junon

21 ms·

421.
by junon 1y ago
I've mentioned this elsewhere. I was mobile, I don't often use it there, and I was in a rush.
422.
by junon 1y ago
Yes though in theory my public key would have been published elsewhere at least for verification. Valid point though, yes they would have been able to do that.
423.
by junon 1y ago
Unfortunately wouldn't have helped. They skimmed my npm-only address directly from the public endpoint.
424.
by junon 1y ago
Hi, missing a lot of history here. When Chalk was written, colors in the terminal wasn't a flashy thing people tried to do very often, at least not in the JS world. Coming from browsers and wanting to make CLI apps using the flashy new
425.
by junon 1y ago
Thanks Josh, appreciate it <3
426.
by junon 1y ago
Being able to sign releases would help, too. I would happily have that enabled since I'm always publishing from one place.
427.
by junon 1y ago
Quote is probably added recently. Not entirely correct as I have not regained access; nothing happening to the packages is of my own doing. npm does appear to have yanked a few, slowly, but I still don't have any insight as to what t
428.
by junon 1y ago
That was the low-tech part of their attack, and was my fault - both for clicking on it and for my phrasing. It wasn't a single-click attack, sorry for the confusion. I logged into their fake site with a TOTP code.
429.
by junon 1y ago
I was on mobile, didn't use the autofiller. Also previous experience with the web extensions showed me that they were flakey at best anyway. The `.help` should have been the biggest red flag, followed by the 48-hours request timeline.
430.
by junon 1y ago
I clicked the link like a genius :)
431.
by junon 1y ago
This was mobile, I don't use browser extensions for the password manager there.
432.
by junon 1y ago
It's been almost two hours without a single email back from npm. I am sitting here struggling to figure out what to do to fix any of this. The packages that have Sindre as a co-publisher have been published over but even he isn't
433.
by junon 1y ago
Thank you, I appreciate it! I did so as well and even called their support line to have them escalate it. Hopefully they'll treat this as an urgent thing; I'd imagine I'm far from the only one getting these.
434.
by junon 1y ago
They phished username, password (unique to npm), and a TOTP code. They even gave me a new TOTP code to install (lol) and it worked. Showed up in authy fine. Whoever made this put a ton of effort into it.
435.
by junon 1y ago
Migadu. The tooltip hovering over it shows: dkim=pass header.d=smtp.mailtrap.live header.s=rwmt1 header.b=Wrv0sR0r
436.
by junon 1y ago
Yep - https://gist.github.com/Qix-/c1f0d4f0d359dffaeec48dbfa1d40ee...
437.
by junon 1y ago
Seems so, yes.
438.
by junon 1y ago
That it had been more than 12 months since last updating them. Npm has done outreach before about doing security changes/enhancements in the past so this didn't really catch me. Screenshot here: https://imgur.com/a
439.
by junon 1y ago
Ignore anything coming from npm you didn't expect. Don't click links, go to the website directly and address it there. That's what I should have done, and didn't because I was in a rush. Don't do security things whe
440.
by junon 1y ago
Hi, yep I got pwned. Sorry everyone, very embarrassing. More info: - https://github.com/chalk/chalk/issues/656 - https://github.com/debug-js/debug/issues/1005#issuecomment-3...
441.
by junon 1y ago
Just to see if a bird is in the picture (like the comic states) using chatgpt et al can probably do a sufficient job. Not condoning people make this app, just thinking about how fast things have moved in just a few short years.
442.
by junon 1y ago
This was correct a number of years ago. Feels a little strange we can just do an API call for bird recognition now.
443.
by junon 1y ago
What in the world are you talking about?
444.
by junon 1y ago
I had the same thing happen on both Facebook and Twitter. The answer is: nothing. In both cases for me, I had signed up and logged in for the first time, and was met with an immediate ban. No rhyme or reason why. I, too, needed it for work
445.
by junon 1y ago
If it's performing a request upon closing the tab, only two options are available: 1. it delays closing until it completes, which is a performance hit, or 2. it's performing more website specific background work when I've tol
446.
by junon 1y ago
> Maybe it’s for for analytics or even auto-logout when they leave the website. Yeah, don't do either of these things. Don't log me out when I close the tab. Don't spy on me after I close the tab. Very simple!
447.
by junon 1y ago
Once I ditched the hydraulic analogy and really tried to internalize charge, current, voltage, etc. is when I finally started to understand why the hydraulic analogy "works" but only for people who already understand electricity.
448.
by junon 1y ago
Yep you're right then. :)
449.
by junon 1y ago
It depends on how you quantify it, which isn't really possible and isn't even the point of the comment. It really feels like you're being intentionally obtuse here. The point was that they seem to be impervious to many govern
450.
by junon 1y ago
That's a reductio ad absurdum conclusion. Both lobby for and are in major political cahoots with many governmental bodies worldwide. They lobby like crazy, and can defend just about any lawsuit that comes their way - including dodgin

More ›