News for hackers. Stuff that matters.

A comment on What NPM should do to stop a new colors attack. Parent comment

Re:What NPM should do to stop a new colors attack by oauea on Tuesday January 11, 2022 @11:28AM (#29893603)
> Are (D)DoS attacks wrong?

Yes, if you attack infrastructure that you do not have permission to test. Here people downloaded code, ran it on their own infrastructure (or worse: shipped it to their users!) and were surprised this code did not do what they expected.

So, the only malicious actors here are those who shipped the package to their end users. Not the developer, they did not ship the code to anyone. They simply released a new version that other people chose to download and include in their own work.

To be clear, it's a total dick move and I don't support it at all, but the real blame should go to those who blindly download such code and run or redistribute it.

[ Parent | on HN ]
Re:What NPM should do to stop a new colors attack by shepherdjerred on Tuesday January 11, 2022 @01:38PM (#29895685)
I totally agree.

We need better tools to prevent things like this from happening again because nobody is ever going to audit the 2000 dependencies of every new create-react-app release.

[ Parent | on HN ]