16 ms·

NPM Vulnerability Discussion on Twitter

140 points by ColinWright 5y ago

ColinWright 5y ago
Yes, I know, some of you will hate the layout with a passion. But this kind of diagram is the only way I can make sense of the back'n'forth that sometimes happens. If you prefer Twitter's rendering then just click on a node and that tweet will open for you. Edited to fix a typo ... thank you Jonn. Oh how I hate auto-corrupt.
- tzs 5y ago
  It would greatly help if there were some text in the upper left saying that there is a large diagram on the page but you may have to zoom out or scroll to see it. All that shows up on an iPad at normal zoom is a white page. I waited quite a while thinking maybe it was just generating something client side and that was taking a while before I noticed that there were scroll bars (both vertical and horizontal) on the page and their thumb size indicated I was only seeing a tiny fraction of the page. On my desktop it depends on what I was doing previously. About half the time my browser window won't be big enough for anything to show up in the initial view.
  - ColinWright 5y ago
    I agree completely, but I've tried many times to figure out how to do that, and I've had no luck. I don't have any front-end skillz. If you can tell me how to do it, I'd be grateful. Thanks.
    - tzs 5y ago
      I don't know how you would put some text in an SVG, but if you are OK with linking to an HTML page instead of directly to an SVG maybe just make an HTML page that has a line of text saying that one might need to zoom out or scroll to see the large image below, a line break or paragraph break, and then an image tag referring to the SVG?
      - ColinWright 4y ago
        Working on it ... I have a couple of options, neither perfect, both require some time, but I may be able to do something. Thanks.
        tzs 4y ago
        If you can run a post-processing step on the SVG file before putting it on the server, the following might work. I took a look at the SVG, and although I don't know anything about SVG other than it is an XML format it looks pretty easy to add some text at a given location. The white background seems to come from this: <polygon fill="white" stroke="transparent" points="-4,4 -4,-11651.5 3898,-11651.5 3898,4 -4,4"/> We just need to find that in the SVG, look at the points defining the rectangle, find the left side and the top side from that list of points, then add some text. The left side is the minimum first coordinate in the set of points and the top is the minimum second coordinate in the set of points. That's -4 and -11651.5 in this case. Then we just need to add text there: <text text-anchor="left" x="-4" y="-11637.5" font-family="Times,serif" font-size="14.00">Hello, World!</text> Using the left side for x seems fine. For y using the top results in clipped text because apparently the y for text is the baseline. I don't know how font sizes work in SVG, but it looks like moving the base line down by font-size works nicely. Here's a little Perl script that can be used as a filter that takes your SVG and adds that text line, finding the top and left by looking at the points list in the first polygon line that has fill set to "white" and stroke set to "transparent". #!/usr/bin/env perl use strict; my $left = 0; my $top = 0; while (<>) { print; if (m{<polygon.*fill="white"} && m{stroke="transparent"} && m{points="(.*?)"}) { my @points = split /\s+/, $1; foreach (@points) { my($x, $y) = split /,/; $left = $x if $x < $left; $top = $y if $y < $top; } $top += 14; print qq{<text text-anchor="left" x="$left" y="$top" font-family="Times,serif" font-size="14.00">Hello, World!</text>\n}; last; } } print while (<>);
        ColinWright 4y ago
        Yeah, I've done the post-processing SVG version and it works fine, until the chart itself does have a node near the top left, and then things overlap. So I need to test whether they will overlap, and suddenly it's a bag-o-nails. Or at the least, need to test if something is up there and not both including the extra, but that's ... inelegant. The option of having an HTML template and including the SVG will work, and that's the one I'm probably going to go with. It needs tweaking.
- thinkingemote 5y ago
  I like it. The spatial element gives some pointers towards order in time too. I think ordering by importance (most quoted, replied) takes precedence.
  - zwp 5y ago
    This old dog is reminded of trn(1), "threaded read news". See top right: https://upload.wikimedia.org/wikipedia/commons/d/d8/Trn_console.png https://upload.wikimedia.org/wikipedia/commons/d/d8/Trn_cons...
    - shagie 5y ago
      That does bring back memories... and would be a nice way to visualize Twitter.
- junon 5y ago
  Actually prefer this to Twitter. Easier to read.
  - ColinWright 5y ago
    It is until the discussion gets really big. When there are several hundred tweets there's no good way to layout the graph. Then you need folding, but even then, folding in the 2D environment gives you a much better sense of the discussion.
    - ratww 5y ago
      To be fair, when there are several hundred tweets involved it's even more difficult to to follow on Twitter. Your format is better.
- Zealotux 5y ago
  I enjoy this layout and I only wish it had some sort of check for background color contrast accessibility.
  - ColinWright 5y ago
    Yeah, the colours are a complete hack. There are so many things this needs to make it more usable, but I have neither the time nor the skillz.
- 3np 5y ago
  I don't suppose the source that generated it is available? :)
  - ColinWright 5y ago
    Not yet ... working on a few issues.
- 1970-01-01 5y ago
  I find the diagram very easy to quickly understand everything. Well done! Haters gonna hate no matter what you do.
- skulk 5y ago
