30 ms·
NPM won't publish packages containing the word keygen
- HeckFeck 3y agoWhat if I write a package to provide generic key generation for other software packages, then share it, generous man that I am?
- AndrewKemendo 3y agoName it kee-gin
- cm_silva 3y agoHow about Key Djinn ;-)
- AndrewKemendo 3y agoMeshuggah is now the “replace:” for “keygen”
- NamTaf 3y agoThat's djent, not (d)jinn https://en.wikipedia.org/wiki/Jinn https://en.wikipedia.org/wiki/Jinn
- AndrewKemendo 3y agoHa, whoops you’re right.
- HeckFeck 3y agoKey-Gone-Jin?
- jojobas 3y agoBelieve it or not, jail.
- simiones 3y agoFor anyone not aware of the reference, this is from an episode of Parks and Recreation: https://www.youtube.com/watch?v=eiyfwZVAzGw https://www.youtube.com/watch?v=eiyfwZVAzGw
- faefox 3y agoWe have the best package repository in the world because of jail.
- HeckFeck 3y agoFreeBSD? Makes sense, isolate the repo process so nothing nasty escapes.
- dylan604 3y ago%s/keygen/keymaker/g OR %s/keygen/keymaster/g depending on what era of movie buff you are
- adql 3y agoname it negyek
- 2OEH8eoCRo0 3y agoI have a pet theory that the language police learned their habits from these systems that have no better way than keyword moderation.
- rmnclmnt 3y agoSuch rules are so dumb and easy to circumvent, it is like parent filtering all over again!
- nottorp 3y agoOh btw, do they allow "breast" in package names?
- sneak 3y agoNPM is owned by Microsoft, who sell proprietary software, the kind that keygens are made to defeat. Don't expect to see KMS spoofers on GitHub anytime soon for the same reason.
- kholdstayr 3y agoWhat about this? https://github.com/massgravel/Microsoft-Activation-Scripts https://github.com/massgravel/Microsoft-Activation-Scripts
- sneak 3y agoThose are scripts that talk to KMS servers on the internet - they would not fall under DMCA prohibitions on anticircumvention as I understand it. KMS spoofers are the services running on those internet hosts the scripts talk to. py-kms is on GitHub but I assume it won't remain there for the same reasons as yt-dlp.
- mynameisvlad 3y ago> py-kms is on GitHub but I assume it won't remain there for the same reasons as yt-dlp. You mean this yt-dlp that isn't on there? https://github.com/yt-dlp/yt-dlp https://github.com/yt-dlp/yt-dlp That script also does more than just Online KMS activation, which would be clear from a few seconds skimming. There's also been no indication that any of these repos would get taken down. At all. py-kms has been there since 2017. You'd think if Microsoft had such a big problem with its existence, it'd have gotten pulled in the last 6 years.
- sgjohnson 3y agopy-kms is a thing
- IggleSniggle 3y agoOkay but what about keygen for ssh/git/pgp/certs or really anything in software that relates to security, which fundamentally rely on, at some point, the generation of encryption keys? It’s just such a dumb counterproductive step to take.
- withinboredom 3y agokeyword moderation is terrible and only affects the language(s) you know about. It doesn't actually prevent the content (the goal of these types of filters) from being served. It'd be like a virus scanner preventing a program from running because it had the name 'virus' in it ... which would prevent itself from running -- probably.
- deleted 3y ago[deleted]
- hbn 3y agoMy favorite is the online name censoring in video games. Dark Souls infamously just does a straight check of any string match within the name against a big list of no-no words. So in this fantasy game where everyone is running around as a knight, anyone who has "knight" in their game will appear as "k***ht" to other players. There's also a famous image I've seen online from another game where the guy's name was Nasser which appeared for everyone else in-game as "N***er"
- vmilner 3y agoI remember a conversation with some using an in-house file transfer system “Oh you won’t be able to send more than X GBytes, at that point the chances that the base64 encoding contains a banned rude word become too high, and the transfer will fail”
- reuben364 3y agoI wonder what the optimal encoding is given a list of banned words for any substring of a message.
