency is so much easier.
- tremon 5y agoControl your dependencies, don't make them control you. Pin dependendency versions, don't allow auto-upgrade. And cache your dependencies locally for as long as you depend on them.
- rytcio 5y agoIdeally
- CRConrad 5y ago> What were they supposed to learn? "Don't have dependencies"? Yes. Or vet them thoroughly.
- notRobot 5y agoHere's my $.02: Packages are literally remote code exec vulns in the hands of package authors. At the very least, it takes them under a minute to break your app, simply by deleting their package. Read the article. This is not the first time it's happened, and it's not going to be the last. [0] I write backends (mostly in PHP, although not exclusively), and I release a lot of my code under libre licenses. But I don't do packages. I don't want that level of control over other people's projects, it's scary as fuck. I have enough responsibilities as is. I have a mailing list for people who use my code, when an update is out they can download the .php files, 'require' them and test them before deployment, but never will I do packages. IMO, re-inventing the wheel sometimes is not the worst thing. Including code written by strangers that you haven't inspected and that they can remotely modify is. Stop using packages that are essentially wrappers around three-line Stack Overflow answers. In this case, the old-fashioned way is the better way, and you'll have a hard time convincing me otherwise. [0]: https://qz.com/646467/how-one-programmer-broke-the-internet-by-deleting-a-tiny-piece-of-code/ https://qz.com/646467/how-one-programmer-broke-the-internet-...
- blackoil 5y agoExtending your logic to extreme you'll not be able to use any OS, compiler, processor unless you build it. We can't build practically anything of use without any 3rd party library in any language/platform. The problem here is not packages but lack of stdlib and tendency of package writers to have shit ton of further dependencies.
- MaxBarraclough 5y ago> I don't want that level of control over other people's projects, it's scary How far do you take this though? The average GNU Linux distro ships with a whole pile of packages already installed, from a multitude of different authors.
- rajin444 5y agoThere’s no reason people can’t keep local caches of these libs if it is a major concern. This seems like a non issue.
- phkahler 5y agoWhat exactly does colors do?
- shepherdjerred 5y agohttps://www.npmjs.com/package/colors https://www.npmjs.com/package/colors > get color and style in your node.js console
- Ostrogodsky 5y agoIt's incredible how far we have come
- guessmyname 5y ago> What exactly does colors do? A picture is worth a thousand words → https://i.imgur.com/inxA7Pg.png https://i.imgur.com/inxA7Pg.png The library inserts ANSI escape sequences [1] between the text you want to colorize in order to, well, colorize it ¯\_(ツ)_/¯ Many people are obsessed with colors in the Terminal, and so, they reach out to libraries like this. They exist in every major programming language ecosystem, even though colorizing text is as simple as writing this \x1b[48;5;011<TEXT>\x1[0m . One of the disadvantages of this rudimentary colorization technique is that if you have short-term memory, you will quickly forget the meaning of these numbers, but you can solve that problem with constants, there is no reason to install a third-party library with potentially malicious code to add this type of functionality to a high-profile project like AWS-CDK [2]. I wish these libraries would support NO_COLOR [3] more consistently. I have seen many “modern” CLI tools (the ones people like to build using Rust or Go) overuse colors with no option to disable them. [1] https://stackoverflow.com/a/33206814 https://stackoverflow.com/a/33206814 [2] https://github.com/aws/aws-cdk/pull/18324/files https://github.com/aws/aws-cdk/pull/18324/files [3] https://no-color.org https://no-color.org
- hnthrowaway0315 5y agoWhy wouldn't everyone roll their own solution? Doesn't seem to be a huge thing to me, but I could be wrong...
- deleted 5y ago[deleted]
- evolve2k 5y agoMy sense is that it’s time to evolve licensing such that wealthy major consumers of packages that have become somewhat essential are naturally paying a licence fee. The problem is not in what the code does it’s a problem with the agreement for use.
- evolve2k 5y agoActually in attempting to answer my own question, on other platforms like YouTube and Medium, popular content receives monetary support by virtue of being popular. What if this was addressed at the “platform” level, I’m thinking the package manager here, NPM. If npm had paid plans that would essentially mop up larger corporations they could then auto-distribute funds Spotify style based on “number of listens”. I’d personally want to see this work mainly as enterprise plans.
- tailspin2019 5y ago> If npm had paid plans that would essentially mop up larger corporations they could then auto-distribute funds Spotify style based on “number of listens”. This seems like a pretty decent idea…
- hibikir 5y agoUntil there's enough money in the pot that making your packages seem very important happens to be a productive use of one's time. At that point, you have to start dealing with fake downloads, dependencies added for no reason to somewhat more popular packages that aren't paying much attention... and suddenly you need to take money from the pool to pay for your fraud prevention team.
- paulryanrogers 5y agoPerhaps download's value could be weighted by associated domains? For example if Apple.com is relying on it the author will get paid more than random.example
- 5y ago
- sys_64738 5y agoObviously he has this right to do what he wants and he did. But the consequences are that his reputation is in tatters. Probably doesn't bother him but equally the repos will be forked and utilization continues of the predecessor. Might not be a maintainer mind you so the dependent repos will quickly find alternates.
- capableweb 5y agoDoesn't it seem strange that Snyk is creating a vulnerability report for this + labeling it a DoS? DoS is something someone executes against a target, in this case a package had it's functionality (purposefully) altered. That's like calling changing the API of a popular library DoS, because now application authors need to change their code/use a different library... Fittingly enough, all four solutions for this particular issue all goes back to Snyk, as seen in the bottom of the blog post. Seems like they are labeling this a DoS to justify being able to publish something in their database and blog.
- detaro 5y agoIntroducing a deliberate endless loop is not like changing the API of a library, no.
- capableweb 5y agoBut if the API offered a function called .countBy but then renamed that function to be .countAllBy, now I can't run my application anymore, causing my service to go down if I upgrade the version without testing it, is that a DoS now?
- detaro 5y agono. is it really that complex of a concept that intent of a change matters too, and introducing an endless loop to cause trouble to users is different from a legitimate API change that does a useful thing?
- capableweb 5y agoWho are you to decide what is useful/legitimate or not? As a user of $ExampleLibrary, I surely know best what's useful rather than the maintainer.
- shukantpal 5y ago> Who are you to decide what is useful/legitimate or not? Common sense.
- trexd 5y agoWhy not just change the license to GPLv3 for the upcoming version?
- throw_m239339 5y agoGPL for students and open source projects, paid license for orgs and companies. GPL itself isn't really a way to get paid for your work.
- trexd 5y agoI was speaking more to preventing companies from using your open source work, but I guess in this instance the emphasis is on getting paid.
- gcampos 5y agoThe truth is that it become a race to the bottom with a lot of open source projects, specially the ones that are not hard to replicate. If the author made the project GPL, someone else would create a similar library with a more permissive license, which would end up taking the market and making the original library irrelevant.
- hartator 5y agoAnyone knows what the author meant by the "LIBERTY LIBERTY LIBERTY" message? It's unclear if it's referring to current authoritarian turns in our western world, big corps using his software for free, or something else.
- jayski 5y agoor the insurance company jingle
- alessioalex 5y agoHe's a nutjob that blew up his own house while trying to make a bomb or something. There's even an article somewhere. It's not the first time he's being ..weird.
- lightlyused 5y agoI posted this earlier, but it got flagged. https://news.ycombinator.com/item?id=29859476 https://news.ycombinator.com/item?id=29859476
- lightlyused 5y agoHis twitter post. https://twitter.com/marak/status/1320465599319990272 https://twitter.com/marak/status/1320465599319990272
- fault1 5y agoThe author of this package was caught with 50lbs of Potassium Nitrate (in the middle of NYC) and a bunch of materials on making bombs and booby traps when his apartment caught fire: https://abc7ny.com/suspicious-package-queens-astoria-fire/6425363/ https://abc7ny.com/suspicious-package-queens-astoria-fire/64... https://www.qgazette.com/articles/more-charges-possible-for-astoria-bomb-suspect/ https://www.qgazette.com/articles/more-charges-possible-for-... https://nypost.com/2020/09/16/resident-of-nyc-home-with-suspected-bomb-making-materials-charged/ https://nypost.com/2020/09/16/resident-of-nyc-home-with-susp... He might have been the unibomber in training. Don't want to pile on, but dude clearly seems to be going through mental issues.
- ruuda 5y agoThis is why you pin all dependencies and upgrade (and test) when it's convenient for _you_, not when the author pushes a new version.
