News for hackers. Stuff that matters.

A comment on ESLint compromised, may have stolen your credentials.

Re:ESLint compromised, may have stolen your credentials by msoad on Thursday July 12, 2018 @01:41PM (#17516888)
I blame the Linux Foundation that has allowed Node.js to ship with npm CLI which is a client for a _VC backed_ _for profit_ company. This posinstall stuff is clearly a bad design that many have pointed to it before but npm just ignored it. Nobody can fix it other than npm. I have nothing personal against people who work at npm inc but this structure is not right. npm is having way too much control over this ecosystem. They always complain about not having not enough resources. How about running npm like an open source project instead? I have many questions:

    Why the registry code is not open source?
    Why the CLI is not maintained well? (Yarn exists because npm CLI sucks)
    What if VC money forces npm to milk free users for money?
[ Parent | on HN ]
Re:ESLint compromised, may have stolen your credentials by steamer25 on Thursday July 12, 2018 @02:38PM (#17517383)
In a recent video, Ryan Dahl mentioned that he regrets incorporating package.json and NPM into Node:

https://youtu.be/M3BM9TB-8yA?t=588

He has a very early attempt at breaking from compatibility with Node called "Deno". Here's the part in the video about his current thoughts on importing external modules under Deno:

https://youtu.be/M3BM9TB-8yA?t=1257

He has some other security proposals as well.

[ Parent | on HN ]
Re:ESLint compromised, may have stolen your credentials by pedro_hab on Thursday July 12, 2018 @03:12PM (#17517685)
And he even mentions linters (in the first Deno slide) as untrusted utilities that should take advantage of the JS sandbox and not have access to network.
[ Parent | on HN ]
Re:ESLint compromised, may have stolen your credentials by agmcleod on Thursday July 12, 2018 @03:13PM (#17517690)
Why does this tie to the linux foundation?

> How about running npm like an open source project instead?

In the end such a large service requires a fair bit of hardware & costs to work. While I would prefer there wasn't as much dependency on something a single company controls. The largeness of node & npm makes it quite the target.

[ Parent | on HN ]
Re:ESLint compromised, may have stolen your credentials by caniszczyk on Thursday July 12, 2018 @03:45PM (#17517989)
exactly, this has nothing to do with the LF and everything to do with the NodeJS community being OK with a for-profit startup owning their registry... the registry should be community owned and funded similar to the way say the LF runs LetsEncrypt.org as a community resource
[ Parent | on HN ]
Re:ESLint compromised, may have stolen your credentials by rantyMcRantFace on Thursday July 12, 2018 @05:20PM (#17518720)
You realize that LF is only a minor partner in LetsEncrypt, right? The major partners are EFF, Mozilla, OVH, Akamai and Cisco (and Cisco being involved is a very good reason to stay the hell away from it).
[ Parent | on HN ]
Re:ESLint compromised, may have stolen your credentials by reitanqild on Friday July 13, 2018 @12:19AM (#17520488)
No big fan of Cisco but unless someone else will chime in and explain why this is a big deal when it comes to LetsEncrypt I think this is a bit over the top.
[ Parent | on HN ]
Re:ESLint compromised, may have stolen your credentials by agmcleod on Tuesday July 17, 2018 @09:49AM (#17549696)
To be honest, i don't know if it's practical for something like this to be community funded. Ideally there would be a committee from multiple companies who have interest that can contribute. Node.js has a board for example.
[ Parent | on HN ]
Re:ESLint compromised, may have stolen your credentials by smsm42 on Thursday July 12, 2018 @03:56PM (#17518095)
How being VC-backed or for-profit is related to anything? Sounds like knee-jerk reaction - somebody screwed up, they are VC-backed, which proves VCs are evil and profits are evil. Let's not add such noise.
[ Parent | on HN ]