3 ms·
Does making npm return 404 a portion of the time for a couple minutes really count as "bring[ing] down the JavaScript ecosystem"?
by tbrownaw 2y ago
Does making npm return 404 a portion of the time for a couple minutes really count as "bring[ing] down the JavaScript ecosystem"?
- hombre_fatal 2y agoBut you can just curl it again in a few minutes and bring it down again. And then again after that, so they claim that it can be done indefinitely. That’s quite a big difference. Also, you can target not just express but an even higher volume small library that most large projects depend on. I don’t get how every comment so far has dismissed DoS as a serious issue.
- akira2501 2y agoOn it's own probably not. Given the way that people hook npm into automated deployments it likely can rise to that level for some users. Given that some people may depend on this deployment strategy without even being aware of it, it does seem like an issue worth noticing.