Re:What NPM should do to stop a new colors attack
by taberiand on Monday January 10, 2022 @09:47PM
(#29886723)
Everyone who had code that broke due to this (and, really, everyone else too) should see it as a clear wake up call that they need to do better managing their dependencies.
Re:What NPM should do to stop a new colors attack
by lolinder on Monday January 10, 2022 @09:53PM
(#29886776)
Yes. Just like everyone who gets ransomware on their computers should see it as a clear wake-up call to improve their security practices. It doesn't mean we shouldn't also condemn the attack that prompted the wake-up call.
Except for that he didn't just delete the code. He added malicious code that without warning broke applications at runtime, most likely disproportionately affecting small projects that lack rigorous dependency controls.
Companies can change their revenue model, but they don't get a blank check to do anything they want. See Toyota's recent blow-up with the key fobs as a counterpoint to your argument. It's one thing to phase out support for an old product. It's quite another to yank out the rug from under people without warning, and companies don't get a pass on that anymore than this guy should.