Malicious crossenv package on npm

Re:Malicious crossenv package on npm by tomc1985 on Wednesday August 02, 2017 @12:54AM (#14908025)

Yeah I'm not really following how users desiring a natural-language tuple-looking thing prevents proper identity verification. Even without namespacing strong identity controls (signature verification and preventing unauthorized accounts from posting under a taken name, for example) can prevent most attacks short of typosquatting.

[ Parent | on HN ]

Re:Malicious crossenv package on npm by stupidcar on Wednesday August 02, 2017 @05:07AM (#14909046)

Typosquatting is exactly what these malicious packages were doing. So you're agreeing that arguments re. identify verification is a useless distraction in this case?

[ Parent | on HN ]

Re:Malicious crossenv package on npm by KirinDave on Wednesday August 02, 2017 @11:07AM (#14911124)

You seem to have a handle on every aspect of this situation except what the actual attack we're discussing was.

It was typo squatting.

[ Parent | on HN ]

Re:Malicious crossenv package on npm by tomc1985 on Wednesday August 02, 2017 @05:11PM (#14914697)

And you like to assume things.

Name canonicalization gets you part of the way there. But unless you want to go full-on namespacing then you must realize you are fighting a pointless battle.

You cannot reasonably expect to save users from themselves in every way.

[ Parent | on HN ]

Re:Malicious crossenv package on npm by KirinDave on Friday August 04, 2017 @07:34PM (#14933244)

Npm has namespacing.

[ Parent | on HN ]