- namibj 3y agoJust use a r-ANS entropy coder with feedback skipping symbols that would result in a ban from being possible to encode at that moment... I think. Unless I've gotten confused about the limits of dynamic prediction abilities in ANS. I think it's just that the encoder and decoder run in opposite directions through the encoded symbols, but read-ahead during decoding shouldn't be a problem...
- ethbr0 3y agogenkey
- franky47 3y agoAuthor here, with some context: the relevant package [1] generates key material to setup an end-to-end encryption SDK [2], based on libsodium and OPAQUE. [1] https://www.npmjs.com/package/@socialgouv/e2esdk-keygen https://www.npmjs.com/package/@socialgouv/e2esdk-keygen [2] https://github.com/SocialGouv/e2esdk https://github.com/SocialGouv/e2esdk
- _ugfj 3y agoI thought buttbuttination taught everyone how incredibly stupid this is 25-30 years or so ago already? But no. Just a few years ago I tried to enter an answer into a Hungarian Q&A site recommending to take the Algeciras-Tangier ferry and the answer was refused. https://en.wiktionary.org/wiki/geci https://en.wiktionary.org/wiki/geci
- hoherd 3y agoLOL, that is a great mnemonic! Now I will always remember how to spell assassination.
- franky47 3y agoThe Scunthorpe problem all over again. https://en.wikipedia.org/wiki/Scunthorpe_problem https://en.wikipedia.org/wiki/Scunthorpe_problem
- ricardo81 3y agotee hee.
- retrocryptid 3y agowait... are you implying that "k*ygen" is a dirty word?
- deleted 3y ago[deleted]
- MSFT_Edging 3y agoDirty word in the context of security, copyright liability, etc.
- jrockway 3y agoAh yes, the age-old hacking tool: ssh-keygen.
- devmor 3y agoReminds me of the times I've seen junior devs changing "password" to "wordpass" to bypass automated commit checks for sensitive data. These kinds of checks are so trivially defeated, the only people they actually stop is people trying to do legitimate work.
- zirgs 3y agoTbh in this case that check is useful. It prevents devs from accidentally including passwords in their commits.
- devmor 3y agoNot a perfect example, but the point is that it's not stopping anyone from doing anything malicious.
- sebzim4500 3y agoPresumably some of those devs will see the warning and think "oh yeah, I probably shouldn't commit the password" rather than find a workaround.
- marcosdumay 3y agoI really hope their password isn't literally "password", so I can't see how blocking that word improves anything.
- throwaway22032 3y agoWhere will I get my Кейген now?
- ezekg 3y agoI run a business called Keygen [^0], and own the @keygen namespace on npm. We’re working on a Node SDK, so this isn’t good to hear. I’ll open up a discussion with them and see what we can do. [^0]: https://keygen.sh https://keygen.sh
- franky47 3y agoHave you had any publishing issues? My last successful publish on this package was 3 months ago, and I started noticing issues with deploys a few weeks back. Three fun days of CI/CD pipeline debugging to get to this..
- deleted 3y ago[deleted]
- ezekg 3y agoAfter digging around, I found the org and I do own @keygen. And I was able to publish an empty package to the org: https://www.npmjs.com/package/@keygen/js https://www.npmjs.com/package/@keygen/js. But it doesn't look like it's searchable, unless there's a caching issue.
- samtho 3y agoIt is searchable now, at least: https://i.imgur.com/kFDSuHE.png https://i.imgur.com/kFDSuHE.png
- ijustlovemath 3y agounrelated to your question: Your website's very pretty, but doesn't scroll horizontally on mobile. It also looks like there might be a bug in the code sample - where does "fingerprint" come from?
- creshal 3y agoIt doesn't scroll on desktop either, I guess the world still is not ready for people having multiple windows open in parallel.
- smashah 3y agoThis reminds me of the supply chain attack experts who's only solution seems to be blocking postinstall scripts.