  Your algorithm to embed a graph in 2D is intriguing: https://i.imgur.com/7xhl7VY.png https://i.imgur.com/7xhl7VY.png What kind of curve is this?
  - ColinWright 5y ago
    It's just using GraphViz.
- akkartik 5y ago
  What do you think trn/slashdot/HN-style threading is lacking?
  - ColinWright 5y ago
    Any kind of sense of where I am in a discussion. If you find the trn/slashdot/HN-style threading better than the 2D graphical layout then I doubt I can explain to you why I find it (the threading) lacking.
- shabbyrobe 5y ago
  I love this visualisation. Is the script to generate it publicly available?
  - ColinWright 5y ago
    Currently not, there are significant problems that I'm trying to solve before making it available. No, I'm not trying to make it perfect, but I'd like it to be actually usable before opening the code.
baisq 5y ago
The only thing I take away from this is that you should not use custom domains for your email, at least for important stuff.
- 3np 5y ago
  ...or just make sure you keep them under your control...? Losing access to an account at a major mail provider seems more probable than losing control of a domain you paid for.
  - KMnO4 5y ago
    Eh, it happens. I pay over $200/year for my domain + GSuite. It’s a luxury I enjoy, but a luxury nonetheless. If I couldn’t afford that anymore, I’d probably go back to Gmail. I’d probably think to switch over many of my email addresses (for services that I use), but some may slip the cracks when the domain expires.
    - SuperCuber 5y ago
      How much does your domain cost? Most TLDs cost under $20, and GSuite costs like $60 a year... I pay like $60 for domain + mail combined (with fastmail)
      - KMnO4 5y ago
        My last month’s GSuite invoice was $17.63 (CAD). It has definitely increased in price, but it’s still the cheapest unlimited cloud drive. I think the cheaper plan only includes 30GB storage.
- lrvick 5y ago
  I checked the password-reset flows for most major NPM contributors that use regular webmail accounts like Gmail too. < 10% had useful 2FA enabled. Most were just password reset questions or had a backup email to some old expired and re-registerable forgotten earthlink accounts etc. I do this stuff all the time. I looked up the password reset questions controlling the zoom.us domain 2 years ago and collected an insulting $200 bug bounty for it. Zoom, like NPM, didn't do signed binaries, so this would have been brutal combined with other issues I found. The solution is what all sane OS package managers do: code signing. NPM has rejected this at least as far back as 2013 when they refused a PR by someone that implemented it for them: https://github.com/npm/npm/pull/4016 https://github.com/npm/npm/pull/4016 I don't know what else to do but keep publicly trolling them at this point until code signing is implemented. Unsigned code is a free pass for remote code execution when an account gets taken over. Meanwhile Debian maintains hundreds of signed nodejs packages proving it is very doable by a low budget team. NPM seems to just want to reduce deveopler friction at all costs :/
WesolyKubeczek 5y ago
Now I want this to be the default twitter ui so much.
- azemetre 5y ago
  I found it very confusing, is the chart trying to be a timeline?
  - noway421 5y ago
    I think the main thread is on the left with the reply/qt sub-trees on the right. You can only read the first column. I quite like the layout, if there's only 1 main thread that i need to be aware of it's quite nice. This layout probably won't work if there's more than 2 people in a conversation. The layout is actually not that much dissimilar from what twitter already has, just more info from non-main threads and better visibility for orphan leafs.
  - coffeeling 5y ago
    It tries to map the entire tree in one view.
    - ColinWright 5y ago
      At the time the snapshot was taken that was the entire tree, so it doesn't just "try", it succeeds.
  - ColinWright 5y ago
    No. The chart in all forms (there's more than one) shows each tweet as a node, and arrows showing which tweets are replies, and which tweets are "Quote-Tweets". If A->B, then B is a reply to A. In this particular version I've taken the longest thread and laid it out on the left, allowing the other descendants to flow to the right. Another layout is to have the initial tweet at the top and lay it out as a simple tree (technically DiGraph), but that often leaves the top left corner empty, leading people who initially open it to think it's empty and close it without scrolling. Yes, they do, that's happened before here on HN, including in this discussion. Does that help? Are you still confused? It's just a chart showing tweets, quotes, and replies.
BigJono 5y ago
Fixing security issues is nice, how about we go a step further and learn to write a one or two liner instead of inundating every project with 400,000 indirect dependencies?
- bayindirh 5y ago
  No. We must move fast, break things, and trust the network (because it's reliable and all that thing). Implementing your good code with no dependencies is heresy! It's a relic of the past. </rant>. On a serious note, you can implement a lot of things with a standard library of any language, and only time consuming machinery should be incorporated as external dependencies, but somebody didn't get the memo, I guess.
- _fat_santa 5y ago
  I think these packages are just holdovers from "Before ES6". I can see it be reasonable to pull in a package like this back before the functionality was implemented in native JS. All these packages are just holdovers that are only used by: * Legacy Projects that pulled them in way back when and never migrated to the native API's * Inexperienced developers not knowing this is part of standard JS now. You can't really do much about the former. For the latter though, NPM would be wise to plaster a link to MDN's docs on some of these packages.
