3 ms·

I even agree with the message but we must keep this out of open source or we're going to lose all of it because nobody will be able to trust it and use of open

I even agree with the message but we must keep this out of open source or we're going to lose all of it because nobody will be able to trust it and use of open source will immediately fail certifications. This is wells poisoning, all of them.

88913527 5y ago
Why should I trust open source today? Packages are routinely hacked, political message or not. I 100% agree this has no place in open source but (1) people subject to the effects of war aren't in most sound state of mind and (2) "npm install" is arbitrarily running pre- and post- hook commands that can do all sorts of fun things on your machine. This commit looks harmless in comparison to packages looking for wallets and AWS credentials. OSS is used not because it's safe or secure, but because the benefits outweigh the costs.
- hda2 5y ago
  > Why should I trust open source today? Packages are routinely hacked, political message or not. Correction: NPM packages are routinely hacked. I've been using linux packages for two decades, and not once have they been hacked (to my knowledge). I consider those packages to be infinity more secure than proprietary packages where I and others can't check what's running under the hood. OSS being safe and secure is one of the primary reasons why I prefer open source to closed source software.
  - 88913527 5y ago
    Anecdotally, I agree because it's difficult to find much on linux package distribution hacks. But there is this: https://lwn.net/Articles/295406/ https://lwn.net/Articles/295406/ I guess I wonder where you draw the line, and if this sort of incident is acceptable, why, and is the line being drawn arbitrary.
  - johnny22 5y ago
    and typo name hijacks in other language specific repos
throw_m239339 5y ago
> I even agree with the message but we must keep this out of open source or we're going to lose all of it because nobody will be able to trust it and use of open source will immediately fail certifications. This is wells poisoning, all of them. There are deeper issues with NPM: how many developers review or audit any packages they download anymore cause each time they pull a single package, it comes with 3000+ dependencies? I'm being hyperbolic, but "open source" isn't the issue here. What certification are you even talking about if developers themselves can't be bothered to audit their 3000+ NPM dependencies at first place? It's too much work cause too much dependencies? Well that's the architecture NPM chose. I don't have that issue with Go, PHP or Java package management oddly...
- maxloh 5y ago
  Agree with this. Open source is not the problem, but running code written by a random guy without fixed version and without auditing between upgrades is.
tremon 5y ago
Correction: no one should have been trusting it for years already. There's very obvious supply-chain vulnerabilities in pretty much all open source developer repositories. And that's by design: npm, pypi, rubygems, cpan etc are developer resources. Nobody should have been deploying them unseen to production. Ever. If you want trust, use a (Linux) distribution as intermediary.
michaelmrose 5y ago
If they want something they can trust they ought to pay for it. If rich companies feel like they can no longer afford to mooch off people working for almost nothing and have to write their own libraries tell me what of value will be lost? I mean do you hang out in your kitchen hoping that Bezos will come by your house to borrow a cup of sugar?

88913527 5y ago

Why should I trust open source today? Packages are routinely hacked, political message or not. I 100% agree this has no place in open source but (1) people subject to the effects of war aren't in most sound state of mind and (2) "npm install" is arbitrarily running pre- and post- hook commands that can do all sorts of fun things on your machine. This commit looks harmless in comparison to packages looking for wallets and AWS credentials. OSS is used not because it's safe or secure, but because the benefits outweigh the costs.

hda2 5y ago
> Why should I trust open source today? Packages are routinely hacked, political message or not. Correction: NPM packages are routinely hacked. I've been using linux packages for two decades, and not once have they been hacked (to my knowledge). I consider those packages to be infinity more secure than proprietary packages where I and others can't check what's running under the hood. OSS being safe and secure is one of the primary reasons why I prefer open source to closed source software.
- 88913527 5y ago
  Anecdotally, I agree because it's difficult to find much on linux package distribution hacks. But there is this: https://lwn.net/Articles/295406/ https://lwn.net/Articles/295406/ I guess I wonder where you draw the line, and if this sort of incident is acceptable, why, and is the line being drawn arbitrary.
- johnny22 5y ago
  and typo name hijacks in other language specific repos

throw_m239339 5y ago

> I even agree with the message but we must keep this out of open source or we're going to lose all of it because nobody will be able to trust it and use of open source will immediately fail certifications. This is wells poisoning, all of them. There are deeper issues with NPM: how many developers review or audit any packages they download anymore cause each time they pull a single package, it comes with 3000+ dependencies? I'm being hyperbolic, but "open source" isn't the issue here. What certification are you even talking about if developers themselves can't be bothered to audit their 3000+ NPM dependencies at first place? It's too much work cause too much dependencies? Well that's the architecture NPM chose. I don't have that issue with Go, PHP or Java package management oddly...

maxloh 5y ago
Agree with this. Open source is not the problem, but running code written by a random guy without fixed version and without auditing between upgrades is.

tremon 5y ago

Correction: no one should have been trusting it for years already. There's very obvious supply-chain vulnerabilities in pretty much all open source developer repositories. And that's by design: npm, pypi, rubygems, cpan etc are developer resources. Nobody should have been deploying them unseen to production. Ever. If you want trust, use a (Linux) distribution as intermediary.

michaelmrose 5y ago

If they want something they can trust they ought to pay for it. If rich companies feel like they can no longer afford to mooch off people working for almost nothing and have to write their own libraries tell me what of value will be lost? I mean do you hang out in your kitchen hoping that Bezos will come by your house to borrow a cup of sugar?