4 ms·

It's a stretch to pin blame on Microsoft. They're probably the reason the service is still up at all (TFA admits as much). In hindsight it's likely that all the

It's a stretch to pin blame on Microsoft. They're probably the reason the service is still up at all (TFA admits as much). In hindsight it's likely that all they wanted from the purchase was AI training material. At worst they're guilty of apathy, but that's no worse than the majority of npm ecosystem participants.

mr90210 1y ago
> It's a stretch to pin blame on Microsoft. They're probably the reason the service is still up at all. I reckon that the ecosystem would have been much healthier if NPM had not been kept running without the care it requires.
- 2d8a875f-39a2-4 1y ago
  I did wonder about that. Maybe yeah. It's likely that several no-better forks would have sprung up right away.
righthand 1y ago
It’s NOT a stretch to blame Microsoft. How many billions have we spent chasing “AI”? These issues could have been easily solved if we spent the consideration on them. This has been going on well over a decade. Microsoft isn’t any better steward than the original teams. This issue has happened Plenty under Microsoft’s ownership.
- 2d8a875f-39a2-4 1y ago
  i would contend that they are no worse than the original teams, who also clearly didn't care. their motivations may have been growth rather than AI training data but the outcomes were the same
  - righthand 1y ago
    Microsoft has money to fix the problem is the difference. Neither side (og team, Microsoft, or npm consumers) has any capital interest in the matter.
- rs186 1y ago
  Yeah, easily solved. Would love to hear your genius solutions right here that Microsoft is too dumb to come up with and implement.
  - dns_snek 1y ago
    Seriously? This is is extremely low hanging fruit that's not being taken care of. You shouldn't be able to take over a software dependency with a phishing email. Requiring simple PGP code signing or even just passkey authentication would eradicate that entire attack vector. Future attacks would then require a level access of access that's already synonymous with "game over" for all intents and purposes (e.g. physical access, malware, or inside job). It's not bulletproof but it would be many orders of magnitude better than the current situation.
    - rs186 1y ago
      As long as you can publish a package in a CI environment (which is essential), none of what you mentioned matters. And that's not even the point. That phishing email is just one of the ways attackers use to infiltrate, which is not Microsoft's problem to begin with. Next time, the attacker could install malware in your machine that silently runs code and publish a package on your behalf using your own credentials stored locally while you think everything is ok, and you'd still blame Microsoft for not doing enough.
      - righthand 1y ago
        You should indicate whether or not you work for or somehow are affiliated with Microsoft.
      - dns_snek 1y ago
        > Next time, the attacker could install malware in your machine I already addressed this in the previous comment but I hope you realize the absurdity of this statement. If the attacker can corner you in a dark alley they can steal your yubikey and beat the PIN out of you, too. By that logic is 2FA futile and should we all stop using it? Security isn't binary, simply raising the bar from falling for a phishing email to gaining access to someone's machine will probably eliminate 99% of all compromises. > and you'd still blame Microsoft for not doing enough Gaining access to someone's machine is definitive "game over" scenario, using that as an excuse not to harden security to the point that that's the only option left is lazy and irresponsible. Even with that kind of access, code signing will slow the viral spread way down which would make a difference. Once you make it hard to hijack packages, time will be better spent on investing in sandboxing which also protects people from insider threats.
simonw 1y ago
"In hindsight it's likely that all they wanted from the purchase was AI training material." Microsoft already owned GitHub. I don't see how acquiring npm would make a meaningful difference with respect to training material, especially since npm was already an open package repository which anyone could download without first buying the company.
- leptons 1y ago
  Not all NPM packages are hosted on github. I don't know what the number is, but I know I don't have my NPM packages on github (instead, bitbucket).

mr90210 1y ago

> It's a stretch to pin blame on Microsoft. They're probably the reason the service is still up at all. I reckon that the ecosystem would have been much healthier if NPM had not been kept running without the care it requires.

2d8a875f-39a2-4 1y ago
I did wonder about that. Maybe yeah. It's likely that several no-better forks would have sprung up right away.

righthand 1y ago

It’s NOT a stretch to blame Microsoft. How many billions have we spent chasing “AI”? These issues could have been easily solved if we spent the consideration on them. This has been going on well over a decade. Microsoft isn’t any better steward than the original teams. This issue has happened Plenty under Microsoft’s ownership.

2d8a875f-39a2-4 1y ago
i would contend that they are no worse than the original teams, who also clearly didn't care. their motivations may have been growth rather than AI training data but the outcomes were the same
- righthand 1y ago
  Microsoft has money to fix the problem is the difference. Neither side (og team, Microsoft, or npm consumers) has any capital interest in the matter.
rs186 1y ago
Yeah, easily solved. Would love to hear your genius solutions right here that Microsoft is too dumb to come up with and implement.
- dns_snek 1y ago
  Seriously? This is is extremely low hanging fruit that's not being taken care of. You shouldn't be able to take over a software dependency with a phishing email. Requiring simple PGP code signing or even just passkey authentication would eradicate that entire attack vector. Future attacks would then require a level access of access that's already synonymous with "game over" for all intents and purposes (e.g. physical access, malware, or inside job). It's not bulletproof but it would be many orders of magnitude better than the current situation.
  - rs186 1y ago
    As long as you can publish a package in a CI environment (which is essential), none of what you mentioned matters. And that's not even the point. That phishing email is just one of the ways attackers use to infiltrate, which is not Microsoft's problem to begin with. Next time, the attacker could install malware in your machine that silently runs code and publish a package on your behalf using your own credentials stored locally while you think everything is ok, and you'd still blame Microsoft for not doing enough.
    - righthand 1y ago
      You should indicate whether or not you work for or somehow are affiliated with Microsoft.
    - dns_snek 1y ago
      > Next time, the attacker could install malware in your machine I already addressed this in the previous comment but I hope you realize the absurdity of this statement. If the attacker can corner you in a dark alley they can steal your yubikey and beat the PIN out of you, too. By that logic is 2FA futile and should we all stop using it? Security isn't binary, simply raising the bar from falling for a phishing email to gaining access to someone's machine will probably eliminate 99% of all compromises. > and you'd still blame Microsoft for not doing enough Gaining access to someone's machine is definitive "game over" scenario, using that as an excuse not to harden security to the point that that's the only option left is lazy and irresponsible. Even with that kind of access, code signing will slow the viral spread way down which would make a difference. Once you make it hard to hijack packages, time will be better spent on investing in sandboxing which also protects people from insider threats.

simonw 1y ago

"In hindsight it's likely that all they wanted from the purchase was AI training material." Microsoft already owned GitHub. I don't see how acquiring npm would make a meaningful difference with respect to training material, especially since npm was already an open package repository which anyone could download without first buying the company.

leptons 1y ago
Not all NPM packages are hosted on github. I don't know what the number is, but I know I don't have my NPM packages on github (instead, bitbucket).