- bayesian_horse 5y agoThe only way to prevent this is to pin the actual commit. Because the meaning of the semantic version numbers is up to the package maintainers in most packaging systems. And even then you need a way to source exactly that version without relying on the original author's cooperation. Pinning all dependencies to this extent is extremely inconvenient. More inconvenient, arguably, than to deal with this shit once in a while...
- ownagefool 5y agoThat's what .lock files do though.
- bayesian_horse 5y agoNot sure if that is even enough, at least in NPM the .lock files work on semantic versions, not commits. I'm not sure if NPM enforces you to change the semantic version with each commit. And even if all of that works, you still run head first into the issue once you inevitably upgrade the dependencies.
- epmatsw 5y agoYarn at least includes a hash of the tarball in the lockfile, so even if npm’s immutability fails somehow you’ll at least know.
- xg15 5y agoThen the package manager should be changed to make it more convenient.
- 5y ago
- T3RMINATED 5y ago
- ycIsGarbage 5y ago
- bcrl 5y agoAt some point people need to stop pulling in random unsigned libraries from the internet and deploying them without any review or testing. This chaos seems like it would be entirely preventable with just a small sprinkling of best practices.
- Xylakant 5y agoSigning would not have helped at all here - the author decided to nuke their project (and likely their last reputation), they could have signed that commit/package.
- bcrl 5y agoRequiring multiple signatures from several trusted sources would have.
- bcrl 5y agoI'm seriously downvoted for this? We have just had an incident where a maintainer acted maliciously and has demonstrated that a single point of trust is insufficient. If we really care about avoiding issues with open source software, clearly it is necessary to get multiple maintainers to sign off on changes to widely used open source projects. We have had all the technology components needed to implement this for decades, we just need the will to implement a system that is better. If we don't use this incident to improve, then it's going to happen again, and maybe the consequences will be worse.
- mrtksn 5y agoFor a bit more context: https://news.ycombinator.com/item?id=29839786 https://news.ycombinator.com/item?id=29839786 In essence, It seems to be the case of a developer getting screwed, being disillusioned, becoming political, making bombs?, attacking the ecosystem etc. Many years ago, I recall another developer of popular NPM packages(Azer Koçulu) pulling a similar thing[0]. https://qz.com/646467/how-one-programmer-broke-the-internet-by-deleting-a-tiny-piece-of-code/ https://qz.com/646467/how-one-programmer-broke-the-internet-... We followed each other on Twitter, I recall him being disillusioned with SV and angry to Wikipedia for some reason(I think he believed on some greater plan or agenda pushed by SV companies, including Wikipedia). I disagreed and got unfollowed and blocked. Later, if I recall correctly, he got married and was touring the world.
- hnthrowaway0315 5y agoProgrammers have all the power to hurt things but they rarely think about using that power. Sometimes it's not how much value you can create that wins the day, but how much pain you can strike at other people that counts. Politics is like that. Ugly, but necessary.
- arvinsim 5y agoThe sad thing is that some(most?) of them only want to think about the code and do not want to do deal with the real world implications of the software that they are involved in.
- hnthrowaway0315 5y agoThat's kinda OK-ish (for them), but politics is a monster that will bite you if you don't care.
- notatoad 5y agoi would pay for a service that runs an NPM mirror of a "last known good" version of packages to avoid this kind of thing. just keep all my dependencies a few weeks behind NPM to give things like this a chance to get caught, and let me continue blindly updating. every time something like this happens, the reaction in the comments is the same: well you should test your dependencies. and yeah, i do that before release, but running an npm update on my dev branch and finding one of my dependencies has broken something is a bunch of work i could do without, and seems like work that is being duplicated by a ton of developers.
- cerved 5y agoYou're using a VCS I presume? Why not just rollback?
- noobermin 5y agoThe replies here (and on twitter) really are making me realize a lot of the hurt that will possibly stem from marak's actions really were ripe to happen given the sheer number of javascript developers who don't understand at all what they're doing. IT people for some reason tend not to be great at introspection which tells me this won't be fixed because this is more than just one asshole dude, this is a systemic issue with js and web development as a whole. This sort of thing would be really hard to accomplish in Linux for example because of the mentality they adopted early on when Linus had his first burn out moment, but the fact that even after leftpad nothing has changed really shows how systemically broken web dev is.
- samhh 5y agoAnecdotal but everywhere I've worked on JS codebases has used lockfiles. It might be this isn't affecting that many but those it is affecting are loud.
- umvi 5y agoRollback what? You can't rollback someone else's dependencies.
- commandlinefan 5y ago> now what stop trying to save a couple of bucks by reusing functionality that's not that hard to just develop in-house maybe?
- notatoad 5y agoonly helps if people developing the functionality that is difficult to develop in-house do the same. i'm not going to build my own AWS cdk.
- hnthrowaway0315 5y agoDo something better -- self host! Everyone decloud and only use the standard libraries compilers provide. What a wonderful world! Everyone is forced to do some system programming. Going to be pain in the beginning but then whoever really passionate about programming (not shipping products but programming) is going to be happy. OK just joke :/ Although I do secretly wish to wake up one morning and find out we have to do things like in the early 90s.
- gitgrump 5y agoThis wasn't AWS CDK, it was a package to fake data and a package with some ANSI escape sequence constants. The comparison doesn't make sense. The problem is that developers apparently can't even differentiate between when you should use a library and when you shouldn't; they just pull in the first result from an NPM search. You can probably trust AWS, which is good because CDK is complicated. You can't necessarily trust random NPM package authors, which is good because rewriting `colors` is not a Herculean task.
- notatoad 5y agoIt wasn't a comparison. As the article states, AWS CDK depends on colors, if I want to use AWS CDK, I have to use colors too. I don't get the choice to re-implement that myself unless I want to stop using the official CDK library
- 5y ago
- hnthrowaway0315 5y agoMaybe everyone should include a clause in the license to force commercial use to pay certain "tribute" e.g. 0.01% of gross revenue. Worst case everyone is going to invent their own wheels, which is beneficiary to all lower-echelon programmers (but not so for managers/tech leads as they have responsibility to ship things) because I as one definitely want to invent as many wheels as possible.
- bastardoperator 5y agoShould I get paid for my multiple contributions to faker (I don't think I should)? I've submitted several PR's for generating data all of which were accepted. Even back then the maintainer was barking about money... Honestly the project would be better off forked. He did not write this library entirely by himself, at this point I just see him as holding other committers contributions as hostage. It's a bad look, why would anyone want to deal with him after this stunt is beyond me.
- starkd 5y agoI couldn't help but think the same thing. Seems like an incredibly immature way to handle it. He could have easily set an end date and state nothing will be maintained beyond that date. It's not a good look.
- IceDane 5y agoI don't think he cares at this point. I think this is a person that has been driven to the absolute end of their patience. If he's really barely been getting by, then I can only imagine the sheer frustration he must be feeling. Not only are there swathes of fortune 500 companies which depend on his package but don't contribute a dime, but he also had a company with millions of dollars in funding look at his idea and then weaponize his own project to beat him to market.
- andrewmcwatters 5y agonpx depcheck colors npx depcheck faker
- maxclark 5y agoWhat’s the fix here? Maintainers should be able to do whatever they want either their code But if they vandalize their modules that should be a lifetime ban from the registry It’s pretty obvious that node needs a better method for dealing with this by now
- ozim 5y agoCompanies/people should do due diligence and not accept libraries just because they are free somewhere on the internet and stop "staring". This would make libraries less popular and would make "stars"/"downloads" less of a misguided status symbol that is only making things worse, because the more "stars"/"downloads" people have the better they feel. Then comes hangover when reality hits and such person is left with silly numbers that are not going to buy anything but also not helping to land a job. That would make people who should not be in a maintainer position not to be there as it would stop being so attractive. In the end there would be libraries/frameworks created by corporations that can afford that or by real enthusiasts that understand what they sign up for. Did Linus Torvalds made Linux to be famous - not - he did it because he liked to have it. He made it into career and got famous, but he is an exception not the rule. There is too much people who are in it for the wrong reasons that is my conclusion.
