7 ms·

Reminder: when ‘colors’ and ‘faker’ packages printed stuff in the output in an endless loop, NPM and Github banned the author and took over the packages. When

by aasasd 4y ago

Reminder: when ‘colors’ and ‘faker’ packages printed stuff in the output in an endless loop, NPM and Github banned the author and took over the packages. When ‘node-ipc’ overwrote all files on disk, NPM just waited while the author himself published an amendment and posted that the package ‘only created a text file, no biggie’.

moss2 4y ago
- More-nitors 4y ago
  (not op) little things are taken seriously/ serious stuffs are taken lightly
  - misnome 4y ago
    It’s like bikeshedding. It’s easier to deal with the smaller problems.
    - exikyut 4y ago
      A random connection to bikeshedding being mentioned yesterday in a totally unrelated thread: https://news.ycombinator.com/item?id=31315883 https://news.ycombinator.com/item?id=31315883 (interesting comment is the large block of text 3 replies deep) Bit random, but my brain likes linking connections between things. Not sure if useful?
EGreg 4y ago
[flagged]
- cmeacham98 4y ago
  Sorry, but I can't watch your youtube video until it has been thoroughly vetted to the same standard as commits to the linux kernel or peer review in science. As a matter of fact, I'd have to say your video is bad for society. Surely you see how this is a self-defeating argument? Of course higher-stakes projects where inclusion of incorrect or malicious inputs in the end result could have significant impact on a lot of people will have more stringent checking than social media. Is your ideal world really one where all forums of human communication are peer reviewed?
  - MetaWhirledPeas 4y ago
    What YouTube video? I haven't read that comment yet; still awaiting results from the Online Content Vetting Foundation. Yours flew through the process though. Congrats! In all seriousness though, I do agree somewhat with the GP. Inherent vetting can be good. But it's also a tool used against us for manipulation. An example of this would be app stores. Heavily vetted, but you are force fed the apps they want you to see, and they have every right to deny you access to apps they find undesirable. We need systems of reputation and trust to emerge, as they always have, and we need the freedom to choose them. Tools like Twitter allow largely unvetted content, sure, but they also allow users to curate their own circle of trust. This comes with risks of course, but I trust it more than some omniscient entity handing me content like mana from heaven.
    - EGreg 4y ago
      That’s because they are vetted by ONE organization, that privately owns the store. It is actually an example of private capitalist ownership, again. In science, no one “owns” physics. No one “owns” articles on wikipedia. The ideal is to have multiple reviews represented and all of their major legitimate concerns should be addressed before publishing something to the public. Think of concentric circles where the inner circle isn’t just Apple or Google but a good mix of experts with different views. The hard part is resolving disputes between experts, or determining if a criticism is legitimate. This is what “edit wars” are like on wikipedia. Perhaps in this case, both points of view should be included side by side. In a capitalist market system, though, explaining nuances of WHY Trump’s or Biden’s administration did something, or including the entire context of a gaffe video, would make it uninteresting to their audience. Imagine if Fox News would fairly report the results of studies about single payer healthcare around the world - their audence would bounce. They face intense market pressures to cater to their audience, this is WHY they report as they do and WHY they tell their straight news anchors to “rein it in”. The one exception may be Tucker Carlson over there, who is able to somehow maintain a show while going against the entire military-industrial complex and establishment, unlike Sean Hannity. It is a rare phenomenon to see someone with such a highly promoted time slot have such a contrarian position. But if it sells to an audience, I guess it works. CNN totally jumped the shark when they discovered they can cover the malaysian airline flight for months 24/7 and their ratings went up. They went from being a straight news network to pandering for ratings too. None of the open source platforms or wikipedia would sell out like that.
- serial_dev 4y ago
  > We should treat things like operating systems do: have collaborative security assessments for each package BEFORE it is published. This would not work for small open source projects, and every successful open source project starts out as a small project that nobody vetted yet. I have smaller, but popular open source packages that I know are used by many people,and most of those projects (even now, after a year being public) get zero actual contributions. If my most popular packages don't receive pull requests, how would I find a trustworthy expert committee to judge all my other silly little packages for free? Also, why would I make the projects I work for fun and for free purposefully a painful, sluggish, bureaucratic experience for everyone involved?
  - EGreg 4y ago
    It's a matter of scale, as I said :) At some point, projects have to bring in more "adult supervision"
infamouscow 4y ago
Vendor and audit your dependencies. You shouldn't rely on GitHub to protect you from security problems.
- mort96 4y ago
  While I agree in principle, that usually means you'll 1) frequently blindly update all your dependencies, which doesn't really give you much security benefit, or 2) use old dependencies long after security vulnerabilities have been discovered in them. The first point does give you some security benefits by reducing the chance that you'll hear about a malicious package before you upgrade to it, but it's not exactly great. I don't know what the solution is. I don't think there is a solution. We can't have 5000 dependencies from 2000 random individuals on the internet and still be safe. But if you want to avoid that situation, you're locking yourself out of the vast majority of the NPM ecosystem.
  - infamouscow 4y ago
    Maybe the ecosystem needs to discourage unnecessary packages imports.
darepublic 4y ago
faker was a disease that I fought against in the places where I was unfortunate enough to inherit it in the codebase. lots of devs not knowing better thinking it really made our tests more robust -- it didn't, in fact, just more flaky. also faker's functionality can easily be shimmed or rolled yourself if you want to. I will continue the fight, there are many other super popular npm packages whose value is dubious at best, cause dependency tooling headaches, and are like viruses in the web ecosystem. and the fact this faker guy sabotaged his own package is great because even before that I was against it, and now it is just easier to convince people not to import this clown lib
deleted 4y ago
[deleted]

by aasasd 4y ago

moss2 4y ago

More-nitors 4y ago
(not op) little things are taken seriously/ serious stuffs are taken lightly
- misnome 4y ago
  It’s like bikeshedding. It’s easier to deal with the smaller problems.
  - exikyut 4y ago
    A random connection to bikeshedding being mentioned yesterday in a totally unrelated thread: https://news.ycombinator.com/item?id=31315883 https://news.ycombinator.com/item?id=31315883 (interesting comment is the large block of text 3 replies deep) Bit random, but my brain likes linking connections between things. Not sure if useful?