  - EamonnMR 5y ago
    * Tutorials written in the pre-ES6 world being copied and used in the ES6 world.
  - danlugo92 5y ago
    But "isEven"??? That's one line of code in your utils module...
    - kuschku 5y ago
      In typescript? Sure. In vanilla JS? It’s more complicated. How do you handle someone inputting undefined/null/a string/a random object/NaN/etc? For isEven, you first need isNumber. And that’s where the complexity lies. ({}) % 2 == 0 // false ([]) % 2 == 0 // true "" % 2 == 0 // true "a" % 2 == 0 // false "1" % 2 == 0 // false "2" % 2 == 0 // true undefined % 2 == 0 // false null % 2 == 0 // true
_fat_santa 5y ago
One of the problems I see are the super popular holdover packages before ES6 was standardized on. The tread mentions the `foreach` package. And remembering back, many previous supply chain attacks were on these small packages like: `iseven`, `isodd`, etc. I don't fully understand why packages like this are so popular. My guess is it has to be a combo of legacy projects pulling those deps in and inexperienced developers not knowing that these features are now part of standard JS. While this would cause controversy, I think that NPM should lock all these dependencies down and not allow any modifications. The modules would basically be passthroughs to native ES6 functionality. I'm not saying NPM should lock down all legacy packages, just the ones that implemented ES6 functionality (isBetween, isEven, isOdd, forEach, etc)
- skrebbel 5y ago
  Hahahhahh isBetween, why Compared to that, left-pad is rocket science
  - _fat_santa 5y ago
    Nevermind on that one. I just checked NPM and thankfully that package does not exist.
  - daurnimator 5y ago
    https://github.com/yefremov/isnan https://github.com/yefremov/isnan An entire module for just `return value !== value;`
    - __s 5y ago
      & ofc there's https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Number/isNaN https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...
      - jefftk 5y ago
        Which wasn't everywhere in 2017, when isnan was created: IE11 didn't (and still doesn't, though it's less relevant) have isNaN() (Not supporting a culture of taking a dependency for this sort of thing, though)
flatiron 5y ago
I know PGP isn't perfect but why aren't packages signed by their maintainers?
- franciscop 5y ago
  Overhead, and fear of losing the key and being locked out feels like two valid reasons, I'm sure there are more I'm unaware of (probably should add lack of familiarity, hence the lack of knowledge).
- cordite 5y ago
  Who will check the signatures when so few have signatures? What dev thinks oh I can’t upgrade because of this error, stackoverflow says use this flag —disable-signature-verification so I do and now I can develop again
  - flatiron 5y ago
    Any place with a devops team would not disable that.
  - progval 5y ago
    For what it's worth, Debian packagers check signatures when downloading from PyPI.
- jacques_chester 5y ago
  To my knowledge NPM doesn't currently have a mechanism for signing by authors. Packages are signed by NPM itself on upload, which defends somewhat against repository compromise.
seanwilson 5y ago
> Buy expired NPM maintainer email domains How do people manage selling or changing a domain they've been using long-term as their primary email address for sign-ins like this? To stop a new owner of that domain from taking over accounts sign-ins that use that email address, you'd need to reliably update all your sign-in details with anything you've signed up to? You could use a password manager to track everything you've signed into before to help with this but that's error-prone. Alternatively, this forces you to keep paying for the old domain indefinitely?
- moritonal 5y ago
  Yes, that's exactly what you have to do. There's no way to raze land on the internet.
  - readmorebooks 5y ago
    This also highlights how often developers seem to ignore mortality. When a person expires, soon will their domain registration follow.
krono 5y ago
The chain of trust is a lie, external dependencies are as much a trade-off in security risks as they are in production cost, and your belief in the good intentions of a person/entity does not shield you from their unintentional mistakes or oversights.
aasasd 5y ago
Reminder: when ‘colors’ and ‘faker’ packages printed stuff in the output in an endless loop, NPM and Github banned the author and took over the packages. When ‘node-ipc’ overwrote all files on disk, NPM just waited while the author himself published an amendment and posted that the package ‘only created a text file, no biggie’.
- moss2 5y ago
  - More-nitors 5y ago
    (not op) little things are taken seriously/ serious stuffs are taken lightly
    - misnome 5y ago
      It’s like bikeshedding. It’s easier to deal with the smaller problems.
      - exikyut 5y ago
        A random connection to bikeshedding being mentioned yesterday in a totally unrelated thread: https://news.ycombinator.com/item?id=31315883 https://news.ycombinator.com/item?id=31315883 (interesting comment is the large block of text 3 replies deep) Bit random, but my brain likes linking connections between things. Not sure if useful?
- EGreg 5y ago
  [flagged]
  - cmeacham98 5y ago
    Sorry, but I can't watch your youtube video until it has been thoroughly vetted to the same standard as commits to the linux kernel or peer review in science. As a matter of fact, I'd have to say your video is bad for society. Surely you see how this is a self-defeating argument? Of course higher-stakes projects where inclusion of incorrect or malicious inputs in the end result could have significant impact on a lot of people will have more stringent checking than social media. Is your ideal world really one where all forums of human communication are peer reviewed?