- kristjansson 5y agoNo. Maintainers should be able to publish whatever they want. Users should save whatever they want to consume locally for whatever specification of local (disk, mirror, whatever) works for them. Malicious actions will be rejected and punished by the marketplace. If GitHub et al want to be a value of local, i.e. controlled by the (community of) users then they can play that role, but no one should expect them to
- NKosmatos 5y agoTry to look at it from another point of view. Marak is fed up of all these billion dollar companies (and other small projects) using his code, he has some financial problems and so he decides to teach them a lesson. I sympathize and for sure if I were responsible for a big company and I was using an open source component/project I would donate something. We all have to rethink of how the open source funding is supposed to work and have some Fortune 500 c9mpanies start giving back to people that deserve it.
- oliyoung 5y agoWhile I agree with your sentiment, he made the "mistake" of MIT licensing his work.
- Aeolun 5y agoLike, I understand it. And he could easily have done something much more malicious, like running a ‘rm -rf /‘. This seems on the level of a very misplaced prank. I feel like people (and especially corporations thst have freely used the library for years) are overreacting a bit. This is just a warning signal that we depend on random packages too easily. The only thing standing between many products and disaster is the decency of maintainers. Nobody wants to acknowledge that (me included) since it’ll mean my job becomes much more of a pain.
- gls2ro 5y agoI think people overreact (or at least I overreact) because of two things: 1. A kind of "psychological contract" is in place between a package maintainer/creator and the developers using it and that is somewhere along the lines of "assuming good faith" or "good intentions" from the maintainer and giving back somekind of "kindness" to maintainer specially in cases of of some OSS (MIT, Apache, BSD-2/3 ...). This maintainer broke this contract - the trust of its users. They are pissed and rightly so. He broke is because he also felt that another "psychological contract" was broken between himself and the market. So his users are pissed because they see this as retaliation from the maintainer to them without them doing anything to merit this. 2. Another aspect is that he could have gone multiple ways to try to get money from companies by pivoting his projects. But his action is an emotional response with a hint of political activism that caused damage also to developers who are not having the choice (they are not decision makers or not managing budgets) nor the desire to be part of this. So for them there is another breach of "contract" happening: using those libraries seems to have a hidden term "you will be used as collateral when needed in my fight against big companies" which they did not agreed and was not explicit.
- joshuaissac 5y agoGitHub has now suspended the maintainer: https://nitter.net/marak/status/1479200803948830724 https://nitter.net/marak/status/1479200803948830724
- DangerousPie 5y ago> #AaronSwartz right...
- junon 5y agoYeah, this was really annoying to see. Don't use him as a pillar to your malicious action.
- zepolen 5y agoYou're new so I won't hold it against you. Aaron Swartz would have 100% approved of this.
- junon 5y agoI'm not new, and no he wouldn't have.
- ddtaylor 5y agoAaron was known for circumventing systems.
- croes 5y agoWas he also known for harming innocent bystanders just to hit big companies?
- ddtaylor 5y agoActually, yeah, because when he setup his PACER scraping script he used credentials belonging to a library that didn't belong to him. A similar thing happened when he hid the computer on campus in a closest that did the JSTOR scraping.
- shaunpersad 5y agoAITA for thinking that if you develop open-source software and your license permits anyone to use it for free, then complaining about no compensation is not a valid complaint? I totally understand that billionaire corporations use software like this for free. But the software maintainer has explicitly allowed _anyone_ to use it for free. If you don't want them to use it for free, license it as such. What am I not seeing here?
- melony 5y agoThat's fine, but then the downstream shouldn't complain either when the code breaks, whether intentionally or unintentionally. The contract on paper disclaims all liability after all. There is a social contract and then there is the literal contract. A lot of commenters here seem to be willfully obtuse or simply ignoring the former.
- stjohnswarts 5y agoIt still doesn't mean you can't call the guy out for being an asshole. However, that's the only relief you'll get in matters such as these. Other avenues would be to tweet about it and make it known that this is what you can expect from the same guy in the future so avoid him for future work as he won't be acting like an adult.
- syshum 5y agoThat also does not mean you cant call out the corporations that are leaching off open source... I find it ironic that people are more upset at this guy for complaining about corporations, than they are about the corporations leaching... the dev and hacker communities have really gone full on #HailCorporate haven't they. Where did my anti-establishment Libre community of the 90's go... I long for the good old days
- NotVerstappen 5y agoWatching people piss into the wind is fun until you get some on your shoes.
- noobermin 5y agoAmazing that the js community apparently learned nothing from the leftpad incident
- deleted 5y ago[deleted]
- inlined 5y agoHow is it not a legal issue to intentionally DOS customers servers? I would send a complaint to the California DA’s office for hacking; the laws against which in CA are very liberal.
- toomanydoubts 5y agoBecause you chose to download and execute it, without due diligence, while the license states that the code comes with no warranty whatsoever?
- dane-pgp 5y agoIf you create a package which claims to do one thing, but actually deliberately does something else that you know users don't want, then surely there comes a point where the harm done counts as hacking?
- dns_snek 5y agoEach version of the package comes with its own source code and license. It's your responsibility to audit new package versions before installing them. And that's what the author did, he published a new version. You can blame your tools and package.json for automatically updating, but at that point it's a self-inflicted injury.
- dane-pgp 5y agoI haven't actually checked if the README or description of the package was updated to reflect the new (malicious) behaviour of the code, but even if it was, I think that knowingly exploiting people's trust to stop their software working should be treated as evidence of hacking. It's like if you went to work one day with a spray can hidden in your jacket and started graffitiing the office walls, but justified your actions by saying "Well you could have searched me before I entered to make sure I wasn't carrying that spray can". Or perhaps a better example, what if some (free) binary application auto-updated, and included in the release notes or documentation a sentence stating that the "File > Open" option had been changed to instead delete the selected file. Would you still blame the victim for their "self-inflicted injury"?
- msoad 5y agoI do free work for open source _a lot_. I have a rather controversial opinion on this. I don't think I should be paid for my work because the moment money comes in I have to be responsible for the work I was doing for fun. I enjoy building cool things others can use for free and I want to reserve the right to respond to feature requests with a simple "PRs are welcome! :)". I get my paycheck from my employer and I have always been successful convincing my employers that I do open source work on the side for my own interest.
- franciscop 5y agoI have a different opinion, but I respect yours; and that's the basis of open source. There's many, many vastly different reasons why people do open source, and partly probably why we haven't "banded together to get paid" so to speak. For me, if I got donations that'd be great, but it'd not create a different sense of responsibility for my work, I'd keep doing exactly the same (unless I was explicitly hired as a contractor, but that's different). I do not particularly mind not being paid though, it's me who is putting my own code out there for people to use, for free! Now I make mainly open source JS libraries and use the fairly liberal MIT, if I worked in end-products where there might be a bit more of a "competition" or a big company might literally repackage/resell your product I might release those under a different license, like dual-licensed or similar.
- bruce511 5y agoSo, in essence, I think you're saying that you choose a license depending on your goals for a project. Which seems reasonable. More reasonable than folks who release under a license, then complain when others do exactly what the license allows. I see a lot of "but give nothing back" complaints from some open source folk, but I've looked hard and I don't see a "give something back" clause anywhere, at least not in the licenses I'm using. What I do see are "give something forward" clauses, which explicitly target customers, not suppliers. I like and use open source as much as the next guy, but for my day job I code for money. Alas so far Open Source pays no bills.
- 5y ago
- pmlnr 5y agoNPM dependencies go brrrrr again. Long live leftpad and the lack of stdlib!
- IceDane 5y agoI'm not sure what this is going to achieve for Marak but I can't help but sympathize and I can only imagine he is at the end of his patience - and who can blame him? The Retool people who decided to literally fuck this guy with his own project should be ashamed of themselves.
- epaulson 5y agoIt's time for someone to make a Redhat, but for "safe" open source software libraries. My big enterprise would sign up for it in a heartbeat. We'd pay for access from an alternative NPM registry where everything is at least semi-vetted - someone at least looks at diffs before new versions get updated and made available. Sure, the "safe" repo wouldn't have as nearly as many packages as the main NPM repo, but if it had the most popular packages that's probably fine. If I'm developing an app and wanted to use something outside of that "safe" registry, maybe I could, but I'd have to have a longer conversation with my enterprise's security org about why I'm using some new package that's not in the "safe" registry - and I'd probably have to pin or import it into my org's private repo. It's up to package authors and this new Redhat-ish company that manages the "safe" repo to figure out how to split revenue back to package authors. The new company is definitely providing a service and should get to keep a cut, but hopefully there's enough left over to give some to the package authors - and that's incentive enough for the package authors to want to get their code included in the "safe" repo. My company's security org is doing code scans/static analysis and version tracking and software BOM work of everything we're building, but ultimately none of this makes sense if I as an app developer can just add whatever I want and it's assumed to be safe if it passes the scans and doesn't have a CVE listed somewhere. We'd happily pay if someone was willing to try to vet packages (and take on some liability if they're wrong)
- Flocular 5y agoI could see a govermental effort be approriate too. Alot of critical infrastructure is depending on open source too. Agencies like the German BSI should embrace and invest into open-source much more strongly.
