Re:What NPM should do to stop a new colors attack
by brigandish on Tuesday January 11, 2022 @01:06AM
(#29888151)
> are clean and clear legally because the victim chose to run their code
If you take a knife from my kitchen and use it on yourself that is not my fault.
If you ask me for a tissue and I provide you with a knife and tell you it's a tissue, then I have some responsibility.
Ultimately, in either case, why were you not more careful?
Re:What NPM should do to stop a new colors attack
by vertis on Tuesday January 11, 2022 @08:40AM
(#29891312)
I mean to strain the analogy it's more like feeding someone a sandwich and then having the ability to transmute the sandwich into a knife once they've already eaten it.
Re:What NPM should do to stop a new colors attack
by brigandish on Tuesday January 11, 2022 @08:44AM
(#29891350)
Did he meta-program that infinite loop? I haven't bothered to read the code… like everyone else :-D
Re:What NPM should do to stop a new colors attack
by syshum on Tuesday January 11, 2022 @03:35AM
(#29889014)
For me the question is was the new (breaking) functionality announced when the package was updated. It appears to me it was thus I find no issue.
This is different then software announcing on the next release they will include ads or even a crypto miner as part of revenue generation
As long as the change is announced then there is no ethical issues and if you as the dev or user fail to read the updates of your depencacy tree well that is a failing on your part
Not users of your code, platforms you distribute on, and that precedent has been rolling forward for a while now, it's not new. Even so, I don't approve of GitHub's ban, but that doesn't mean I have to endorse the author.
> People are choosing to run his code, and choosing to update to whatever new code he publishes, regardless of the contents.
This line of reasoning would suggest that the authors of malware that requires affirmative action to start running (download an exe, open a PDF, whatever) are clean and clear legally because the victim chose to run their code. How is this any different than a malicious EXE sitting on a server somewhere waiting to be downloaded? It can't just be that the victims in this case ought to have known better, because the victims in most cases of malware ought to have known better.