freeqaz 5y ago
This page just shows an empty white page for me on mobile Safari. Is the site down? Does anybody have an archive link?
- ColinWright 5y ago
  Try shrinking it, searching for text, or scrolling. It's a chart, and a small part of the top left corner is empty.
  - freeqaz 5y ago
    Thank you very much!
buzzwords 5y ago
I see a lot of comments here pointing to new/inexperienced developers. As one of those guys, I have to say JS community is not that great at keeping blogs/docs/tutorials up to date. Take react for example the learning section is quite out of date and no one develops using classes anymore.
hyfgfh 5y ago
Non-essential dependencies are for the weak and every single company that I worked for.
imdsm 5y ago
Myles has a good point about public email to account emails being different sometimes (https://twitter.com/MylesBorins/status/1523811989797093376 https://twitter.com/MylesBorins/status/1523811989797093376). There was a way to resolve account usernames to email addresses through a quirk of the user interface up until last year. Fortunately, they're really good with dealing with bug bounties and had it fixed less than week after I reported it. That said, domain based accounts for something like this is still a big vulnerability. Perhaps something akin to the UK OFCOM amateur radio license requirement would work, requiring people to update/confirm their details at least once every five years, or in this case, yearly?
cheshire137 5y ago
The link just loads a blank white page for me on mobile. Would have preferred a direct Twitter link.
- finiteseries 5y ago
  Scroll ~1000 pixels to the right and then zoom out 10x so you can click a node, skip the weird diagram, and just use Twitter.
- ColinWright 5y ago
  As it says elsewhere in this discussion, it's not just a blank white page. Try scrolling. Or searching. Or scaling. There's a chart there, and you can scan the entire thread, or just click on a node to go directly the the tweet you want to see.
darepublic 5y ago
What I would like essentially a curated npm, es and esm modules only and some other rules better vetting packages and their dependencies. At first almost no existing npm packages will be suitable to make the migration but I expect with just a bit of work and automation we can migrate over versions of the behemoths as well. Working with this package manager your builds can be simpler because you only deal with and target es modules. goodbye common js! goodbye leftpad! see you in hell!!
zachrip 5y ago
https://twitter.com/lrvick/status/1523827220023853057 https://twitter.com/lrvick/status/1523827220023853057 If you're trying to protect people, why release an exploit straight to the public instead of responsibly disclosing? Edit: Looks like it's already known, hard to know that from the tweet context.
- progval 5y ago
  It's not a new one. https://news.ycombinator.com/item?id=30403848 https://news.ycombinator.com/item?id=30403848 was exactly the same exploit.
- NicolaiS 5y ago
  The issue has been publicly known for years. The more focus we can get the better - hopefully NPM will add MFA at some point...
Sephr 5y ago
NPM is a shitshow. At one point you could literally take over people's packages by asking the NPM staff nicely. Source: https://twitter.com/sephr/status/1524080664106086400 https://twitter.com/sephr/status/1524080664106086400
- dr-detroit 5y ago
bornfreddy 5y ago
I am starting to think that what we need is package distributions. That is, forked popular packages that are hand-vetted by a group of maintainers, just to make sure that some random malware doesn't find its way into the dependencies. If you want the latest and greatest, or want your custum dependencies checked, you pay. Otherwise it's free. I'm quite sure that the market for this is really big. Does something like this already exist?
- yjftsjthsd-h 5y ago
  That sounds like a Linux distro with the base OS factored out; the only difference between that and, say, Debian, is that Debian is a kernel + core userspace and not just application libraries. I'm not aware of anything quite like that already existing, but OS distros are sufficient prior art for me to think that it could work. EDIT: Actually, there are package managers + package collections that intentionally can be installed on top of an existing OS; nix/nixpkgs and pkgsrc are probably the big ones. I'm not 100% sure that those are what you want today, but it's likely that if you could get maintainers to add your desired packages they'd be accepted there.
  - boarnoah 5y ago
    It also describes software ecosystems like the apache software foundation, dotnet foundation or even just community vetting like PHP has with Tidelift (which is a pretty clever idea on its own) etc...
    - bornfreddy 5y ago
      Yup, I knew I wasn't the first one to see an opportunity here. :) Tidelift sounds great, thank you!
- Ekaros 5y ago
  Isn't that kind of antifactory? Still, that also opens up the question of timely updates to solve possible security vulnerabilities.
getcrunk 5y ago
Is there an easy tool maybe something for ${bundler} to take your package.json and rewrite everything to refer to static versions hosted on your own cdn? At least that way upgrades, malicious or otherwise are opt in for production The other thing would be ideally a crowd funded resource to vet particular versions of popular packages.
- TAForObvReasons 5y ago
  For NPM use https://verdaccio.org/ https://verdaccio.org/ . It can proxy the public registry. Install your project and it will pull and cache the dependencies. Once cached you can remove the uplink and it will only serve the cached version