- tln 5y agoI think this could be done as a community. Imagine if npm allowed organizations to publish "vetted pointers" to packages. So redhat could publish a "{redhat}colors", which would include only the vetted versions. When installing, you could choose to setup your installation to allow "redhat-vetted" versions only. And that would apply even to sub-dependencies. This becomes a community tool if "redhat" could tell npm to vet anything vetted by another org.
- 5y ago
- Simplicitas 5y agoAs with every other human institution, the issue is "trust", or "civilization" as Bruce Scheneier has pointed out.
- pmontra 5y agoI run locate and found both colors and faker on my laptop as dependencies of Postman. Color's license is MIT. Faker's is custom but basically MIT too. The maintainer has every right to change his mind and/or stop maintaining those packages at any time. However the outcome (Fortune 500 companies using his work for free) is consistent with the choice of the license. With insight that was a mistake to start with. Maybe a FOSS license plus a commercial one would have bought him money but maybe those packages wouldn't become as popular as they are now. Everybody should dual license for mutual protection. Finally, breaking other FOSS projects and not only commercial ones is not the nicest way to complain against companies not paying him. Furthermore, honest question, did he ask them for those money?
- dang 5y agoRecent and related: Important NPM package colors from Marak causing console problems at the moment - https://news.ycombinator.com/item?id=29861560 https://news.ycombinator.com/item?id=29861560 - Jan 2022 (1 comment) Creator of faker.js pushed an update of colors.js which has an infinite loop - https://news.ycombinator.com/item?id=29855397 https://news.ycombinator.com/item?id=29855397 - Jan 2022 (1 comment) Marak adds infinite loop test to popular colors.js - https://news.ycombinator.com/item?id=29851065 https://news.ycombinator.com/item?id=29851065 - Jan 2022 (7 comments) Marak's GitHub account suspended after he erased his faker project - https://news.ycombinator.com/item?id=29837473 https://news.ycombinator.com/item?id=29837473 - Jan 2022 (53 comments) Faker.js Erased by Author - https://news.ycombinator.com/item?id=29822551 https://news.ycombinator.com/item?id=29822551 - Jan 2022 (2 comments) Popular JavaScript package “Faker” replaced with message about Aaron Schwartz - https://news.ycombinator.com/item?id=29816532 https://news.ycombinator.com/item?id=29816532 - Jan 2022 (3 comments) Faker.js Has Been Deleted - https://news.ycombinator.com/item?id=29806328 https://news.ycombinator.com/item?id=29806328 - Jan 2022 (9 comments)
- stjohnswarts 5y agoYikes, it's one thing to stop development of somethign but another to intentionally do damage to thousands of people, big companies and small one person webdev shops alike. This guy probably can't be sued because of opensource, but he should be shunned in the future by open source advocates and just the public in general. Why would anyone hire him unless it's to run an antifa/right-wing website?
- ricardobeat 5y agoSome people find this too rough, but the reality is: do not license something as MIT or any free license if you are not happy with commercial users benefiting from your work. Simple as that. None of them are under any obligation to pay, maintain, promote, or not clone your project.
- skeeter2020 5y agoAlso let's keep in mind that these projects would never have achieved their level of popularity if they were not licensed liberally. The value he's provided was based on free; you can't then compare it to the alternative after the fact.
- bogwog 5y agoThis guy wants to have his cake and eat it too. I saw a project recently where the author released it to the public domain, but in the top he said something like "I know it's public domain, but please don't remove my name." Sometimes people choose a liberal license like CC0 or MIT because they don't want to bother researching the boring details of licensing and/or don't care. But clearly that guy who wants his name on it, and the dev in the OP do care about the licensing details. Releasing colors/faker under a liberal license was a mistake, and pushing out this malicious update was another (much worse) mistake. What he should have done was updated his libraries to print out a warning like "This software has reached end-of-life and will no longer be maintained. It is being superseded by Colors PRO. Visit ... for more information.", and then started selling licenses/support contracts. But now, not only is he not going to get paid for colors/faker, he probably won't ever get hired by any of the companies affected by this, he might get sued, and he might even go to prison if this gets misconstrued as hacking. EDIT: Ok, after some more research, it looks like this guy is going through some serious shit: https://news.ycombinator.com/item?id=29868071 https://news.ycombinator.com/item?id=29868071 Everything I wrote up there was based on the assumption that he wasn't trying to build a bomb in his apartment...my bad.
- Miner49er 5y agoThis goes both ways. Don't blindly use MIT licensed code if you aren't okay with the risk of something breaking or something malicious being inserted.
- linuxhansl 5y agoEither you work on Open Source - which allows everyone to use it within the scope of the respective license; or you do not. Working on Open Source a lot myself, I have absolutely no sympathy for the developer. If you do not like others to use your work, then don't do it. Whether the "other" is a large corporation or not is immaterial. Now, this does point a problem which has bothered me before: The commoditization of every little aspect of functionality. That leads to 1000's or 10000's of dependencies that are impossible to track.
- arvinsim 5y ago> Now, this does point a problem which has bothered me before: The commoditization of every little aspect of functionality. That leads to 1000's or 10000's of dependencies that are impossible to track. It just points out to the glaring need for the JS/Web STL library to grow.
- tentacleuno 5y agoSo it looks like the developer's doing this as some sort of meme[0]. Personally I think we should be auditing our packages' dependency chains to ensure they're not reliant upon this developer. [0]: https://web.archive.org/web/20220109232136/https://github.com/Marak/colors.js/issues/285 https://web.archive.org/web/20220109232136/https://github.co...
- mwattsun 5y ago"Paying for open source - it matters" ~~ Rich Hickey @richhickey https://twitter.com/richhickey/status/1338893764702691334 https://twitter.com/richhickey/status/1338893764702691334 Edit: "Open Source is Not About You" by Rich Hickey https://gist.github.com/richhickey/1563cddea1002958f96e7ba9519972d9 https://gist.github.com/richhickey/1563cddea1002958f96e7ba95...
- rjhackin 5y agoDo you think npm is a flawed design ?
- throw_m239339 5y agoYes it is absolutely, but it was by design, in order to generate growth for NPM the company at the expense of the Node.js community. I'm not saying this, Node.js creator said that.
- greatgib 5y agoIt's fun, because a few years ago, serious software engineers in serious companies, were always hosting their own copy of all the dependencies that were used. In the worst case scenario, using 'stable' versions of Linux distributions like Debian. But, in recent years, the trend was the one of young incompetent hipster devs: it is has been to not use the very last version of everything, and especially if we can get it directly from random sources on the internet. This is especially true with npm/js and go developers. It is not like no one tried to tell them and teach them about that, but they can't or won't understand...
- sli 5y agoI'll admit that I cracked up pretty good over this, and am glad that I'm not working in JS/TS every day anymore for reasons among these kinds, but I am firmly on the developer's side on this one. Github suspending the developer's account is well within the realm of the type of questionable actions I expected out of Github after its acquisition by MS and only makes me feel even better about my long-ago move to Gitlab (a story for another time).
- glenneroo 5y agoSorry to repeat this again (too many repeated threads) but he was already temp-banned from GH around 2013 (i.e. before the Microsoft acquisition) for "creating a script that forced people to watch a library that [he] created", whatever that means: https://youtu.be/varf6oWaFtU?t=202 https://youtu.be/varf6oWaFtU?t=202
- Aeolun 5y agoThat’s the craziest thing. What does Github have to do with the npm packages? Why would his account be suspended over an upload to npm?
- toyg 5y agoGithub owns Npm, so I guess they feel entitled to be "NPM police" and nuke the rest of his output as collateral damage.
- shagie 5y agoNPM has been tightening up its publish and unpublish rules for over half a decade. https://thenewstack.io/the-kik-kerfuffle/ https://thenewstack.io/the-kik-kerfuffle/ That GitHub is now the owner of NPM doesn't change that policy and maturing of the environment. https://blog.npmjs.org/post/141577284765/kik-left-pad-and-npm https://blog.npmjs.org/post/141577284765/kik-left-pad-and-np... > We dropped the ball in not protecting you from a disruption caused by unrestricted unpublishing. We’re addressing this with technical and policy changes.
