4 ms·
is it his right? to sabotage downstream code in revenge for not being paid for work he willingly took on knowing full well that he may never be paid? legality
by naikrovek 5y ago
is it his right? to sabotage downstream code in revenge for not being paid for work he willingly took on knowing full well that he may never be paid?
legality is defined at the behest of societal needs. if society says something legal should be made illegal, or vice versa, then it will be.
GitHub/Microsoft chose to do the right thing for the society in the short term. in the long term, choosing a less stupid library update policy will benefit everyone AND let authors do all the "non-harmful" malevolent stuff they want.
as if this wasn't a single-point denial of service attack...
we are slowly (far too slowly) learning that our assumptions that all developers are benevolent is incorrect, and it's going to take another 2-5 instances of this kind of attack before people really start to understand why and see the danger of simply using libraries at all; especially in ecosystems like NPM where almost no one writes a single line of code on their own if it can instead be pulled in as a library dependency. this attitude is the exact opposite of a secure code approach and until people learn this, and learn it well, this kind of attack will continue, and the time between the attacks will gradually shorten.
- xvector 5y agoShould your users have control over the code you publish under your name? Because that is the precedent we are setting here.
- fault1 5y agoDid he own this code? Colors.js had plenty of other contributors, and there was no CLA involved. github user "DABH" actually had more lines of code than marak did: https://github.com/Marak/colors.js/graphs/contributors https://github.com/Marak/colors.js/graphs/contributors npm and github both have terms of service that you agree to when you choose to distribute something over those systems. npm in particular has had a long policy of unrolling malicious changes to the registry of packages ever since left-pad.
- yifanl 5y agoIf the responsibility lies with the maintainer, then the responsibility lies with the maintainer.
- heavyset_go 5y ago> to sabotage downstream code in revenge for not being paid for work he willingly took on knowing full well that he may never be paid? Some consumers of his project chose to use his 3rd party dependency in their code for free knowing full well that it could disappear or break at any time, and yet they still chose not to mitigate those risks they chose to take on.
- naikrovek 5y agoyes, that is the other half of the coin: don't run code if you don't know what it does. an extreme version of that: don't use libraries at all. I am trending more and more to this extreme as I age, because people aren't learning their lesson, and the npm ecosystem keeps biting them over and over...
- chaostheory 5y ago"we are slowly (far too slowly) learning that our assumptions that all developers are benevolent is incorrect, and it's going to take another 2-5 instances of this kind of attack before people really start to understand why and see the danger of simply using libraries at all" I agree, but at the same time if we had this mindset earlier; open source probably wouldn't have caught on as quickly. Maybe it wouldn't have become mainstream?
- seoaeu 5y agoHonestly, it is kind of surprising we've gotten this far assuming that basically all open source maintainers aren't malicious
- raesene9 5y agoUnfortunately I don't think that 2-5 instances of this will produce any change. We've seen more than that number of actual malicious package takeovers in the last couple of years and it has produced basically no real change. heck I did a talk describing this kind of attack 6 years ago and I found prior instances when researching that talk...