5 ms·

He didn’t, though. People signed up to a distribution method to run the code and just assumed future updates would be okay. He didn’t push the code to them, the

by jzb 5y ago

He didn’t, though. People signed up to a distribution method to run the code and just assumed future updates would be okay. He didn’t push the code to them, they pulled it.

lolinder 5y ago
He did what he did knowing full well that people would end up downloading and running that code. By your same reasoning you could argue that websites distributing malware aren't pushing viruses to people, people are coming to them and pulling the virus onto their computer.
PragmaticPulp 5y ago
People didn't actively go seek out a new version. He intentionally abused semver to disguise it as a safe update, when it was not. I know it's popular in programming/infosec to blame the victim for trusting anyone, but you can't deny that this it's common behavior among many (though not all) projects to use the caret prefix when specifying dependencies because you trust the package maintainer to honor the semver agreement.
- shepherdjerred 5y ago
  It's his project. It's a free, open-source project. What does the maintainer owe us? Absolutely nothing. > I know it's popular in programming/infosec to blame the victim for trusting anyone, but you can't deny that this it's common behavior among many (though not all) projects to use the caret prefix when specifying dependencies because you trust the package maintainer to honor the semver agreement. Be thankful that all he did was spam the console. It could have been something more malicious. Updating dependencies without auditing source code is a very common practice, but that doesn't mean it's not the victim's fault. It is unrealistic to audit the insane amount of source that our projects are built on, but that is the exact tradeoff that we're making in exchange for the productivity of not building libraries ourselves or paying for those libraries. Open source is something that we're gifted not something that we're owed. If you disagree, then feel free to either use exclusively proprietary software where you can have expectations of the maintainer, or build all of the functionality that you need by yourself.
  - sakarisson 5y ago
    > Be thankful that all he did was spam the console. Why would I be thankful for that? If you slap me, should I be thankful that my nose wasn't broken?
    - baq 5y ago
      Fool me once… etc.
    - jzb 5y ago
      If nothing else, he illustrated a point that many people needed made. They got off cheap - he didn't exfiltrate data, install malware or whatever. He showed that their supply chain is insecure, and that they are trusting way too much in the kindness of unpaid strangers. If your business or development practices depend on pulling a bunch of packages from NPM or other sources un-audited and so forth - especially straight into production! - you need to seriously rethink things. You got off relatively light, this time, if you were impacted by this.
  - afiori 5y ago
    I think that open source developers still owe us not to maliciously run malware on our machines. To be clear they do not owe us to produce good code, or to keep producing code, or to produce the code we want; it is remarkably close to charity giving: the developer/mantainer is donating their work/code to the community. Just like charity you should not give poisoned gifts. The kid that gave homeless people oreos with toothpaste filling wasn't charitably offering food to someone in need, he was maliciously offering them a "poisoned" gift.
    - rakoo 5y ago
