5 ms·

> This is career suicide Unlikely. > undermines the ecosystem due to the loss of trust. Good, that trust was always misplaced. At least it’s only Russia and

by rosndo 5y ago

> This is career suicide Unlikely. > undermines the ecosystem due to the loss of trust. Good, that trust was always misplaced. At least it’s only Russia and Belarus getting screwed instead of everybody getting hit by ransomware.

deleted 5y ago
[deleted]
bastijn 5y ago
I actually agree this is destroying your credibility as an author and caused me to search all projects author is involved in and blacklist them. * Despite the motive for the act there is actual malicious code injected in a library without notifying or disclosing any information. * The whole act was not well thought out. The check is rudimentary to put it gently, or plain naive to say it straight. Not only Russians are targeted but also anyone having vpns or other legitimate reasons to run under Russian IPs. Finally the check is crude and might as well fail at some point, with devastating effect. * Author seems to be removing github issues, hiding conversations and doing damage control now that this backfires.
- rosndo 5y ago
  > I actually agree this is destroying your credibility as an author and caused me to search all projects author is involved in and blacklist them. “FOSS developer” is hardly a career. Nobody is losing out on income by you blacklisting their projects.
  - ahelwer 5y ago
    Lots of FOSS developers support themselves with lucrative jobs or contracts they received on the basis of their reputation within the FOSS community (conference circuit, online forums, professional network, etc.) and otherwise mainly develop for the clout. Social consequences can be very effective in this way. It isn't quite like being blackballed but you really can't piss too many people off before those contracts start disappearing. Network effects work in reverse too.
- deleted 5y ago
  [deleted]
inopinatus 5y ago
Wow that is naive. Geolocation by IP address is notoriously error-prone. The most obvious is former Soviet republics, or any neighbour of a target nation, being mis-identified. That includes Ukraine itself, by the way, but also Finland and Poland. How about territory that is disputed? Or adjacent to enclaves like Kaliningrad? But it can also include friendly-nation assets that just happen to be currently inside Russia or Belarus, including government entities and journalists. It can affect folks simply relying on mobile networks near borders. Address blocks are routinely reallocated, reassigned, reused, misused, on a global basis and an address range announced in Korea last year can show up in Canada tomorrow. Even geolocation by client-side request can be wrong, too. Not just because it's easy to lie, but major nations also fuck with the GPS, which is an issue currently affecting Baltic aviation¹. By the same token, IP geolocation databases are easily misled by self-reporting from mobile devices. Simple example: imagine someone using a dedicated VPS in the US as a personal VPN exit node for their devices when visiting mainland China (actually, we don't have to imagine: I did exactly this). Any IP-based location assumptions start out incorrect, since it's by VPN exit IP; but later on, thanks to mobile device reporting, that IP address can end up misclassified long-term as "Chinese". None of this is hypothetical. I visited Jordan a few years ago and whilst visiting ruins near Umm Qais, up by the Sea of Galilee, my phone was switching to Israeli networks. I also know of an Australian startup that was mis-identified as Russian and lost access to a major partner API². That's since resolved, but the point is, forget what you see on police procedurals; identifying the political jurisdiction of a device, whether it's by IP address or any other means, remains an art, not a science, and it's incredibly easy to be wrong. As for the suggestion that the rest of us remain unaffected; any malware incident in the node ecosystem requires immediate attention and audit from every security team, whether you were the intended target or not. This idiot has cost all of us time and energy. [1] https://www.theguardian.com/world/2022/mar/09/finland-gps-disturbances-aircrafts-russia https://www.theguardian.com/world/2022/mar/09/finland-gps-di... [2] https://twitter.com/cyclytics/status/1503211938133966851 https://twitter.com/cyclytics/status/1503211938133966851
- rosndo 5y ago
  > As for the suggestion that the rest of us remain unaffected; any malware incident in the node ecosystem requires immediate attention and audit from every security team, whether you were the intended target or not. This idiot has cost all of us time and energy. The truth is that you are the idiot if you only perform audits when someone else announces an incident. You’ve already lost at that point. It’s nobody else’s fault but yours if you waste time because of your shit policies. But go on, keep digging an ever deeper hole for yourself with pathetic attempts at shifting blame. It’s absolutely your security teams job to audit all incoming code, rather than blindly trusting stuff from NPM.