- 5y ago
- 0xbadcafebee 5y agoThe software industry doesn't have any standards about how to publish or consume software, and that leads to problems like these (not the conflict over OSS, but the ability for random upstream software to randomly compromise thousands of other projects). We all live in this 'wild wild west' of software that has no guarantees of quality or safety or rigor. We could really use a regulated license for software development, and minimum industry standards, so software can be certified to have the bare minimum of quality and safety processes. Things like an upstream dependency breaking can be caught well before it makes it into downstream projects. But you need the process in place to catch it. We all know what we're supposed to be doing, but few people actually do it, for all sorts of reasons (no time, no money, didn't think it was important, didn't know how to do it, etc). I think we should have regulation to require it, and an actual body that regulates how this is done, just like in every other "real" engineering discipline.
- throw_m239339 5y ago> The software industry doesn't have any standards about how to publish or consume software, and that leads to problems like these (not the conflict over OSS, but the ability for random upstream software to randomly compromise thousands of other projects). The publishing side is irrelevant. Anybody can make any package available for free on the internet. The unwillingness of some private businesses, often billion dollar companies, to audit and vet libraries because obviously, it costs money and these businesses use open source as a way to cut cost at first place, is the issue. The entitlement.
- 0xbadcafebee 5y agoWhy do you think we have zoning codes for how to build buildings? It's not solely because people refused to pay for buildings to be built the right way. Building things the right way takes longer and is more difficult, so people just didn't do it until they were forced to. The money is a red herring. Businesses don't really use open source to cut costs. Most businesses don't even know they're using open source. The business hires engineers and tells them what they want built, and the engineers choose to use open source, because they're lazy and it's quicker than trying to get proprietary vendors approved and licensing costs included in budget forecasts. Maybe some tiny companies that have no money really need to use FOSS, but the majority of businesses pay for software when they need to, they don't mind.
- pkgland 5y agoJust in case anyone need this, I’ve built pkg.land (beta) to help developers find NPM similar packages, here are the links for colors and faker: - https://pkg.land/package/colors https://pkg.land/package/colors - https://pkg.land/package/faker https://pkg.land/package/faker
- javchz 5y agoI think as JS developers, this should be a wake-up call, to never trust npm semantic versioning if your project it's critical. In this case, it's a dev who decided to use his right of doing political activism at the cost of his reputation. But this it's a best-case scenario. Another dev of a popular NPM library could get hacked, and insert malware. I wonder if there are zombie servers out there mining crypto or doing DDoS, just because an obscure library dependency of a dependency of a dependency, got compromised. I don't think Marak was "right" (In bird culture that is considered a d*ck move), but legally he owned nothing to anyone. Adding a new update to production without testing first, it's in the hands of their devs of the apps, not him.
- Aeolun 5y agoSomething tells me this update doesn’t quite go to production in a lot of cases. At least I don’t generate production data using faker.
- selfhoster11 5y agoProduction? Some people only have a testing environment, with production maybe in the plans at some point.
- jbverschoor 5y agoHow come npm packages aren’t immutable and signed just like rubygems? Totally understand the guy though
- Dma54rhs 5y agoIt's insane indeed, this stunt wrecked Googles official firebade cli app for npm. Google is full of talented developers and org is supposedly security minded, how does something like that get through. People pay top dollar to use their cloud services.
- arvinsim 5y agoFrom what I read in other comments, one of the possible motives of this action is to teach a lesson to these billion dollar companies who are piggybacking on OSS without giving back a single cent to the developers.
- laurent123456 5y agoBut they are. A given version of a package is immutable on npmjs. In that particular case, the developer pushed a new version of the package.
- junon 5y agoThey are. The problem is the prevalence of version ranges, which were never part of semantic versioning and instead added by npm. The author published a new version as a patch release which means everyone using version ranges automatically pulled it.
- kseifried 5y agoCVE probably won't do CVEs for these as they don't do backdoors/intentionally malicious code (but maybe they will, who knows). In any event the color.js issue is being tracked by the #GSD https://globalsecuritydatabase.org/ https://globalsecuritydatabase.org/ in GSD-2022-1000007 (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1000xxx/GSD-2022-1000007.json https://github.com/cloudsecurityalliance/gsd-database/blob/m...) and the faker.js issue in GSD-2022-1000008 (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1000xxx/GSD-2022-1000007.json https://github.com/cloudsecurityalliance/gsd-database/blob/m...), if you would like to add anything to it please submit a PR or file an issue against the file. Thanks.
- smrtinsert 5y agoStop using version ranges.
- 29athrowaway 5y agoI think package managers such as npm should require package maintainers to sign a legally binding agreement that they're not going to willfully do stuff like this. There's no other way. Why? because determining if a package is malicious via static analysis or other automatic means would be the equivalent of creating a solution for the halting problem.
- greyface- 5y agoWhat consideration, if any, should package maintainers receive in return for legally binding themselves in this way?
- 29athrowaway 5y agoThe publication of their package.
- throw_m239339 5y ago> The publication of their package. AKA peanuts.
- arvinsim 5y ago> I think package managers such as npm should require package maintainers to sign a legally binding agreement that they're not going to willfully do stuff like this. I would think this would discourage a lot of people to contribute to NPM. It's not about enforcement but the threat.
- 29athrowaway 5y agoSure but you cannot build something serious without guarantees. Maybe you can set a flag in your package.json which enables only the usage of packages from authors that have agreed.
- geuis 5y agoI’ve got a really strong, and I believe relevant opinion on this. I’ve been running jsonip.com as a free simple IP lookup service for 11 ish years. I used to be very politically active (shout out to Indymedia). Nowadays the sentiments are the same but the outreach, it is lacking. After Trump got elected, I went through the same phase many people did: shouting into the void on Facebook and Twitter. I was pissed off and wanted to feel like someone was listening to me, rather than doing anything about it. After a few months, that passed. And I honestly looked around for what I could do. Well it turns out I had (still have) a free simple api service that serves a couple million requests per day. It’s not much of an “audience” but it was something. What I ended up doing is adding some simple anti Trump messages to the api response. Yeah, on the surface this seems dumb and juvenile but let me out it into perspective. It’s my service that I’ve paid money every month for a decade. When in a situation where you have no voice, I feel it’s valid to use what you have. Now here’s the critical intersection with the topic at hand. I absolutely never did anything that fundamentally changed the api. I had no intention of breaking the client contract just to get attention. I added a couple extra fields, but in no way did that break anyone’s usage of the jsonip service. What this author did is really juvenile and crass. It’s a 13 year old level of maturity that leads someone to break the software chain that many downstream clients rely on. How many hundreds or thousands of build breakage alerts went off when they did a package upgrade because of this? How many thousands of human hours were spent because of this? There’s some minor argument being made in this that the author is pushing for some type of remuneration for their work, and I am entirely behind that. Maybe they should fork their packages into a paid model. Maybe setup a Patreon account. Maybe get a job at a company that uses their software. I dunno. But there are more mature and legit options for getting paid for your work than breaking the toolchain for who knows how many people and ruining your reputation at the same time. … /end rant
- shadowgovt 5y agoThis can be resolved by just pinning version in npm, right? I mean, it's a malicious attack that compromises trust in the maintainer of the package, but it's not the end of the world for any team being conscientious of their dependencies.
- gumby 5y ago> … introduced an infinite loop that bricked thousands of projects … What a terrible choice of metaphor. Apparently the author of this article has no idea what an actual brick is. You can brick a device, but hardly do the same with an application, much less a web page.
- willcipriano 5y agoYou get what you pay for.
- dopamean 5y agoMarak Squires is a really shitty person with an extremely checkered past. I wouldn’t use any software he was responsible for.
- no_wizard 5y agoI think this is one of those levels where it’s appropriate to ask for sources. Multiple sources, from reputable exchanges / sites. Sometimes folks get disillusioned which can lead to things like very real depression which can drive them to do things that otherwise they would not. I don’t agree with the choices in this case personally, I do not think we should rake the maintainer over a fire over it without more evidence of actual wrongdoing. This feels to me, if I was projecting myself as an armchair psychologist, that feelings of disillusionment have driven this behavior and I can understand how maintainers like this get there, especially when people build multi million dollar businesses on the back of your work without giving support or worse, demanding things they feel entitled to. Is it fair? No. Should perhaps they handled this differently? I wouldn’t have done this, I think there is a more graceful way to retire projects personally. Is it true that legally they were licensing their work in a way where millions could do this? Of course. However, ethos cut both ways. Companies and certain individuals like to ignore the ecosystem and not contribute back, lots of big ones, that make billions per quarter, and then chastise maintainers for not being responsive, or trying to change licensing to get more personal benefit etc. yet they don’t want to be held responsible for the other side of the ethos: contributing back to those which you built your success upon.
