Hacker News Reader

Comment by perihelions | Hacker News Reader

Yes. You don't inconvenience thousands of engineers for philosophical reasons like "someone signed away their legal rights and now they regret it". FOSS is FOSS. The end-users are entitled to those packages -- the licenses explicitly say so.

It would be a breach of trust for a package manager to unjustifiably revoke users' access to a package. They don't have an option to be kind to the package author, because their duty to their users comes first. