5 ms·

Also: when ‘colors’ and ‘faker’ packages printed stuff in the output in an endless loop, NPM and Github banned the author and took over the packages. When ‘nod

by aasasd 5y ago

Also: when ‘colors’ and ‘faker’ packages printed stuff in the output in an endless loop, NPM and Github banned the author and took over the packages. When ‘node-ipc’ overwrote all files on disk, NPM just waited while the author himself published an amendment and posted that the package ‘only created a text file, no biggie’.

Aeolun 5y ago
Because the first time was about money, and the second time was about ethics?
- aasasd 5y ago
  If you really think that in security of open-source people should tolerate a malware attack because the author says ‘oh, I'm fighting those Russians’, then I sure hope I'll never have to use any of your software.
- SpicyLemonZest 5y ago
  I’m very sympathetic to the attacker here, but I can’t imagine an argument for why there’s an ethical obligation to delete random Russian users’ files, much less why that duty should outweigh the NPM project’s general duty of good stewardship.
  - Aeolun 5y ago
    I’m not suggesting it’s right. Just speculating on what makes it different.
  - kistaro 5y ago
    Because there is an obligation to stop the war by any means available. Since Putin will not stop voluntarily, he must be rendered unable to continue. Every possible tool to drain the resources and undermine the tenuous stability of Russia is necessary and appropriate. War sucks for civilians. It sucks less for the civilians who get some files deleted than for the civilians who get their houses shelled by Russian and Belarusian artillery. Does the NPM project have a general duty of good stewardship? Of course. Does the NPM project have a duty to interfere with a developer who chooses to increase the misery and pressure applied to a nation that has been committed to a path of an unjust war of aggression, which is deliberately bombing civilians? Fuck no.
    - dixie_land 5y ago
    - ensan 5y ago
      "Since Putin will not stop voluntarily, he must be rendered unable to continue." Regardless of one's positions on the Ukraine war, I don't see how manipulating node packages could, for example, stop a Russian hypersonic missile or fortify Ukrainian barracks. By the way, if you look at the damage to Ukraine's infrastructure and human capital, it has already lost the war. Also evident by repeated calls from Zelensky to resume negotiations. He badly miscalculated from the start...
    - SpicyLemonZest 5y ago
      I don't agree with the premise that every tool is appropriate and I struggle to believe you do either. If your boss told you that you need to work unpaid until further notice because they're donating everyone's salary to Ukraine, you wouldn't object to that? You wouldn't have concerns if you came home one day to find your stuff on the curb because your landlord wanted to make room for refugees? A lot of tools are appropriate that wouldn't be appropriate for most international disputes, but when you're fortunate enough to not be in the warzone, you can't go crazy and start smashing random people's root directories.
emilfihlman 5y ago
This is a really important thing to bring up.
yyyk 5y ago
It's difficult to trust NPM after node-ipc. After all, it's pretty close to a software eqivalent of warcrime. Imagine a hospital used node-ipc and got its files deleted.
- hutzlibu 5y ago
  I really hope no hospital did use node and npm to store important medical information or on critical systems. But if they did, people might die for real, if suddenly important information about patients is gone or manipulated. Or a important operation had to be canceled because of it. How can one critizise bombings of hospitals and then potentially do the same on a software level?
  - kistaro 5y ago
    Oh no, indeed, how could someone possibly object to killing civilians in cold blood with the full military force of an arguably-developed nation, while themselves committing such horrible crimes as - gasp! - deleting files? patterns of bits have human rights too! Get over yourself.
    - jlkuester7 5y ago
      > patterns of bits have human rights too! I think the main concern of the OP was with _human_ collateral damage that can result from the deleted bits. Having worked for years in EMRs, I can definitely say that sustained IT outages in modern hospital systems can and often do lead to increased deaths.
      - kistaro 5y ago
        Other things that lead to increased deaths: the Russian military intentionally bombing civilians. I usually oppose “whataboutism” but I can’t bring myself to do it here. This is a war where the nation of Russia has decided to murder Ukrainians. Means to interfere with Russia’s blood-soaked campaign must be viewed not in isolation, but in the context of what they are attempting to stop. To be clear, I am not making a general purpose “the end justifies the means” argument. I am making a narrow and specific “the circumstances justify extreme behavior with severe externalities” argument.