- no_wizard 5y agoThis isn’t a vulnerability nor is it corrupt, these are intentional actions on behalf of the project maintainer. Not that I agree per se, to be absolutely clear, however saying these are corrupt or somehow vulnerabilities isn’t the truth. This is the software working as intended
- spijdar 5y agoThey are absolutely corrupt -- intentionally corrupt, but the intention was to break the software in retaliation. Drilling holes in your boat to sink it means yes, it is sinking "as intended", but it's still an act of sabotage. I suppose you can specifically argue against the word corrupt as implying a corruption of the author's intention, but I think it also applies to "does not behave as anticipated". (now, the interesting question is how fair is it to anticipate free work from an individual -- I don't know where to draw the line, but this seems to cross some boundary...)
- josephcsible 5y ago> now, the interesting question is how fair is it to anticipate free work from an individual I don't really see how this is relevant. Suddenly doing no more free work at all would have been perfectly fine, but this was intentionally breaking preexisting code.
- no_wizard 5y agoTo me it is a smear to say it’s corrupt and/or malicious when a maintainer takes the project into a direction they want like this. It’s demonstrably true that this is now intended behavior of the code. Disagreeing with the changes, not liking the changes, if it causes problems for your projects etc does not automatically mean it’s malicious, a vulnerability, or corrupt. I feel this language is used intentionally to smear the maintainer and paper over a real conversation over open source, responsibilities of maintainers and consumers, and the ecosystem as a whole. Instead it’s all about the “vulnerability” caused by the maintainers choices to commit “malicious” code. Did the maintainer drastically change the software? You bet they did. Does that mean it’s malicious, a vulnerability, and/or corrupt? No. This isn’t an illicit cryptominer or process injection etc. the host machines are not being exploited in a malicious way. You can disagree with the actions and what they are doing etc, but labels matter, and I think this is an intentional labeling of this to skirt around having real conversations around OSS, maintainability, the role of consumers etc
- sydthrowaway 5y agoHonestly, the whole bomb making stuff was out of left field. This guy is Mr Robot
- CRConrad 5y agoSounds much more like fireworks to me: All those powdered metals burn in pretty colours. Also feels supported by the fact that the charges were dropped.
- rodgerd 5y agoThe comparison to log4j really rubs me the wrong way. The log4j developers made a poor design decision, but they were doing work in good faith in an effort to meet a user request. It was a mistake, but an honest one. This is someone being a shit deliberately. They shouldn't be mentioned in the same article.
- yamoyaml 5y ago
- mastazi 5y agoMy takeaway from this story is that I never really gave a thought about the fact that Github can close your account... And since on Github you are not allowed to have multiple accounts (e.g. personal vs work account), when that happens they are taking away your ability to work. I am going to set up a self hosted git server for my personal projects straight away. I am thinking about Gitea, any one can share their experience with it? Or alternatives?
- junon 5y agoI've never heard of GitHub enforcing the multiple accounts thing, FWIW. This user was taking clearly malicious actions against millions of consumers of code, in a bait and switch style. GitHub rarely takes action against accounts like that, don't let a sample size of one define them. There are lots of reasons to be annoyed with GitHub but this isn't one of them. As for alternatives, check https://sr.ht https://sr.ht
- mastazi 5y ago> I've never heard of GitHub enforcing the multiple accounts thing, FWIW correct they don't enforce it but they make it such a royal PITA to switch accounts that I eventually gave up trying. They don't have an account switcher like Google etc. > As for alternatives, check https://sr.ht https://sr.ht thank you! Checking it out. Edit: it seems that sr.ht is not self-hosted though? I can see the link to create an account but I can't find instructions on how to install it on my own server.
- Sebb767 5y ago> correct they don't enforce it but they make it such a royal PITA to switch accounts that I eventually gave up trying. If you are ever in need again, Firefox containers are great for this. They also allow you to bundle other corporate accounts, so you don't need any site-dependent switchers at all. > Edit: it seems that sr.ht is not self-hosted though? I can see the link to create an account but I can't find instructions on how to install it on my own server. SourceHut is a SaaS. It's created by a very open source friendly person, though. Self-hosted alternatives are GitLab or Gitea/Gogs, if you are in need of something more lightweight.
- bfung 5y ago* version lock your dependencies. * make a fork of the ones that are really, really important. Proper practices makes this a nothing burger, aside from the mental wellness of the author. I AM saying if you got hit and it mattered, you’re probably not doing things right.
- crawfordcomeaux 5y agoIf corporations don't want to be subjected to the whims of software developers operating freely, they know what they can do. Anyone at any business trying to shame this dev for making an artistic statement through code is telling on themselves in terms of how much they value (or don't value) the freedom of such developers.
- grammarnazzzi 5y agoHe threw away reputation and trust it took years to build for a couple days of negative attention
- foxhop 5y agoHis reputation is growing faster and stronger than ever, this is called activism, free software and code movement.
- junon 5y agoMaintainer of Chalk[0][1] here, a very popular alternative to colors. Happy to help anyone that would like to port away from colors to chalk, or who might just have general questions about terminal colors. Just reply here and I'll see them. [0] https://GitHub.com/chalk/chalk https://GitHub.com/chalk/chalk [1] https://npmjs.org/package/chalk https://npmjs.org/package/chalk
- dimgl 5y agoI love Chalk! I didn't realize it came after colors. Thanks for maintaining this package.
- feupan 5y agoIs a codemod available for anyone who wants to migrate?
- junon 5y agoNot at the moment, but the migration should be pretty straightforward if you don't use the more elaborate color functions from `colors` (e.g. we don't have things like "zebra"). If you use `require('colors/safe')` and only use the basic colors, then Chalk is more or less a drop-in replacement. If you use the property values (e.g. `"my string".green`) then you'll need to change that to `chalk.green("my string")`.
- jwalton 5y agoOne thing worth noting is that chalk 5 is ESM only, so if you’re using commonjs, you’ll need to use chalk 4, or transpire it with Babel, or something…
- peterangular 5y agoI use the hell out of chalk and I just want to say thank you for creating/maintaining a solid product. Seeing this is scary to us who still unfortunately have dependencies with Node/npm. Thank you so much for what you do.
- 5y ago
- malwarebytess 5y ago
- harikb 5y agoI have a related question on how developers should sandbox their dev work from other uses of their computer (banking, email etc). Even though one might vet/vendor dependencies, these (say pining a version) are done closer to production/testing. Developers might be more relaxed updating to newer version for the purpose of vetting them. I am glad VsCode pops up a warning on all new repos - but that kind of warning will often end up getting dismissed because it occurs all too often. Should all dev work happen in VMs? Docker? Where is the web-of-trust solution for dependencies? Where is the notary service for dependencies? This all feels like a ticking bomb to me.
- LAC-Tech 5y agoHow many of these stories do we need to hear before we start treating this problem seriously? I'm not saying never use external libraries. But recognise that each one of them is a potential ticking time bomb. Do you really need it, or is it a nice to have?
- kristjansson 5y agoAll applications should test in two environments. First, the set of packages satisfying stated constraints. Second, against a lockfile consisting of a fixed version for each dep. The first tracks compatibility with the ecosystem, the second verifies the deployable configuration. Valid version sets are manually moved from the first to the second. Upstream failures only break the first.
- StopHammoTime 5y agoThis raises some excellent points about code-ownership. Because I believe they should have at least forked rather than just restore his repo. On the other hand if brother wants to get paid and stop people exploiting his work, maybe don't use the MIT license? There's always AGPL. Of course, as with Elastic, these projects would never get off the ground (in terms of support) without actually using a commercial-compliant license. I'm starting to get sick of developers who release open-source work but then are surprised when people use their work as released. If you want someone to pay you money, ask for money. If they don't want to pay you, do something else. Stop playing games with licensing and taking things down. Is all these people are doing are ruining open source.
- foxhop 5y agoThis is called activism, get used to it, he is not spoiling open source, he is fighting for our freedoms. I applaud him.