EGreg 4y ago

[flagged]

cmeacham98 4y ago
Sorry, but I can't watch your youtube video until it has been thoroughly vetted to the same standard as commits to the linux kernel or peer review in science. As a matter of fact, I'd have to say your video is bad for society. Surely you see how this is a self-defeating argument? Of course higher-stakes projects where inclusion of incorrect or malicious inputs in the end result could have significant impact on a lot of people will have more stringent checking than social media. Is your ideal world really one where all forums of human communication are peer reviewed?
- MetaWhirledPeas 4y ago
  What YouTube video? I haven't read that comment yet; still awaiting results from the Online Content Vetting Foundation. Yours flew through the process though. Congrats! In all seriousness though, I do agree somewhat with the GP. Inherent vetting can be good. But it's also a tool used against us for manipulation. An example of this would be app stores. Heavily vetted, but you are force fed the apps they want you to see, and they have every right to deny you access to apps they find undesirable. We need systems of reputation and trust to emerge, as they always have, and we need the freedom to choose them. Tools like Twitter allow largely unvetted content, sure, but they also allow users to curate their own circle of trust. This comes with risks of course, but I trust it more than some omniscient entity handing me content like mana from heaven.
  - EGreg 4y ago
    That’s because they are vetted by ONE organization, that privately owns the store. It is actually an example of private capitalist ownership, again. In science, no one “owns” physics. No one “owns” articles on wikipedia. The ideal is to have multiple reviews represented and all of their major legitimate concerns should be addressed before publishing something to the public. Think of concentric circles where the inner circle isn’t just Apple or Google but a good mix of experts with different views. The hard part is resolving disputes between experts, or determining if a criticism is legitimate. This is what “edit wars” are like on wikipedia. Perhaps in this case, both points of view should be included side by side. In a capitalist market system, though, explaining nuances of WHY Trump’s or Biden’s administration did something, or including the entire context of a gaffe video, would make it uninteresting to their audience. Imagine if Fox News would fairly report the results of studies about single payer healthcare around the world - their audence would bounce. They face intense market pressures to cater to their audience, this is WHY they report as they do and WHY they tell their straight news anchors to “rein it in”. The one exception may be Tucker Carlson over there, who is able to somehow maintain a show while going against the entire military-industrial complex and establishment, unlike Sean Hannity. It is a rare phenomenon to see someone with such a highly promoted time slot have such a contrarian position. But if it sells to an audience, I guess it works. CNN totally jumped the shark when they discovered they can cover the malaysian airline flight for months 24/7 and their ratings went up. They went from being a straight news network to pandering for ratings too. None of the open source platforms or wikipedia would sell out like that.
serial_dev 4y ago
> We should treat things like operating systems do: have collaborative security assessments for each package BEFORE it is published. This would not work for small open source projects, and every successful open source project starts out as a small project that nobody vetted yet. I have smaller, but popular open source packages that I know are used by many people,and most of those projects (even now, after a year being public) get zero actual contributions. If my most popular packages don't receive pull requests, how would I find a trustworthy expert committee to judge all my other silly little packages for free? Also, why would I make the projects I work for fun and for free purposefully a painful, sluggish, bureaucratic experience for everyone involved?
- EGreg 4y ago
  It's a matter of scale, as I said :) At some point, projects have to bring in more "adult supervision"

infamouscow 4y ago

Vendor and audit your dependencies. You shouldn't rely on GitHub to protect you from security problems.

mort96 4y ago
While I agree in principle, that usually means you'll 1) frequently blindly update all your dependencies, which doesn't really give you much security benefit, or 2) use old dependencies long after security vulnerabilities have been discovered in them. The first point does give you some security benefits by reducing the chance that you'll hear about a malicious package before you upgrade to it, but it's not exactly great. I don't know what the solution is. I don't think there is a solution. We can't have 5000 dependencies from 2000 random individuals on the internet and still be safe. But if you want to avoid that situation, you're locking yourself out of the vast majority of the NPM ecosystem.
- infamouscow 4y ago
  Maybe the ecosystem needs to discourage unnecessary packages imports.

darepublic 4y ago

faker was a disease that I fought against in the places where I was unfortunate enough to inherit it in the codebase. lots of devs not knowing better thinking it really made our tests more robust -- it didn't, in fact, just more flaky. also faker's functionality can easily be shimmed or rolled yourself if you want to. I will continue the fight, there are many other super popular npm packages whose value is dubious at best, cause dependency tooling headaches, and are like viruses in the web ecosystem. and the fact this faker guy sabotaged his own package is great because even before that I was against it, and now it is just easier to convince people not to import this clown lib

deleted 4y ago

[deleted]