by aasasd 5y ago

Aeolun 5y ago

Because the first time was about money, and the second time was about ethics?

aasasd 5y ago
If you really think that in security of open-source people should tolerate a malware attack because the author says ‘oh, I'm fighting those Russians’, then I sure hope I'll never have to use any of your software.
SpicyLemonZest 5y ago
I’m very sympathetic to the attacker here, but I can’t imagine an argument for why there’s an ethical obligation to delete random Russian users’ files, much less why that duty should outweigh the NPM project’s general duty of good stewardship.
- Aeolun 5y ago
  I’m not suggesting it’s right. Just speculating on what makes it different.
- kistaro 5y ago
  Because there is an obligation to stop the war by any means available. Since Putin will not stop voluntarily, he must be rendered unable to continue. Every possible tool to drain the resources and undermine the tenuous stability of Russia is necessary and appropriate. War sucks for civilians. It sucks less for the civilians who get some files deleted than for the civilians who get their houses shelled by Russian and Belarusian artillery. Does the NPM project have a general duty of good stewardship? Of course. Does the NPM project have a duty to interfere with a developer who chooses to increase the misery and pressure applied to a nation that has been committed to a path of an unjust war of aggression, which is deliberately bombing civilians? Fuck no.
  - dixie_land 5y ago
  - ensan 5y ago
    "Since Putin will not stop voluntarily, he must be rendered unable to continue." Regardless of one's positions on the Ukraine war, I don't see how manipulating node packages could, for example, stop a Russian hypersonic missile or fortify Ukrainian barracks. By the way, if you look at the damage to Ukraine's infrastructure and human capital, it has already lost the war. Also evident by repeated calls from Zelensky to resume negotiations. He badly miscalculated from the start...
  - SpicyLemonZest 5y ago
    I don't agree with the premise that every tool is appropriate and I struggle to believe you do either. If your boss told you that you need to work unpaid until further notice because they're donating everyone's salary to Ukraine, you wouldn't object to that? You wouldn't have concerns if you came home one day to find your stuff on the curb because your landlord wanted to make room for refugees? A lot of tools are appropriate that wouldn't be appropriate for most international disputes, but when you're fortunate enough to not be in the warzone, you can't go crazy and start smashing random people's root directories.

emilfihlman 5y ago

This is a really important thing to bring up.

yyyk 5y ago

It's difficult to trust NPM after node-ipc. After all, it's pretty close to a software eqivalent of warcrime. Imagine a hospital used node-ipc and got its files deleted.

hutzlibu 5y ago
I really hope no hospital did use node and npm to store important medical information or on critical systems. But if they did, people might die for real, if suddenly important information about patients is gone or manipulated. Or a important operation had to be canceled because of it. How can one critizise bombings of hospitals and then potentially do the same on a software level?
- kistaro 5y ago
  Oh no, indeed, how could someone possibly object to killing civilians in cold blood with the full military force of an arguably-developed nation, while themselves committing such horrible crimes as - gasp! - deleting files? patterns of bits have human rights too! Get over yourself.
  - jlkuester7 5y ago
    > patterns of bits have human rights too! I think the main concern of the OP was with _human_ collateral damage that can result from the deleted bits. Having worked for years in EMRs, I can definitely say that sustained IT outages in modern hospital systems can and often do lead to increased deaths.
    - kistaro 5y ago
      Other things that lead to increased deaths: the Russian military intentionally bombing civilians. I usually oppose “whataboutism” but I can’t bring myself to do it here. This is a war where the nation of Russia has decided to murder Ukrainians. Means to interfere with Russia’s blood-soaked campaign must be viewed not in isolation, but in the context of what they are attempting to stop. To be clear, I am not making a general purpose “the end justifies the means” argument. I am making a narrow and specific “the circumstances justify extreme behavior with severe externalities” argument.