News for hackers. Stuff that matters.

A comment on What NPM should do to stop a new colors attack. Parent comment

Re:What NPM should do to stop a new colors attack by fivea on Monday January 10, 2022 @05:30PM (#29883763)
>>I think you’re being far too kind in your interpretation. If one wishes to stop maintaining, all you must do is nothing.

This sounds like a gross misrepresentation of what happened.

It has been reported that the author of the colors and faker packages announced last year that he was no longer willing to do free work for Fortune500 companies.

He also proceeded to state quite publicly that either companies paid him for his work, or they should fork the project and maintain it themselves instead of taking advantage of everyone else's work.

After a year has passed, the author proceeded to release a couple of major versions that had a more artistic feel.

https://web.archive.org/web/20210704022108/https://github.co...

Source:

https://www.theverge.com/2022/1/9/22874949/developer-corrupt...

These packages are his circus, and his clowns run the act he chooses.

If anything, this update showcases the completely abhorrent security culture in place in these mega-companies, which literally ingest into their product line anything that they can find on GitHub without a shred of due diligence.

[ Parent | on HN ]
Re:What NPM should do to stop a new colors attack by acdha on Monday January 10, 2022 @05:41PM (#29883938)
> After a year has passed, the author proceeded to release a couple of major versions that had a more artistic feel.

Artistic would be a new color scheme or maybe a “support open source maintainers” message. The accurate description you didn't give is sabotage because he introduced an infinite loop:

https://github.com/Marak/colors.js/commit/074a0f8ed0c31c35d1...

[ Parent | on HN ]
Re:What NPM should do to stop a new colors attack by fivea on Tuesday January 11, 2022 @02:26AM (#29888608)
> Artistic would be a new color scheme or maybe a “support open source maintainers” message.

The author already did that, and complained about fortune500 companies mooching their work without giving anything in return.

The author stated that people should fork the repo if they intended to keep using it.

The author made said statements a year ago. Is a year enough time to take action?

Now the author decided to do a major version release with a protest version of his own work, and that makes him a villain?

[ Parent | on HN ]
Re:What NPM should do to stop a new colors attack by acdha on Tuesday January 11, 2022 @07:00AM (#29890465)
> Now the author decided to do a major version release with a protest version of his own work, and that makes him a villain?

He did more than that, as noted in the comment you replied to.

[ Parent | on HN ]
Re:What NPM should do to stop a new colors attack by fivea on Tuesday January 11, 2022 @10:05AM (#29892241)
> He did more than that, as noted in the comment you replied to.

He really didn't. It matters nothing if you feel a commit breaks your code because you not only ignored the author but also failed to perform any sort of due diligence regarding what dependencies you ingest.

I mean, it was a major version bump. People blindly upgrade stuff without any regard about what goes in, and somehow that makes the guy who volunteered his work on a side project a villain?

There are a lot of red flags in this story, but the author of the colors flag ain't one of it.

[ Parent | on HN ]
Re:What NPM should do to stop a new colors attack by acdha on Tuesday January 11, 2022 @10:41AM (#29892776)
I see you've switched from “he didn't break anything” to “it's the users' fault for not catching what he broke faster”.

Hint: going from 1.4.0 to 1.4.1 is not a major version bump — https://snyk.io/vuln/npm:colors

[ Parent | on HN ]
Re:What NPM should do to stop a new colors attack by jamesfinlayson on Tuesday January 11, 2022 @02:07AM (#29888485)
Not to mention plenty of people (me at a big company included) used both of these packages as indirectly (as dependencies of dependencies) and had no idea about this until this week.
[ Parent | on HN ]