3 ms·
I think it would have been fine if that code had stayed in a separate branch, or a separate repository. You can create a repo and put all the silly print statem
by remram 5y ago
I think it would have been fine if that code had stayed in a separate branch, or a separate repository. You can create a repo and put all the silly print statements and infinite loops you want, and Microsoft will leave you alone.
If you mount a supply-chain attack, deliberately overwriting a package you know people are relying on with code that will break their systems, that is something else.
Maybe GitHub should have frozen only this one repo, though I doubt that would have made a difference in the public response. But you can't really say that they banned someone's private little experiment here.
As to the power you cede to Microsoft, that is a weird way to phrase it. Microsoft gave you the right to use their platform, for free. All they did is take that away. That is not much power at all.
- GauntletWizard 5y agoI want to point out my latest example of a supply chain attack that's going on all the time: GitHub Actions GitHub Actions uses tags to represent it's versions, which would be great if GitHub locked down tags. They don't. Every GitHub Action I encountered in my first foray into the technology a couple weeks ago included a "Publish" script - that as it's first action, deleted a tag! And then reused that tag. This is absolutely a supply chain attack, if not a malicious one.
- remram 5y agoYeah I feel uneasy about using third-party GitHub actions. I suppose you could use `action@<hash>` syntax instead of a tag... At least actions are usually self-contained, you don't have the same problem of transitive dependencies you have in npm.