- rtpg 5y agoThis sort of stuff is why I'm for larger standard libraries. Design-by-committee issues are one thing, but ultimately each library maintainer having to go out there and sell themselves at this atomized creature, instead of being able to group together resources, means we're paying over and over for base functionality, with the willpower of people with good intentions. This might be controversial, but I feel like the default position should be that every package over a certain number of monthly downloads should be considered as being added to the standard library (along with paying maintainers a stipend and helping integrate into a release process). I think we can have our cake and eat it too on this topic
- hinkley 5y agoThe advantage of 'the' standard library is that I can walk in day one anywhere and get the same behavior, whether I like that behavior or not. Curation doesn't guarantee that I'll ever work two places that use the same one, so there are limits to how helpful that is. Problem is that package-lock.json files in node don't compose. I can't pull in a library that locks other libraries to a specific versions for me. It is possible there's another solution presented by DVCS, but it's not clear to me if it actually avoids the set of problems illustrated here or just dresses them up in different outfits.
- kristopolous 5y agoYou're intrinsically working with thousands of developers with any ecosystem like this; some of which you'd likely never hire in a million years. It is what it is. How would you fix it?
- jdavis703 5y agoIs there any project or organization that forks non-corporate packages and verifies updates? Rouge developers and hackers will continue to be a problem. If such a project doesn’t exist, would you use it? And ultimately would you pay for it?
- shp0ngle 5y agoThis is so dumb. If you don't want fortune 500 corps to use your software, use license like Affero GPL, nobody will touch it. Don't put it in MIT.
- vbezhenar 5y agoOur build tools and overall approaches need to focus on reproducibility, offline builds, bundling of all dependencies (including source code when available) with release artifact. I think that big companies already have it with some tooling, but small companies usually use what's available off the shelf in default configuration and those practices are not very reliable when it comes to rogue dependencies changes.
- deleted 5y ago[deleted]
- balls187 5y agoSo which corporations are leaching off of open source, without contributing back to open source? Why punish the majority of developers who contribute back to open source with patches, bug reports, comments, answers on Stack Overflow, etc?
- oauea 5y agoCrazy how many projects apparently depended on this library without pinning their versions.
- irrational 5y agoI truly don’t understand trusting anything from a package manager. Download the code. Read through it. Then host it on your own server and manually include it. Anything else is pure insanity to me.
- fault1 5y agoThe problem with npm is that you'll have to read a LOT of transitive dependencies. There is a reason why there is a large cottage industry doing security scanning of npm deps. In the end it all depends on who you trust.
- dcow 5y agoI feel like the “smart” move would have been to relicense and “GPL bomb” all the corporations. That would have negatively impacted exactly 0 users but probably caused every software company to actually fork or move to something else like the author originally requested. In the community it would have resulted in much more interesting discussion around software licensing and how to support package maintainers rather than just royally piss everyone off with punk behavior. Kids these days…
- broknbottle 5y agoThis guy again? Last time I seen something posted they were being looked into for bomb making after some kind of fire. https://nypost.com/2020/09/16/resident-of-nyc-home-with-suspected-bomb-making-materials-charged/ https://nypost.com/2020/09/16/resident-of-nyc-home-with-susp... The irony is that the guy was once banned on here for spamming their startup Nodejitsu https://en.m.wikipedia.org/wiki/Nodejitsu https://en.m.wikipedia.org/wiki/Nodejitsu
- deleted 5y ago[deleted]
- tex0 5y agoIMHO the by far most concerning part about this is GitHub blocking the original author.
- lenkite 5y agoI see the license is still the MIT license. Why doesn't this narcissist dev change the license to say: "Companies who do not pay me $1 million shall NOT consume this" ? Why is he still using an open for all consumption license and then complaining that billion dollar companies are leeching him? (After hosting his library on said billion dollar company)
- pictur 5y agohttps://web.archive.org/web/20210628030444/https://marak.com/blog/2021-04-25-monetizing-open-source-is-problematic https://web.archive.org/web/20210628030444/https://marak.com...
- dusted 5y agoIt's his libs, he can do whatever he wants.
- MR4D 5y agoWhy do I have the sneaking suspicion that someone is going to “solve” this with blockchain?
- DarkWiiPlayer 5y agoIt's funny how so many people bitch about "responsibility" or point out that "well, aws & co. are allowed to use the code because loicense" Have any of these keyboard-warriors ever read a FOSS license? There's a huge fucking disclaimer at the bottom in all caps saying "this code does whatever use at your own risk". So what? Is the author bound to the moral implications that their users assume the code actually works, but it's totally okay for amazon to completely disregard the open source ideal of "give and take" because the license technically allows them to?
- r_hoods_ghost 5y agoGood on him. While the foss movement may have started with good intentions its main achievement has been to help accelerate the transfer of wealth from the producers of software to rentiers and parasite capitalists by providing them with a truly vast amount of free labour. Be a radical! Demand to be paid for your work!
- jeffrallen 5y agoDick move borne out of legitimate frustration. Too bad for all involved.
- SergeAx 5y agoBreaking thousands of apps? Good day for authors to learn what that lock file there is for.
- throwaway47292 5y agocreate-react-app has thousands of transient dependencies, being worked on by maybe 40000 developers (possibly more), 1 in 100 people is a sociopath, and 1 in 100 is a psychopath, and looking at the general population around 1 in 100 is a criminal. There is selection bias in the open source community, but still, we can assume when you do `create-react-app` you are going to run the code of ~50 people that don't have your best intentions at heart. Supply chain attacks are one of the best attack vectors. So vet your dependencies and assume them malicious.
- Bolkan 5y agoI would but can't because '^'
- ralferoo 5y agoThe real problem for a spiteful move like this is that it's unlikely to make people want to support his open source work at the risk he'll later destroy it, and companies are unlikely to want to employ him because of fears of him sabotaging the code base if he ever got upset and left on bad terms. I can't really see any positive outcome for him personally on this, although ironically any of the big companies he's talking about are learning the lesson not to trust other people's code updates without auditing. But maybe this will change the mindset in open source package managers that updating to the latest version is always best. The older approach of something like git submodule and sticking with a tried-and-tested version until you make a deliberate choice to update seems much more appealing now.
- tacticaldev 5y agoWhile we don't do this with every package. If a package isn't managed by a team or company, we tend to fork these libraries. if it's critical we at least discuss contributing.
- fraktl 5y agoI'm thinking of an alternative title: "Developer works for free for decades, gets cancelled promptly."
- deleted 5y ago[deleted]
- ChrisMarshallNY 5y agoFor myself, I tend to avoid dependencies that I didn’t write. I use a ton of my own packages. Most of my published work is stuff that I developed for my own consumption. I publish them as standalone projects; complete with tests and documentation. Doing it this way, vastly improves the Quality of my work. It’s a pattern that I have been observing in highly competent engineers, for decades. I make these packages available for others to use, but don’t really care, whether or not they use them (which is good, because very few people use my stuff). I think, in all my projects, I only use four external dependencies, and two of them are in an experimental project (one, being ffmpeg, and the other, a simple built-in Webserver package). A third, is a paid extension, in a “semi-experimental” project (a SOAP library in an ONVIF driver). The fourth, is a keychain wrapper that I use in a couple of projects. It is something I could write, myself, but appreciate not having to. I think I might use VLCLib somewhere, but I'm not sure if I have published it. I know that I played with it, at one time. If I do use an external dependency, I check the code, and the author. I don’t do a full audit, but I make sure that it is well-written and maintainable, in case I need to pin/fork it. If they offer it as paid, I’ll often use that option, unless they are asking a ridiculous amount (in which case, I’ll find another option). The presence of a paid option is generally a sign that the developer is serious about supporting their library. I will check out the author. I tend to look for experience and competence, as general qualities. If I find issues, or have requests, I’ll communicate with the author, through their preferred channel (like GitHub issues). I try to be respectful and polite. I do use a number of StackOverflow-inspired (or other sources) snippets. When I do that, I never use the code directly, but take it apart, and put it back together, in my style. I also reference the source, in my headerdoc comments. I always make sure that I completely understand the code. I only have one project that I authored, “go viral,” and I have turned it over, completely, to a very capable team of folks. I no longer have much to do with the project, and that’s by design. I”m very glad that it took off, as it helps a lot of folks, and I’m extremely grateful to the team that adopted it. I trust them to be good stewards.
