News for hackers. Stuff that matters.

A comment on What NPM should do to stop a new colors attack. Parent comment

Re:What NPM should do to stop a new colors attack by acdha on Tuesday January 11, 2022 @07:00AM (#29890465)
> Now the author decided to do a major version release with a protest version of his own work, and that makes him a villain?

He did more than that, as noted in the comment you replied to.

[ Parent | on HN ]
Re:What NPM should do to stop a new colors attack by fivea on Tuesday January 11, 2022 @10:05AM (#29892241)
> He did more than that, as noted in the comment you replied to.

He really didn't. It matters nothing if you feel a commit breaks your code because you not only ignored the author but also failed to perform any sort of due diligence regarding what dependencies you ingest.

I mean, it was a major version bump. People blindly upgrade stuff without any regard about what goes in, and somehow that makes the guy who volunteered his work on a side project a villain?

There are a lot of red flags in this story, but the author of the colors flag ain't one of it.

[ Parent | on HN ]
Re:What NPM should do to stop a new colors attack by acdha on Tuesday January 11, 2022 @10:41AM (#29892776)
I see you've switched from “he didn't break anything” to “it's the users' fault for not catching what he broke faster”.

Hint: going from 1.4.0 to 1.4.1 is not a major version bump — https://snyk.io/vuln/npm:colors

[ Parent | on HN ]