140 points by ColinWright 5y ago

Yes, I know, some of you will hate the layout with a passion. But this kind of diagram is the only way I can make sense of the back'n'forth that sometimes happens. If you prefer Twitter's rendering then just click on a node and that tweet will open for you. Edited to fix a typo ... thank you Jonn. Oh how I hate auto-corrupt.

tzs 5y ago
It would greatly help if there were some text in the upper left saying that there is a large diagram on the page but you may have to zoom out or scroll to see it. All that shows up on an iPad at normal zoom is a white page. I waited quite a while thinking maybe it was just generating something client side and that was taking a while before I noticed that there were scroll bars (both vertical and horizontal) on the page and their thumb size indicated I was only seeing a tiny fraction of the page. On my desktop it depends on what I was doing previously. About half the time my browser window won't be big enough for anything to show up in the initial view.
- ColinWright 5y ago
  I agree completely, but I've tried many times to figure out how to do that, and I've had no luck. I don't have any front-end skillz. If you can tell me how to do it, I'd be grateful. Thanks.
  - tzs 5y ago
    I don't know how you would put some text in an SVG, but if you are OK with linking to an HTML page instead of directly to an SVG maybe just make an HTML page that has a line of text saying that one might need to zoom out or scroll to see the large image below, a line break or paragraph break, and then an image tag referring to the SVG?
    - ColinWright 4y ago
      Working on it ... I have a couple of options, neither perfect, both require some time, but I may be able to do something. Thanks.
      - tzs 4y ago
        If you can run a post-processing step on the SVG file before putting it on the server, the following might work. I took a look at the SVG, and although I don't know anything about SVG other than it is an XML format it looks pretty easy to add some text at a given location. The white background seems to come from this: <polygon fill="white" stroke="transparent" points="-4,4 -4,-11651.5 3898,-11651.5 3898,4 -4,4"/> We just need to find that in the SVG, look at the points defining the rectangle, find the left side and the top side from that list of points, then add some text. The left side is the minimum first coordinate in the set of points and the top is the minimum second coordinate in the set of points. That's -4 and -11651.5 in this case. Then we just need to add text there: <text text-anchor="left" x="-4" y="-11637.5" font-family="Times,serif" font-size="14.00">Hello, World!</text> Using the left side for x seems fine. For y using the top results in clipped text because apparently the y for text is the baseline. I don't know how font sizes work in SVG, but it looks like moving the base line down by font-size works nicely. Here's a little Perl script that can be used as a filter that takes your SVG and adds that text line, finding the top and left by looking at the points list in the first polygon line that has fill set to "white" and stroke set to "transparent". #!/usr/bin/env perl use strict; my $left = 0; my $top = 0; while (<>) { print; if (m{<polygon.*fill="white"} && m{stroke="transparent"} && m{points="(.*?)"}) { my @points = split /\s+/, $1; foreach (@points) { my($x, $y) = split /,/; $left = $x if $x < $left; $top = $y if $y < $top; } $top += 14; print qq{<text text-anchor="left" x="$left" y="$top" font-family="Times,serif" font-size="14.00">Hello, World!</text>\n}; last; } } print while (<>);
        ColinWright 4y ago
        Yeah, I've done the post-processing SVG version and it works fine, until the chart itself does have a node near the top left, and then things overlap. So I need to test whether they will overlap, and suddenly it's a bag-o-nails. Or at the least, need to test if something is up there and not both including the extra, but that's ... inelegant. The option of having an HTML template and including the SVG will work, and that's the one I'm probably going to go with. It needs tweaking.
thinkingemote 5y ago
I like it. The spatial element gives some pointers towards order in time too. I think ordering by importance (most quoted, replied) takes precedence.
- zwp 5y ago
  This old dog is reminded of trn(1), "threaded read news". See top right: https://upload.wikimedia.org/wikipedia/commons/d/d8/Trn_console.png https://upload.wikimedia.org/wikipedia/commons/d/d8/Trn_cons...
  - shagie 5y ago
    That does bring back memories... and would be a nice way to visualize Twitter.
junon 5y ago
Actually prefer this to Twitter. Easier to read.
- ColinWright 5y ago
  It is until the discussion gets really big. When there are several hundred tweets there's no good way to layout the graph. Then you need folding, but even then, folding in the 2D environment gives you a much better sense of the discussion.
  - ratww 5y ago
    To be fair, when there are several hundred tweets involved it's even more difficult to to follow on Twitter. Your format is better.
Zealotux 5y ago
I enjoy this layout and I only wish it had some sort of check for background color contrast accessibility.
- ColinWright 5y ago
  Yeah, the colours are a complete hack. There are so many things this needs to make it more usable, but I have neither the time nor the skillz.
3np 5y ago
I don't suppose the source that generated it is available? :)
- ColinWright 5y ago
  Not yet ... working on a few issues.
1970-01-01 5y ago
I find the diagram very easy to quickly understand everything. Well done! Haters gonna hate no matter what you do.
skulk 5y ago
Your algorithm to embed a graph in 2D is intriguing: https://i.imgur.com/7xhl7VY.png https://i.imgur.com/7xhl7VY.png What kind of curve is this?
- ColinWright 5y ago
  It's just using GraphViz.
akkartik 5y ago
What do you think trn/slashdot/HN-style threading is lacking?
- ColinWright 5y ago
  Any kind of sense of where I am in a discussion. If you find the trn/slashdot/HN-style threading better than the 2D graphical layout then I doubt I can explain to you why I find it (the threading) lacking.
shabbyrobe 5y ago
I love this visualisation. Is the script to generate it publicly available?
- ColinWright 5y ago
  Currently not, there are significant problems that I'm trying to solve before making it available. No, I'm not trying to make it perfect, but I'd like it to be actually usable before opening the code.