- insanitybit 3y agoThat sounds completely different. Blocking the word 'keygen' accomplishes absolutely nothing and is clearly stupid. Blocking build scripts absolutely stops a major attack vector.
- smashah 3y agoMalicious unchecked code in postinstall can just be moved to runtime so blanket blocking postinstall is as effective a solution to supply chain attacks as the solution of blocking npm packages with the word "keygen" in them is to the problem of .... js based keygens??? There are many legitimate purposes for postinstall scripts yet the anti-postinstall crowd acts like they solved security issues with this one easy step.
- marcosdumay 3y agoPostinstall scripts run without any interaction before the developer has any chance of reviewing the code. They are a very bad thing.
- smashah 3y ago"any chance"??? I can't square this circle of someone being paranoid about postinstall script but at the same time thinks the first chance to review dependency code is after doing a `npm i`. Check the git repo of the library you are installing beforehand if you're so paranoid about postinstall. And above that, never install any library for which the source is not readily available. This is the most basic first line of defense. username checks out.
- dns_snek 3y ago
- lopkeny12ko 3y agoI must be missing something obvious. What's malicious about the word "keygen"? What's the issue with ssh-keygen? gpg --gen-key?
- solardev 3y agoBack in the day, paid software used to use serial keys for activation. Keygens made valid reg keys using the same algorithm so you could pirate software easily.
- franky47 3y agoPiracy. Programs that generate activation codes for proprietary software are called keygens. They usually come with interesting musical accompaniments.
- megous 3y agoKeygens may or may not facilitate piracy, but they're not themselves piracy. This is just some ridiculous NPM policy. What will be next? Cracks?
- distortionfield 3y agoYeah what was it about keygens always having the most unhinged synth soundtracks
- franky47 3y agoIt sparked a whole new genre, Demoscene. I miss those days. https://en.wikipedia.org/wiki/Demoscene https://en.wikipedia.org/wiki/Demoscene
- NamTaf 3y agoIt's part of the demoscene culture, which overlaps a lot https://en.wikipedia.org/wiki/Demoscene https://en.wikipedia.org/wiki/Demoscene
- 3y ago
- Waterluvian 3y agoKeyword moderation feels like an unspirited attempt by developers to satisfy incompetent managers telling them to get other incompetent managers, upset about piracy, off their backs. I don't believe anyone involved actually thinks this will make a difference. It's just to address a complaint.
- alkonaut 3y agoThat's almost certainly the case. "What can we do that has an observable effect we can demonstrate as us being responsive, but doesn't have a significant cost [to ourselves]". It's the same as any other "this shouldn't be done, but a manager asks me to do it". If you aren't ready to die on that hill as I would, then there is nothing you can do. I'd easily take that fight but that's coming from a very privileged position (i.e., I'd not risk not having food on the table if I said no when a manager asked me to add keyword moderation or a dark-pattern cookie banner).
- RobotToaster 3y ago"see boss, nothing is using the word "keygen", so obviously we have removed all keygens".
- absentmoon 3y agoCool, now I can name my internal packages keygen to avoid dependency confusion /s
- deleted 3y ago[deleted]
- nateguchi 3y agoSurely this must just be a dumb WAF rule?
- ok123456 3y agoIt's the 80s all over again. But instead of puritanical sysops it's huge multinational corporations. Maybe we'll just call them k3yg3n5.
- Etrnl_President 3y ago𝔎𝔢𝔶𝔤𝔢𝔫 𝕶𝖊𝖞𝖌𝖊𝖓 𝐊€ｙģ€ℕ 𝓚𝓮𝔂𝓰𝓮𝓷 𝒦𝑒𝓎𝑔𝑒𝓃 𝕂𝕖𝕪𝕘𝕖𝕟 Ｋｅｙｇｅｎ ᛕꫀꪗᧁꫀꪀ Kꫀׁׅܻᨮ꫶ׁׅ֮ᧁׁꫀׁׅܻꪀׁׅ K⃞ e⃞ y⃞ g⃞ e⃞ n⃞ Ⓚⓔⓨⓖⓔⓝ кєץﻮєภ Nguyen ᏦᏋᎩᎶᏋᏁ kēฯງēຖ 𝐊𝐞𝐲𝐠𝐞𝐧 𝗞𝗲𝘆𝗴𝗲𝗻 𝘒𝘦𝘺𝘨𝘦𝘯 𝙆𝙚𝙮𝙜𝙚𝙣 𝙺𝚎𝚢𝚐𝚎𝚗
- mrweasel 3y agoSo,... has anyone with this issue actually contacted the NPM team and asked what is is about?