by rosndo 5y ago

deleted 5y ago

[deleted]

bastijn 5y ago

I actually agree this is destroying your credibility as an author and caused me to search all projects author is involved in and blacklist them. * Despite the motive for the act there is actual malicious code injected in a library without notifying or disclosing any information. * The whole act was not well thought out. The check is rudimentary to put it gently, or plain naive to say it straight. Not only Russians are targeted but also anyone having vpns or other legitimate reasons to run under Russian IPs. Finally the check is crude and might as well fail at some point, with devastating effect. * Author seems to be removing github issues, hiding conversations and doing damage control now that this backfires.

rosndo 5y ago
> I actually agree this is destroying your credibility as an author and caused me to search all projects author is involved in and blacklist them. “FOSS developer” is hardly a career. Nobody is losing out on income by you blacklisting their projects.
- ahelwer 5y ago
  Lots of FOSS developers support themselves with lucrative jobs or contracts they received on the basis of their reputation within the FOSS community (conference circuit, online forums, professional network, etc.) and otherwise mainly develop for the clout. Social consequences can be very effective in this way. It isn't quite like being blackballed but you really can't piss too many people off before those contracts start disappearing. Network effects work in reverse too.
deleted 5y ago
[deleted]

inopinatus 5y ago

Wow that is naive. Geolocation by IP address is notoriously error-prone. The most obvious is former Soviet republics, or any neighbour of a target nation, being mis-identified. That includes Ukraine itself, by the way, but also Finland and Poland. How about territory that is disputed? Or adjacent to enclaves like Kaliningrad? But it can also include friendly-nation assets that just happen to be currently inside Russia or Belarus, including government entities and journalists. It can affect folks simply relying on mobile networks near borders. Address blocks are routinely reallocated, reassigned, reused, misused, on a global basis and an address range announced in Korea last year can show up in Canada tomorrow. Even geolocation by client-side request can be wrong, too. Not just because it's easy to lie, but major nations also fuck with the GPS, which is an issue currently affecting Baltic aviation¹. By the same token, IP geolocation databases are easily misled by self-reporting from mobile devices. Simple example: imagine someone using a dedicated VPS in the US as a personal VPN exit node for their devices when visiting mainland China (actually, we don't have to imagine: I did exactly this). Any IP-based location assumptions start out incorrect, since it's by VPN exit IP; but later on, thanks to mobile device reporting, that IP address can end up misclassified long-term as "Chinese". None of this is hypothetical. I visited Jordan a few years ago and whilst visiting ruins near Umm Qais, up by the Sea of Galilee, my phone was switching to Israeli networks. I also know of an Australian startup that was mis-identified as Russian and lost access to a major partner API². That's since resolved, but the point is, forget what you see on police procedurals; identifying the political jurisdiction of a device, whether it's by IP address or any other means, remains an art, not a science, and it's incredibly easy to be wrong. As for the suggestion that the rest of us remain unaffected; any malware incident in the node ecosystem requires immediate attention and audit from every security team, whether you were the intended target or not. This idiot has cost all of us time and energy. [1] https://www.theguardian.com/world/2022/mar/09/finland-gps-disturbances-aircrafts-russia https://www.theguardian.com/world/2022/mar/09/finland-gps-di... [2] https://twitter.com/cyclytics/status/1503211938133966851 https://twitter.com/cyclytics/status/1503211938133966851

rosndo 5y ago
> As for the suggestion that the rest of us remain unaffected; any malware incident in the node ecosystem requires immediate attention and audit from every security team, whether you were the intended target or not. This idiot has cost all of us time and energy. The truth is that you are the idiot if you only perform audits when someone else announces an incident. You’ve already lost at that point. It’s nobody else’s fault but yours if you waste time because of your shit policies. But go on, keep digging an ever deeper hole for yourself with pathetic attempts at shifting blame. It’s absolutely your security teams job to audit all incoming code, rather than blindly trusting stuff from NPM.