- _xnmw 5y agoAlright, time to start committing `node_modules` to my git repo. It'll have the added benefit of reproducible builds.
- machiaweliczny 5y agoHashing of modules is already established practice. So you would be affected by this if you have 0 tests, not even auditing is necessary.
- DominikD 5y agoUnsurprisingly the majority of comments here focus on "how to prevent my free dependencies from breaking" instead of "can we have a systemic way of supporting developers that maintain critical software".
- hinkley 5y agoIt's almost as if showy acts of violence/shock don't engender constructive attention.
- rini17 5y agoHow to approach it? For example, is there some trusted release source for typescript? I tried to install it with npm and was horrified.
- andrepd 5y agoI like this quote from someone, in the article >This trains people not to update, 'coz stuff might break. He says this as if it's a bad thing? Clearly depending on 300 libraries and auto-updating everything is a massive security risk. Also very concerning that the dev's account has been suspended.
- bluegopher2 5y agoWell, you can't make a gift, then demand to be paid if the receiver (unexpectedly) makes money out of it. Better to foresee that offer paid services on top, e.g.: https://raccoon.onyxbits.de/blog/bugreport-free-support/ https://raccoon.onyxbits.de/blog/bugreport-free-support/
- sam_goody 5y agoWhile I disagree with his move. 1.It is totally in his prerogative to mess up the package he manages, but not to install into it malware. I am on the fence if this would count as malware. (Because of the open loop, but my leaning is that this is not malware.) 2. Github is, IMO, breaking any trust that I might have had by assuming control of the package, removing the last commit and keeping it online. If they feel they have a reason to close it, they should. And, they then should fork it and put it up under their own name. Which would generate lots of bad press, but is at least within their rights. 3. I don't quite follow the logic of Github closing his account. Yes, I know that when you use $megacorp they WILL eventually close your account and make you sad. Google did it to me once and shut my gmail account. Tough luck for not being a millionaire. 4. You should always lock your NPM dependencies on a version, and update it when you can see what the results are. 5. Yes, the large corps really should be paying for all the work that is being done to help them, despite their hostile attitudes (being typed on a Mac. Guess who wrote the docs? Not Apple.) 6. Github has some perfectly good competitors, both SaaS (gitlab.com, sourcehut.org) and self-hosted (gitlab, gogs/gitea, etc) Using them empowers you, and removes a wincy bit of leverage from $megacorp. Enough people follow suit, and the world will be a better place. And besides, Copilot won't steal or reveal your code. 7. There are more effective ways of making his point, but he worked out of emotion, not logic. Eg. Perhaps he would have been able to change the license and demand compensation from all non-profits? That would provide both cash and publicity. As a rule, it is always better to act out of logic than emotion, but us humans seem to have an issue with this. ;) 8. Is anyone stepping in to help the author get treatment?
- gnubison 5y ago> Eg. Perhaps he would have been able to change the license and demand compensation from all non-profits? That would provide both cash and publicity. Then everyone would use the old code under the old license and he’d have even less of a chance to get funding.
- dcow 5y agoI pretty much agree with you especially on the point that there are far more effective and nuanced ways to for the maintainer to have made their point, like relicensing (imagine what would happen if the license suddenly became AGPL and everyone at big corps automatically updated without checking the new license—it would be a raucous for both legal and engineering, author could offer a non-gpl version for money and probably rake in more than a 6 figure salary… but I digress). What I find most interesting though are the ethics. The way I interpret (1.) on this comment in the context of this thread (other people have said similar things) is that the community considers the author here to be acting ethically, just annoyingly. When someone submits dubious patches to the linux kernel and wastes everyones time, it’s unethical (kernel maintainers are the victim). When researchers submit dubious CCPA requests to people on and waste peoples time, it’s unethical (webmasters are the victim). However, when a package maintainer throws a temper tantrum and fucks up everyones’ stuff and wastes a bunch of time, they’re in their right to do so and it’s pretty much just annoying but totally okay because the maintainer is the victim of something (either corporate greed or mental health issues, or both). Our society very much puts a premium on protecting victims.
- pcj-github 5y agoGuy with history of mental illness is marking commits as "endgame" and making references to Aaron Schwartz. Hope someone is reaching out with professional help for him, or I fear there will be one final HN post about this story in the near future. I think he has a right to torpedo his own projects, and GitHub should stay out of it. Pin your deps, folks.
- ghoward 5y agoMy thoughts: https://gavinhoward.com/2022/01/the-social-contract-of-open-source/ https://gavinhoward.com/2022/01/the-social-contract-of-open-... . I submitted that link here: https://news.ycombinator.com/item?id=29876749 https://news.ycombinator.com/item?id=29876749
- fold_left 5y agoUsing a lockfile and checking in your dependency tarballs [1] can help insulate you from these problems until you're ready to face them. I created shrinkpack before left-pad and thankfully it meant that we were unaffected. A lot of developers, understandably, baulk at checking in dependencies, but there is a concrete benefit in being able to continue uninterrupted during outages. [1] https://github.com/JamieMason/shrinkpack https://github.com/JamieMason/shrinkpack
- tobyjsullivan 5y agoPreviously: https://news.ycombinator.com/item?id=27252066 https://news.ycombinator.com/item?id=27252066 Archived post: https://web.archive.org/web/20210516172305/https://marak.com/blog/2021-04-25-monetizing-open-source-is-problematic https://web.archive.org/web/20210516172305/https://marak.com...
- iLoveOncall 5y agoIntentionally breaking functionalities of an open source software should be considered hacking and should be prosecuted as such.
- deleted 5y ago[deleted]
- tonoto 5y agoI knew I read about him before here, for good or bad.. https://news.ycombinator.com/item?id=1448309 https://news.ycombinator.com/item?id=1448309
- tomiwa1a 5y agoIn my opinion, the fundamental issue here is that open source software is a [public good][1]. So the paradox which everyone asks themselves is "if everyone can benefit from it for free why should I have to pay?". But conversely, if people are benefitting from something you've created then it's only fair for the person who created this value to get some financial compensation commensurate to the value they've created. The author of this package has chosen a method to get some compensation for their work that has resulted in a lose-lose situation where neither the author nor the users are happy. But it doesn't have to be this way. The [Opensource guide][2] has some useful tips on [Getting Paid for Open Source Work][3]. For people interested in web3 and crypto, [Gitcoin][4] is platform where you can [get paid to work on open source software][5]. Hopefully, by becoming more informed on ways to make money from open source software we can avoid situations like this in the future and create a fairer system that works for everyone. [1]: https://en.wikipedia.org/wiki/Public_good_(economics) https://en.wikipedia.org/wiki/Public_good_(economics) [2]: https://opensource.guide/ https://opensource.guide/ [3]: https://opensource.guide/getting-paid/ https://opensource.guide/getting-paid/ [4]: https://gitcoin.co/ https://gitcoin.co/ [5]: https://gitcoin.co/grants/ https://gitcoin.co/grants/
- tehlike 5y agoWe will see an attack on things like opensea due to supply chain vulnerabilities like this.
- randomswede 5y agoWas the developer doing something "outside what they should be allowed to"? No. It's their package. I would argue that intentionally introducing a breaking change (I would count "go into endless loop" as "no longer performing the same semantic operation") should also be coupled with a "bump major version". Was the developer being an arse? Yes, definitely. Technically and morally correct are two very different things. And doing this sort of thing does have an impact on your reputation I suspect that the dev now have limited at least a few possibly-lucrative jobs down the line.
- gertrunde 5y agoMy own opinion on this: A developer updating their code & packages in whatever way they see fit is their right. Those folk downstream consuming these packages are responsible for policing their supply chain with regard to security/quality/risk. That being said, this is a significantly anti-social move that will (quite rightly) negatively impact their reputation, and the trust placed in them, their code, and the packages derived from their code.
- 5ESS 5y agosay, instead of making the new version of his program cease to function for everybody entirely, he decided that the new version of his program was no longer going to be free, and if users wanted to utilize the newest version they must pay a fee. Say he introduced code instead that checked if a license was purchased for the software, and if so the program works, and if not the program halts. Would this have been considered a "malicious" act as well? Is it wrong these days to charge money for your hard work?
- Shinigami92 5y agofaker.js => https://github.com/faker-js/faker https://github.com/faker-js/faker | npm add -D @faker-js/faker colors.js => https://github.com/microsoft/rushstack/issues/3147#issuecomment-1008262074 https://github.com/microsoft/rushstack/issues/3147#issuecomm...