4 ms·

What damage did they cause?

by deadbunny 5y ago

wtallis 5y ago
Do you really expect anyone to believe that you're asking that in good faith?
- deadbunny 5y ago
  Hey you're the one stating they caused damage. They printed some zaglo strings. Hard to see how that damages anything other than making a few CI jobs fail.
  - shukantpal 5y ago
    It isn't necessary the package was used in CI jobs only and not production servers.
    - deadbunny 5y ago
      Then that's on them for not pinning dependencies. You know, ops 101. Play silly games, win silly prizes.
      - shukantpal 5y ago
        Thanks for stating the obvious. It isn't silly at all to publish malware and vaporize your reputation, right?; maybe it was good after all, people will become careful.
        CRConrad 5y ago
        Maybe he wanted libraries that printed blather in an infinite loop. Then it can't be "malware" to put that in his own repositories. If other people don't want that, then they shouldn't pull from his repositories. If they do that anyway, then that's their own fault. Nobody forced them to.
        shukantpal 5y ago
        That's a foolish hypothetical to construct; however, I don't have to refute it. That's because the author themselves said in this case, that the reason to submit the malware was to give a "fuck you" to the big corps.
        CRConrad 5y ago
        > the author themselves said in this case, that the reason to submit the malware was to give a "fuck you" to the big corps. Yeah, so obviously he did want libraries that give a "fuck you" to the big corps (by printing blather in an infinite loop). Then it still can't be "malware" to put that in his own repositories. And my point still stands: If other people -- you, big corps, whoever -- don't want that, then they shouldn't pull from his repositories. If they do that anyway, then that's still just as much their own fault. Because, still, nobody forced them to.
  - viro 5y ago
    It broke hoobs and crashes its security camera plugins. Most people would consider that pretty heavy damage.
    - deadbunny 5y ago
      Good to know not to use that software then.
      - viro 5y ago
        if you want to use non-homekit devices with homekit you kind of have to.
        CRConrad 5y ago
        "Kind of" is doing some pretty heavy lifting there. No, you don't "have to"; you're perfectly free to write your own software in stead. Or even just use a prior version of his code that does what you want it to, in stead of blindly updating to one that doesn't. He didn't force you (or the writers of whatever software you're using) to update, now did he?
    - pritambaral 5y ago
      Was the author aware that "hoobs and its security camera plugins" were going to break from this push? Or any prod servers, for that matter? I see no code in there that checks if it is running in production. In fact, it is a reasonable expectation that people don't throw code into production blindly, but rather test any changes out first.
      - viro 5y ago
        malware is malware. You don't have a right to change ur software to malware. "wElL yOu ShOuLd HaVe Tested" no you shouldn't push software in bad faith designed to crash apps that use it.
        pritambaral 5y ago
Dma54rhs 5y ago
Broke cli tools (firebase for me), computer crashed because of some weird infinite loop out of memory error that I wasn't able to recover from. Anyway good wake up call not relaying on million of deps for npm works hopefully.
- CRConrad 5y ago
  No, you broke your CLI tools. By unthinkingly pulling in stuff from someone else's repository without vetting it. Or using other tools which did, which amounts to the same thing. Good that you woke up to that.
viro 5y ago
It crashes the servers that use the package?
- esarbe 5y ago
  So what? He didn't force anyone to update to the new version, right? So how is it his problem? Some other entity had to go and update the version they depend on. And if you now say "well, that happens automatically", I say; suites them right. They should have tested the stuff. Not his problem.
  - viro 5y ago
    Are you arguing that most malware should be legal because the user downloaded it and ran it?
    - esarbe 5y ago
      Malware is legal. You can study and research and even build malware without doing anything illegal. What one usually gets in trouble for is causing destruction. Regarding this case; wherever they ran in to problems, they probably should thank him for exposing that serious flaw in their release process.

What damage did they cause?

wtallis 5y ago

Do you really expect anyone to believe that you're asking that in good faith?

deadbunny 5y ago
Hey you're the one stating they caused damage. They printed some zaglo strings. Hard to see how that damages anything other than making a few CI jobs fail.
- shukantpal 5y ago
  It isn't necessary the package was used in CI jobs only and not production servers.
  - deadbunny 5y ago
    Then that's on them for not pinning dependencies. You know, ops 101. Play silly games, win silly prizes.
    - shukantpal 5y ago
      Thanks for stating the obvious. It isn't silly at all to publish malware and vaporize your reputation, right?; maybe it was good after all, people will become careful.
      - CRConrad 5y ago
        Maybe he wanted libraries that printed blather in an infinite loop. Then it can't be "malware" to put that in his own repositories. If other people don't want that, then they shouldn't pull from his repositories. If they do that anyway, then that's their own fault. Nobody forced them to.
        shukantpal 5y ago
        That's a foolish hypothetical to construct; however, I don't have to refute it. That's because the author themselves said in this case, that the reason to submit the malware was to give a "fuck you" to the big corps.
        CRConrad 5y ago
        > the author themselves said in this case, that the reason to submit the malware was to give a "fuck you" to the big corps. Yeah, so obviously he did want libraries that give a "fuck you" to the big corps (by printing blather in an infinite loop). Then it still can't be "malware" to put that in his own repositories. And my point still stands: If other people -- you, big corps, whoever -- don't want that, then they shouldn't pull from his repositories. If they do that anyway, then that's still just as much their own fault. Because, still, nobody forced them to.
- viro 5y ago
  It broke hoobs and crashes its security camera plugins. Most people would consider that pretty heavy damage.
  - deadbunny 5y ago
    Good to know not to use that software then.
    - viro 5y ago
      if you want to use non-homekit devices with homekit you kind of have to.
      - CRConrad 5y ago
        "Kind of" is doing some pretty heavy lifting there. No, you don't "have to"; you're perfectly free to write your own software in stead. Or even just use a prior version of his code that does what you want it to, in stead of blindly updating to one that doesn't. He didn't force you (or the writers of whatever software you're using) to update, now did he?
  - pritambaral 5y ago
    Was the author aware that "hoobs and its security camera plugins" were going to break from this push? Or any prod servers, for that matter? I see no code in there that checks if it is running in production. In fact, it is a reasonable expectation that people don't throw code into production blindly, but rather test any changes out first.
    - viro 5y ago
      malware is malware. You don't have a right to change ur software to malware. "wElL yOu ShOuLd HaVe Tested" no you shouldn't push software in bad faith designed to crash apps that use it.
      - pritambaral 5y ago

Dma54rhs 5y ago

Broke cli tools (firebase for me), computer crashed because of some weird infinite loop out of memory error that I wasn't able to recover from. Anyway good wake up call not relaying on million of deps for npm works hopefully.

CRConrad 5y ago
No, you broke your CLI tools. By unthinkingly pulling in stuff from someone else's repository without vetting it. Or using other tools which did, which amounts to the same thing. Good that you woke up to that.

viro 5y ago

It crashes the servers that use the package?

esarbe 5y ago
So what? He didn't force anyone to update to the new version, right? So how is it his problem? Some other entity had to go and update the version they depend on. And if you now say "well, that happens automatically", I say; suites them right. They should have tested the stuff. Not his problem.
- viro 5y ago
  Are you arguing that most malware should be legal because the user downloaded it and ran it?
  - esarbe 5y ago
    Malware is legal. You can study and research and even build malware without doing anything illegal. What one usually gets in trouble for is causing destruction. Regarding this case; wherever they ran in to problems, they probably should thank him for exposing that serious flaw in their release process.