3 ms·
Doesn't it seem strange that Snyk is creating a vulnerability report for this + labeling it a DoS? DoS is something someone executes against a target, in this c
by capableweb 5y ago
Doesn't it seem strange that Snyk is creating a vulnerability report for this + labeling it a DoS? DoS is something someone executes against a target, in this case a package had it's functionality (purposefully) altered. That's like calling changing the API of a popular library DoS, because now application authors need to change their code/use a different library...
Fittingly enough, all four solutions for this particular issue all goes back to Snyk, as seen in the bottom of the blog post. Seems like they are labeling this a DoS to justify being able to publish something in their database and blog.
- detaro 5y agoIntroducing a deliberate endless loop is not like changing the API of a library, no.
- capableweb 5y agoBut if the API offered a function called .countBy but then renamed that function to be .countAllBy, now I can't run my application anymore, causing my service to go down if I upgrade the version without testing it, is that a DoS now?
- detaro 5y agono. is it really that complex of a concept that intent of a change matters too, and introducing an endless loop to cause trouble to users is different from a legitimate API change that does a useful thing?
- capableweb 5y agoWho are you to decide what is useful/legitimate or not? As a user of $ExampleLibrary, I surely know best what's useful rather than the maintainer.
- shukantpal 5y ago> Who are you to decide what is useful/legitimate or not? Common sense.
- toomanydoubts 5y agoI think it's safe to say that people who download a data-generation library intended for testing are not looking for infinite loops.
- jtvjan 5y agoNPM expects packages to follow semantic versioning. If a package contained a breaking change like that, there would be a major version bump, and you'd have to upgrade manually. If the maintainers wasn't acting maliciously, they could change this new version to count as a major release, and then it wouldn't be a DoS.
- idbehold 5y agoThis change introduced an infinite loop upon import. It is nothing like changing an identifier which would've provided an error message about where the issue occurred.
- fault1 5y ago> Doesn't it seem strange that Snyk is creating a vulnerability report for this + labeling it a DoS? I think it most definitely falls into "malicious code" that certainly is not done in good faith, and if not handled properly by downstream users, can cause a lot of unexpected problematic failures. Whatever labels are used to characterize this, whether to call it a vulnerability/DoS or not, are just a matter of arguing over semantic meaning.
- forty 5y agoI guess most customers of snyk if not all, are going to be happy that they tagged this as a vulnerability. I'm not sure why they would have done anything differently, seems like exactly why they are paid for (I don't use them and have no relationship with them)
- e1g 5y agoDoS is just Denial of Service - he published a patch update that removes all functionality with specific intent to break the application that uses his code. His action, and this version of the library, is literally an attack on your application and "Denial of Service" is the only goal.