baisq 5y ago

The only thing I take away from this is that you should not use custom domains for your email, at least for important stuff.

3np 5y ago
...or just make sure you keep them under your control...? Losing access to an account at a major mail provider seems more probable than losing control of a domain you paid for.
- KMnO4 5y ago
  Eh, it happens. I pay over $200/year for my domain + GSuite. It’s a luxury I enjoy, but a luxury nonetheless. If I couldn’t afford that anymore, I’d probably go back to Gmail. I’d probably think to switch over many of my email addresses (for services that I use), but some may slip the cracks when the domain expires.
  - SuperCuber 5y ago
    How much does your domain cost? Most TLDs cost under $20, and GSuite costs like $60 a year... I pay like $60 for domain + mail combined (with fastmail)
    - KMnO4 5y ago
      My last month’s GSuite invoice was $17.63 (CAD). It has definitely increased in price, but it’s still the cheapest unlimited cloud drive. I think the cheaper plan only includes 30GB storage.
lrvick 5y ago
I checked the password-reset flows for most major NPM contributors that use regular webmail accounts like Gmail too. < 10% had useful 2FA enabled. Most were just password reset questions or had a backup email to some old expired and re-registerable forgotten earthlink accounts etc. I do this stuff all the time. I looked up the password reset questions controlling the zoom.us domain 2 years ago and collected an insulting $200 bug bounty for it. Zoom, like NPM, didn't do signed binaries, so this would have been brutal combined with other issues I found. The solution is what all sane OS package managers do: code signing. NPM has rejected this at least as far back as 2013 when they refused a PR by someone that implemented it for them: https://github.com/npm/npm/pull/4016 https://github.com/npm/npm/pull/4016 I don't know what else to do but keep publicly trolling them at this point until code signing is implemented. Unsigned code is a free pass for remote code execution when an account gets taken over. Meanwhile Debian maintains hundreds of signed nodejs packages proving it is very doable by a low budget team. NPM seems to just want to reduce deveopler friction at all costs :/

WesolyKubeczek 5y ago

Now I want this to be the default twitter ui so much.

azemetre 5y ago
I found it very confusing, is the chart trying to be a timeline?
- noway421 5y ago
  I think the main thread is on the left with the reply/qt sub-trees on the right. You can only read the first column. I quite like the layout, if there's only 1 main thread that i need to be aware of it's quite nice. This layout probably won't work if there's more than 2 people in a conversation. The layout is actually not that much dissimilar from what twitter already has, just more info from non-main threads and better visibility for orphan leafs.
- coffeeling 5y ago
  It tries to map the entire tree in one view.
  - ColinWright 5y ago
    At the time the snapshot was taken that was the entire tree, so it doesn't just "try", it succeeds.
- ColinWright 5y ago
  No. The chart in all forms (there's more than one) shows each tweet as a node, and arrows showing which tweets are replies, and which tweets are "Quote-Tweets". If A->B, then B is a reply to A. In this particular version I've taken the longest thread and laid it out on the left, allowing the other descendants to flow to the right. Another layout is to have the initial tweet at the top and lay it out as a simple tree (technically DiGraph), but that often leaves the top left corner empty, leading people who initially open it to think it's empty and close it without scrolling. Yes, they do, that's happened before here on HN, including in this discussion. Does that help? Are you still confused? It's just a chart showing tweets, quotes, and replies.

BigJono 5y ago

Fixing security issues is nice, how about we go a step further and learn to write a one or two liner instead of inundating every project with 400,000 indirect dependencies?

