8 ms·
Anyone putting malware in their packages needs to have repo deleted from GitHub, npm and blocked from further submissions to open source code. Once you have bet
by randomhodler84 5y ago
Anyone putting malware in their packages needs to have repo deleted from GitHub, npm and blocked from further submissions to open source code. Once you have betrayed peoples trust, you need to GTFO.
Open source code bases are not the place for your slacktivist rants. They hurt innocent people. You cannot booby trap your house. All this does is destroys confidence in the ecosystem.
- teawrecks 5y agoYour argument assumes the malicious submitter is honest about their identity online. We can't assume that. Instead, we have to assume that all source, regardless or how "open" it is, could be malicious. Only once it has been properly audited by the many eyes of the community should we consider placing any trust in it. If people had confidence in the ecosystem because they thought they could blindly trust code from random strangers, then it was misplaced to begin with.
- randomhodler84 5y agoI agree with you there, however reality is that you may have one of these packages in your build, on your system, just through merit of using something else in the js ecosystem. We are never going to have a vetted set of dependencies. It will forever remain a mess as long as the platform and ecosystem exist. At best we can be reactive and kick bad actors out of the picture.
- 8note 5y agoRealistically, you shouldn't have confidence in the ecosystem, and you should be verifying the dependency changes that you accept. The more these types of things happen, the better the users of open source will be
- octopoc 5y agoThis is about nodejs packages. You can pick two: 1. Verify nodejs dependencies every time they change 2. Be productive 3. Keep your sanity
- rosndo 5y agoWhy is open source special? Or are you against all the economic sanctions on Russia also? Do you oppose businesses pulling out of Russia despite not being legally required to do so? > They hurt innocent people. You cannot booby trap your house. All this does is destroys confidence in the ecosystem. You could say this regarding all the economic sanctions on Russia too, but it’s a very weak criticism.
- deleted 5y ago[deleted]
- randomhodler84 5y agoThis has nothing to do with any of that, and you are trying to change the goalposts. Guy writes malware, malware hurts peoples systems. Where they are is irrelevant.
- stuxneteer 5y agoWhy is “malware” so special to you? Guy writes sanctions, sanctions hurt people. Guy writes tweets at companies insisting they should pull out of Russia, companies pull out of Russia, people are hurt. What’s the big difference here? What is it about “malware” that necessitates special treatment?
- _Algernon_ 5y agoSanctions hit Russia, while malware hits people outside Russia for one. It's even less targeted than economic sanctions.
- stuxneteer 5y agoSanctions hit people outside of Russia. Russian visas and mastercards stopped working abroad regardless of the cardholders nationality. Many businesses outside of Russia are also severely impacted. Malware can be just as targeted as economic sanctions. The node-ipc “malware” certainly was.
- polski-g 5y agoWell they'd be in prison for many years for knowingly creating and distributing a virus. So your wish is already a reality.