oauea

21 ms·

181.
by oauea 5y ago
> Are (D)DoS attacks wrong? Yes, if you attack infrastructure that you do not have permission to test. Here people downloaded code, ran it on their own infrastructure (or worse: shipped it to their users!) and were surprised this code di
182.
by oauea 5y ago
If you choose to download my code and include it in your project and it doesn't do what you expect, that is on you. The colors library has an infinite loop and you shipped that version to your end users? That's on you. Test and pi
183.
by oauea 5y ago
> People didn't actively go seek out a new version. They did. They chose not to pin their dependency versions, so this is their clear explicit choice. They also chose not to test their dependency updates before pushing it through t
184.
by oauea 5y ago
You're mixing up npm ci and npm install. npm install will update your lockfile. See the docs: https://docs.npmjs.com/cli/v6/configuring-npm/package-locks
185.
by oauea 5y ago
No, that is madness. A new developer clones the repo and gets wildly different dependency versions than the previous devs tested with. Then once you PR your changes, you include that lockfile and production explodes. Insane. And yes, this i
186.
by oauea 5y ago
npm install would like to have a word with your lockfile.
187.
by oauea 5y ago
Tell them about requirements.txt, pip freeze & virtualenv. You can also curl | bash but that doesn't mean bash is to blame, because it doesn't encourage this bad behavior. NPM is literally built around this broken behavior.
188.
by oauea 5y ago
The difference is that your tooling doesn't suddenly decide to pull in a new version than the one you've tested with.
189.
by oauea 5y ago
Yes, and that reason is no good. There's a reason maven3 moved away from it.
190.
by oauea 5y ago
This is violence?
191.
by oauea 5y ago
Throw shit at the police and they're going to react. Pretty normal and expected and has nothing to do with covid.
192.
by oauea 5y ago
Any real world examples?
193.
by oauea 5y ago
I like the idea of not seeing ads. It's pretty cool.
194.
by oauea 5y ago
What violence?
195.
by oauea 5y ago
It might be, but this is not malicious. Plenty of projects have pushed breaking changes for one reason or another. I'd argue the only malicious actors here are those who do not pin and test their dependencies before shipping updates.
196.
by oauea 5y ago
Explanation what it's used for: https://www.edrlab.org/readium-lcp/principles/
197.
by oauea 5y ago
Crazy how many projects apparently depended on this library without pinning their versions.
198.
by oauea 5y ago
What's actually malicious about the code? It's an infinite loop that logs to stdout. Sure, it's not what the library is supposed to do, but is it malicious code?
199.
by oauea 5y ago
Have you not heard of addons? Specifically ublock origin?
200.
by oauea 5y ago
Sure, nothing is 100% random so that is not possible. At best it's difficult to predict.
201.
by oauea 5y ago
> Edit: Moved off the dead parent comment How does one move their comments?
202.
by oauea 5y ago
how do i install macos on my laptop and desktop?
203.
by oauea 5y ago
Why would they? This is the Google Play Store, not the Apple App Store with all its inane rules.
204.
by oauea 5y ago
Well one thing is clear, you wouldn't download a car.
205.
by oauea 5y ago
iframes
206.
by oauea 5y ago
If you don't want people making their own frontends, blame your government for allowing it.
207.
by oauea 5y ago
It's hinted at in the article that these servers are not stock servers, and the author is able to detect similar divergent behavior in all of these nodes, implying they are all the same non-standard tor software that is doing... someth
208.
by oauea 5y ago
Just run the same script from both places?
209.
by oauea 5y ago
Why do they require the internet? Can you not run or mock your required services locally?
210.
by oauea 5y ago
> Since ads can run arbitrary JS What a fantastic idea to create a platform where anyone can pay to have code ran on millions of end-user machines, embedded in random websites. What could possibly go wrong?

More ›