bayindirh 5y ago
No. We must move fast, break things, and trust the network (because it's reliable and all that thing). Implementing your good code with no dependencies is heresy! It's a relic of the past. </rant>. On a serious note, you can implement a lot of things with a standard library of any language, and only time consuming machinery should be incorporated as external dependencies, but somebody didn't get the memo, I guess.
_fat_santa 5y ago
I think these packages are just holdovers from "Before ES6". I can see it be reasonable to pull in a package like this back before the functionality was implemented in native JS. All these packages are just holdovers that are only used by: * Legacy Projects that pulled them in way back when and never migrated to the native API's * Inexperienced developers not knowing this is part of standard JS now. You can't really do much about the former. For the latter though, NPM would be wise to plaster a link to MDN's docs on some of these packages.
- EamonnMR 5y ago
  * Tutorials written in the pre-ES6 world being copied and used in the ES6 world.
- danlugo92 5y ago
  But "isEven"??? That's one line of code in your utils module...
  - kuschku 5y ago
    In typescript? Sure. In vanilla JS? It’s more complicated. How do you handle someone inputting undefined/null/a string/a random object/NaN/etc? For isEven, you first need isNumber. And that’s where the complexity lies. ({}) % 2 == 0 // false ([]) % 2 == 0 // true "" % 2 == 0 // true "a" % 2 == 0 // false "1" % 2 == 0 // false "2" % 2 == 0 // true undefined % 2 == 0 // false null % 2 == 0 // true

_fat_santa 5y ago

One of the problems I see are the super popular holdover packages before ES6 was standardized on. The tread mentions the `foreach` package. And remembering back, many previous supply chain attacks were on these small packages like: `iseven`, `isodd`, etc. I don't fully understand why packages like this are so popular. My guess is it has to be a combo of legacy projects pulling those deps in and inexperienced developers not knowing that these features are now part of standard JS. While this would cause controversy, I think that NPM should lock all these dependencies down and not allow any modifications. The modules would basically be passthroughs to native ES6 functionality. I'm not saying NPM should lock down all legacy packages, just the ones that implemented ES6 functionality (isBetween, isEven, isOdd, forEach, etc)

skrebbel 5y ago
Hahahhahh isBetween, why Compared to that, left-pad is rocket science
- _fat_santa 5y ago
  Nevermind on that one. I just checked NPM and thankfully that package does not exist.
- daurnimator 5y ago
  https://github.com/yefremov/isnan https://github.com/yefremov/isnan An entire module for just `return value !== value;`
  - __s 5y ago
    & ofc there's https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Number/isNaN https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...
    - jefftk 5y ago
      Which wasn't everywhere in 2017, when isnan was created: IE11 didn't (and still doesn't, though it's less relevant) have isNaN() (Not supporting a culture of taking a dependency for this sort of thing, though)

flatiron 5y ago

I know PGP isn't perfect but why aren't packages signed by their maintainers?

franciscop 5y ago
Overhead, and fear of losing the key and being locked out feels like two valid reasons, I'm sure there are more I'm unaware of (probably should add lack of familiarity, hence the lack of knowledge).
cordite 5y ago
Who will check the signatures when so few have signatures? What dev thinks oh I can’t upgrade because of this error, stackoverflow says use this flag —disable-signature-verification so I do and now I can develop again
- flatiron 5y ago
  Any place with a devops team would not disable that.
- progval 5y ago
  For what it's worth, Debian packagers check signatures when downloading from PyPI.
jacques_chester 5y ago
To my knowledge NPM doesn't currently have a mechanism for signing by authors. Packages are signed by NPM itself on upload, which defends somewhat against repository compromise.

seanwilson 5y ago

> Buy expired NPM maintainer email domains How do people manage selling or changing a domain they've been using long-term as their primary email address for sign-ins like this? To stop a new owner of that domain from taking over accounts sign-ins that use that email address, you'd need to reliably update all your sign-in details with anything you've signed up to? You could use a password manager to track everything you've signed into before to help with this but that's error-prone. Alternatively, this forces you to keep paying for the old domain indefinitely?

moritonal 5y ago
Yes, that's exactly what you have to do. There's no way to raze land on the internet.
- readmorebooks 5y ago
  This also highlights how often developers seem to ignore mortality. When a person expires, soon will their domain registration follow.

krono 5y ago

The chain of trust is a lie, external dependencies are as much a trade-off in security risks as they are in production cost, and your belief in the good intentions of a person/entity does not shield you from their unintentional mistakes or oversights.

aasasd 5y ago

Reminder: when ‘colors’ and ‘faker’ packages printed stuff in the output in an endless loop, NPM and Github banned the author and took over the packages. When ‘node-ipc’ overwrote all files on disk, NPM just waited while the author himself published an amendment and posted that the package ‘only created a text file, no biggie’.

moss2 5y ago
- More-nitors 5y ago
  (not op) little things are taken seriously/ serious stuffs are taken lightly
  - misnome 5y ago
    It’s like bikeshedding. It’s easier to deal with the smaller problems.
    - exikyut 5y ago
      A random connection to bikeshedding being mentioned yesterday in a totally unrelated thread: https://news.ycombinator.com/item?id=31315883 https://news.ycombinator.com/item?id=31315883 (interesting comment is the large block of text 3 replies deep) Bit random, but my brain likes linking connections between things. Not sure if useful?
EGreg 5y ago
[flagged]
- cmeacham98 5y ago
  Sorry, but I can't watch your youtube video until it has been thoroughly vetted to the same standard as commits to the linux kernel or peer review in science. As a matter of fact, I'd have to say your video is bad for society. Surely you see how this is a self-defeating argument? Of course higher-stakes projects where inclusion of incorrect or malicious inputs in the end result could have significant impact on a lot of people will have more stringent checking than social media. Is your ideal world really one where all forums of human communication are peer reviewed?

freeqaz 5y ago

This page just shows an empty white page for me on mobile Safari. Is the site down? Does anybody have an archive link?

