News for hackers. Stuff that matters.

A comment on Backdoor in event-stream library dependency. Parent comment

Re:Backdoor in event-stream library dependency by xvector on Monday November 26, 2018 @12:24PM (#18534994)
It’s about ethically handing off a package. No one is forcing him to maintain it. But when you make a package used by millions of people, you become responsible for their safety. To then hand over a package to a hacker or unknown party is just morally wrong.

Just mark it as deprecated and call it a day, like a normal and responsible person.

[ Parent | on HN ]
Re:Backdoor in event-stream library dependency by program9 on Monday November 26, 2018 @01:03PM (#18535390)
No -- downstream devs are responsible for the safety of their own apps, users, and org.
[ Parent | on HN ]
Re:Backdoor in event-stream library dependency by perfunctory on Monday November 26, 2018 @12:36PM (#18535115)
Well, he didn't really hand it over to a hacker, did he?
[ Parent | on HN ]
Re:Backdoor in event-stream library dependency by pcnix on Monday November 26, 2018 @12:38PM (#18535138)
His responsibility as a maintainer is to signal when there's a change in power, since the package is trusted via his credentials.
[ Parent | on HN ]
Re:Backdoor in event-stream library dependency by perfunctory on Monday November 26, 2018 @02:25PM (#18536062)
> the package is trusted via his credentials.

Somebody really needs to explain to me how this works. The dude's bio on github is "antipodean wandering albatross". Nothing against it btw.

[ Parent | on HN ]
Re:Backdoor in event-stream library dependency by sergiotapia on Monday November 26, 2018 @12:49PM (#18535263)
>But when you make a package used by millions of people, you become responsible for their safety.

Says you! I don't agree with that. Author clearly doesn't either. You're painting it as though the author knowingly handed it over to some hacker when in reality he had 0 cares about this package and just handed it over to the first guy who asked. I would have done the same probably.

[ Parent | on HN ]
Re:Backdoor in event-stream library dependency by quaunaut on Monday November 26, 2018 @12:59PM (#18535358)
This is incredibly irresponsible.

If you don't have the care to maintain it or do any sort of vetting, you shouldn't have the care to do anything at all. Literally, leaving this unmaintained would have been a better solution.

[ Parent | on HN ]