      Open source developers don't owe anyone anything. It's this entitlement that has led so many of our fellow people in the community all the way to depression. Stop expecting something when it was explicitly stated that software is provided with no guarantees.
      - 5y ago
- alex_sf 5y ago
  > People didn't actively go seek out a new version. When they set their dependency versions to 'latest', that's exactly what they are doing.
  - fault1 5y ago
    however, I think the more common case is that they set it to the latest bounded by a minor or patch version (as opposed to a major version) as defined by semvar. at least that seems to be quite common in the npm/js world.
- rakoo 5y ago
  > People didn't actively go seek out a new version. Yes, they did. Have you read the article ? That's how npm works: it always pulls the latest version. You can't use tools you don't understand and blame someone else if it doesn't work as you expect it to.
  - PragmaticPulp 5y ago
    > Yes, they did. Have you read the article ? That's how npm works: it always pulls the latest version. No, it pulls the specified version. The affected packages fixed it by removing the leading carpet in the version specifier, which was designed to allow patch version bumps for things like security fixes. He literally abused the versioning system designed to allow security fixes by introducing a breakage and disguising it as a non-breaking change.
- oauea 5y ago
  > People didn't actively go seek out a new version. They did. They chose not to pin their dependency versions, so this is their clear explicit choice. They also chose not to test their dependency updates before pushing it through to their end users, pure negligence by e.g. AWS who was affected by this.
tasha0663 5y ago
There's a thread on the "zalgo" issue on GitHub where he's being a jerk. And he has a sizeable past history of jerkdom. Don't blame the victims that the well was poisoned, blame the jerk who poisoned it. Do I really think he's a jerk? No, I think he's unwell. Previous headlines, lots of conspiracy theory posting recently, now this. He needs help. Do I think this is an attack? We call other exploits attacks. The shoe fits. This was a deliberately hostile act.
- brigandish 5y ago
  > Don't blame the victims that the well was poisoned, blame the jerk who poisoned it. Why are they drinking from someone else's well? Someone with "a sizeable past history of jerkdom"? If you can check the water - nay, if you can copy the water and check it, and create an identical well from that water so that said jerk may never interfere with it again - then the "victims" have no one to blame but themselves. If he had poisoned other people's wells you might have a point. He didn't, in the same way that poisoning the water I keep in my fridge is not an attack on anyone else. Why do you trust the water in my fridge without checking it?
  - anhner 5y ago
    > Why are they drinking from someone else's well? Because the well said "free water". And in some cases it's not even them taking water from that well, but other people who they asked to bring them tea (third party libraries). > Someone with "a sizeable past history of jerkdom"? Do you really dig through the internet history of every maintainer of every package you ever used?
    - krab 5y ago
      In fact, it said "free water without implied fitness for a particular purpose".
    - brigandish 5y ago
      > Do you really dig through the internet history of every maintainer of every package you ever used? No, because that would be impossible but I do try to check the libraries I use to the best of my ability, the same with browser extensions I install. I even read the ingredients on things I buy. Sometimes I read the instructions on drugs I'm prescribed. The perfect is the enemy of the good, after all.