ColinWright 5y ago
Try shrinking it, searching for text, or scrolling. It's a chart, and a small part of the top left corner is empty.
- freeqaz 5y ago
  Thank you very much!

buzzwords 5y ago

I see a lot of comments here pointing to new/inexperienced developers. As one of those guys, I have to say JS community is not that great at keeping blogs/docs/tutorials up to date. Take react for example the learning section is quite out of date and no one develops using classes anymore.

hyfgfh 5y ago

Non-essential dependencies are for the weak and every single company that I worked for.

imdsm 5y ago

Myles has a good point about public email to account emails being different sometimes (https://twitter.com/MylesBorins/status/1523811989797093376 https://twitter.com/MylesBorins/status/1523811989797093376). There was a way to resolve account usernames to email addresses through a quirk of the user interface up until last year. Fortunately, they're really good with dealing with bug bounties and had it fixed less than week after I reported it. That said, domain based accounts for something like this is still a big vulnerability. Perhaps something akin to the UK OFCOM amateur radio license requirement would work, requiring people to update/confirm their details at least once every five years, or in this case, yearly?

cheshire137 5y ago

The link just loads a blank white page for me on mobile. Would have preferred a direct Twitter link.

finiteseries 5y ago
Scroll ~1000 pixels to the right and then zoom out 10x so you can click a node, skip the weird diagram, and just use Twitter.
ColinWright 5y ago
As it says elsewhere in this discussion, it's not just a blank white page. Try scrolling. Or searching. Or scaling. There's a chart there, and you can scan the entire thread, or just click on a node to go directly the the tweet you want to see.

darepublic 5y ago

What I would like essentially a curated npm, es and esm modules only and some other rules better vetting packages and their dependencies. At first almost no existing npm packages will be suitable to make the migration but I expect with just a bit of work and automation we can migrate over versions of the behemoths as well. Working with this package manager your builds can be simpler because you only deal with and target es modules. goodbye common js! goodbye leftpad! see you in hell!!

zachrip 5y ago

https://twitter.com/lrvick/status/1523827220023853057 https://twitter.com/lrvick/status/1523827220023853057 If you're trying to protect people, why release an exploit straight to the public instead of responsibly disclosing? Edit: Looks like it's already known, hard to know that from the tweet context.

progval 5y ago
It's not a new one. https://news.ycombinator.com/item?id=30403848 https://news.ycombinator.com/item?id=30403848 was exactly the same exploit.
NicolaiS 5y ago
The issue has been publicly known for years. The more focus we can get the better - hopefully NPM will add MFA at some point...

Sephr 5y ago

NPM is a shitshow. At one point you could literally take over people's packages by asking the NPM staff nicely. Source: https://twitter.com/sephr/status/1524080664106086400 https://twitter.com/sephr/status/1524080664106086400

dr-detroit 5y ago

bornfreddy 5y ago

I am starting to think that what we need is package distributions. That is, forked popular packages that are hand-vetted by a group of maintainers, just to make sure that some random malware doesn't find its way into the dependencies. If you want the latest and greatest, or want your custum dependencies checked, you pay. Otherwise it's free. I'm quite sure that the market for this is really big. Does something like this already exist?

yjftsjthsd-h 5y ago
That sounds like a Linux distro with the base OS factored out; the only difference between that and, say, Debian, is that Debian is a kernel + core userspace and not just application libraries. I'm not aware of anything quite like that already existing, but OS distros are sufficient prior art for me to think that it could work. EDIT: Actually, there are package managers + package collections that intentionally can be installed on top of an existing OS; nix/nixpkgs and pkgsrc are probably the big ones. I'm not 100% sure that those are what you want today, but it's likely that if you could get maintainers to add your desired packages they'd be accepted there.
- boarnoah 5y ago
  It also describes software ecosystems like the apache software foundation, dotnet foundation or even just community vetting like PHP has with Tidelift (which is a pretty clever idea on its own) etc...
  - bornfreddy 5y ago
    Yup, I knew I wasn't the first one to see an opportunity here. :) Tidelift sounds great, thank you!
Ekaros 5y ago
Isn't that kind of antifactory? Still, that also opens up the question of timely updates to solve possible security vulnerabilities.

getcrunk 5y ago

Is there an easy tool maybe something for ${bundler} to take your package.json and rewrite everything to refer to static versions hosted on your own cdn? At least that way upgrades, malicious or otherwise are opt in for production The other thing would be ideally a crowd funded resource to vet particular versions of popular packages.

TAForObvReasons 5y ago
For NPM use https://verdaccio.org/ https://verdaccio.org/ . It can proxy the public registry. Install your project and it will pull and cache the dependencies. Once cached you can remove the uplink and it will only serve the cached version