- franky47 3y agoI have, yes. Awaiting a response.
- franky47 3y agoOfficial response from NPM (a week later): > You are correct, keygen is a stopword. We blocked users from using this word for security purposes. > Apologize for the inconvenience and we highly suggest you choose a different word for your package going forward.
- tannhaeuser 3y agoI'm assuming keygen must not be part of the package name specifically, right? Because keygen can be part of contained JS content without probs, as the sgml package is demonstrating (containing the legacy keygen element as part of its embedded HTML DTD grammar). But I'm still curious why keygen would be problematic as part of a package name?
- 40yearoldman 3y agoEvery time npm comes up I remind everybody that npm is shit, and nobody should use it. They have a bad track record of doing things right and bad attitude when told. But you keep using it. I refuse to use it at work and refuse to use it in personal life. It’s not real software and will cause you harm.
- tobiasSoftware 3y agoFun fact. Several years ago I started getting charges from NPM, which although I am a software developer I have never used. I cancelled my credit card multiple times, but they kept appearing each month. I went to my bank, Bank of America, and they claimed that there was nothing they could do because NPM was using some sort of option they had to follow me when I got new credit cards. I don't know what kind of option that is, as every time I get a new credit card I have to update it with literally every other company. I also don't know how a bank wouldn't have some sort of manual override. Nevertheless, I called NPM, who said I had to talk with my bank. Eventually, after months of dealing with this loop, I threatened to leave my bank, and my bank advised me to call them and threaten to get the BBB involved if they didn't fix it, and a few days later NPM admitted it was an error on their end and reversed all of the charges. To this day I wonder what kind of shady thing NPM was doing to not just charge someone who had never been a customer of theirs, but to follow them across cancelled credit cards.
- hunter2_ 3y agoOk, I'll bite. There is no way a merchant can learn a new card number other than from the cardholder, or from a thief who got it from the card/cardholder. Not from any upstanding entity. If you merely got a new expiration date, security code, etc. without also changing the card number, they could "follow" that by submitting a transaction without those extra pieces of information, at greater cost and risk to themselves, though. I'll happily take downvotes if I'm wrong, for being assertive without a source. Are you sure NPM was actually charging your card directly, and not a digital wallet or similar virtual card thing which you kept active?
- 3y ago
- slowmovintarget 3y agoThis is why LLMs that have censorship applied seem lobotomized. Clbuttic problem is clbuttic.
- evv 3y agoOh. As the creator and reluctant maintainer of npm's "ssh-keygen", this is awkward! First question: does this mean I won't be able to publish patches to the package? Why do I not want this package under my control? The original package simply calls spawn for your real `ssh-keygen` with the appropriate arguments. No real problem, (although there is very little value here). But a contributor added support for Windows by uploading opaque binary builds for Windows. While I have no reason to distrust the contributor, it is scary to be "responsible" for opaque executables that I did not personally produce. So, what should I do with this package? Assuming npm lets me do anything? Fortunately this package is "only" downloaded ~1600 times/week, miniscule for npm. If you are tempted to use ssh-keygen, I recommend you learn how to use execFile/spawn, and use the native program directly. For context, I published this 10 years ago, as one of my earliest contributions to open source. I probably wouldn't have gone near any security-essential contributions if I had more experience at the time.
- trieloff 3y agoApparently it’s the same for the word “cheat” https://mastodon.online/@macdonst/110492821135085935 https://mastodon.online/@macdonst/110492821135085935
- macdonst 3y agoCan confirm.