by jzb 5y ago

He didn’t, though. People signed up to a distribution method to run the code and just assumed future updates would be okay. He didn’t push the code to them, they pulled it.

lolinder 5y ago

He did what he did knowing full well that people would end up downloading and running that code. By your same reasoning you could argue that websites distributing malware aren't pushing viruses to people, people are coming to them and pulling the virus onto their computer.

PragmaticPulp 5y ago

People didn't actively go seek out a new version. He intentionally abused semver to disguise it as a safe update, when it was not. I know it's popular in programming/infosec to blame the victim for trusting anyone, but you can't deny that this it's common behavior among many (though not all) projects to use the caret prefix when specifying dependencies because you trust the package maintainer to honor the semver agreement.

shepherdjerred 5y ago
It's his project. It's a free, open-source project. What does the maintainer owe us? Absolutely nothing. > I know it's popular in programming/infosec to blame the victim for trusting anyone, but you can't deny that this it's common behavior among many (though not all) projects to use the caret prefix when specifying dependencies because you trust the package maintainer to honor the semver agreement. Be thankful that all he did was spam the console. It could have been something more malicious. Updating dependencies without auditing source code is a very common practice, but that doesn't mean it's not the victim's fault. It is unrealistic to audit the insane amount of source that our projects are built on, but that is the exact tradeoff that we're making in exchange for the productivity of not building libraries ourselves or paying for those libraries. Open source is something that we're gifted not something that we're owed. If you disagree, then feel free to either use exclusively proprietary software where you can have expectations of the maintainer, or build all of the functionality that you need by yourself.
- sakarisson 5y ago
  > Be thankful that all he did was spam the console. Why would I be thankful for that? If you slap me, should I be thankful that my nose wasn't broken?
  - baq 5y ago
    Fool me once… etc.
  - jzb 5y ago
    If nothing else, he illustrated a point that many people needed made. They got off cheap - he didn't exfiltrate data, install malware or whatever. He showed that their supply chain is insecure, and that they are trusting way too much in the kindness of unpaid strangers. If your business or development practices depend on pulling a bunch of packages from NPM or other sources un-audited and so forth - especially straight into production! - you need to seriously rethink things. You got off relatively light, this time, if you were impacted by this.
- afiori 5y ago
  I think that open source developers still owe us not to maliciously run malware on our machines. To be clear they do not owe us to produce good code, or to keep producing code, or to produce the code we want; it is remarkably close to charity giving: the developer/mantainer is donating their work/code to the community. Just like charity you should not give poisoned gifts. The kid that gave homeless people oreos with toothpaste filling wasn't charitably offering food to someone in need, he was maliciously offering them a "poisoned" gift.
  - rakoo 5y ago
    Open source developers don't owe anyone anything. It's this entitlement that has led so many of our fellow people in the community all the way to depression. Stop expecting something when it was explicitly stated that software is provided with no guarantees.
    - 5y ago
alex_sf 5y ago
> People didn't actively go seek out a new version. When they set their dependency versions to 'latest', that's exactly what they are doing.
- fault1 5y ago
  however, I think the more common case is that they set it to the latest bounded by a minor or patch version (as opposed to a major version) as defined by semvar. at least that seems to be quite common in the npm/js world.
rakoo 5y ago
> People didn't actively go seek out a new version. Yes, they did. Have you read the article ? That's how npm works: it always pulls the latest version. You can't use tools you don't understand and blame someone else if it doesn't work as you expect it to.
- PragmaticPulp 5y ago
  > Yes, they did. Have you read the article ? That's how npm works: it always pulls the latest version. No, it pulls the specified version. The affected packages fixed it by removing the leading carpet in the version specifier, which was designed to allow patch version bumps for things like security fixes. He literally abused the versioning system designed to allow security fixes by introducing a breakage and disguising it as a non-breaking change.
oauea 5y ago
> People didn't actively go seek out a new version. They did. They chose not to pin their dependency versions, so this is their clear explicit choice. They also chose not to test their dependency updates before pushing it through to their end users, pure negligence by e.g. AWS who was affected by this.

tasha0663 5y ago

There's a thread on the "zalgo" issue on GitHub where he's being a jerk. And he has a sizeable past history of jerkdom. Don't blame the victims that the well was poisoned, blame the jerk who poisoned it. Do I really think he's a jerk? No, I think he's unwell. Previous headlines, lots of conspiracy theory posting recently, now this. He needs help. Do I think this is an attack? We call other exploits attacks. The shoe fits. This was a deliberately hostile act.

brigandish 5y ago
> Don't blame the victims that the well was poisoned, blame the jerk who poisoned it. Why are they drinking from someone else's well? Someone with "a sizeable past history of jerkdom"? If you can check the water - nay, if you can copy the water and check it, and create an identical well from that water so that said jerk may never interfere with it again - then the "victims" have no one to blame but themselves. If he had poisoned other people's wells you might have a point. He didn't, in the same way that poisoning the water I keep in my fridge is not an attack on anyone else. Why do you trust the water in my fridge without checking it?
- anhner 5y ago
  > Why are they drinking from someone else's well? Because the well said "free water". And in some cases it's not even them taking water from that well, but other people who they asked to bring them tea (third party libraries). > Someone with "a sizeable past history of jerkdom"? Do you really dig through the internet history of every maintainer of every package you ever used?
  - krab 5y ago
    In fact, it said "free water without implied fitness for a particular purpose".
  - brigandish 5y ago
    > Do you really dig through the internet history of every maintainer of every package you ever used? No, because that would be impossible but I do try to check the libraries I use to the best of my ability, the same with browser extensions I install. I even read the ingredients on things I buy. Sometimes I read the instructions on drugs I'm prescribed. The perfect is the enemy of the good, after all.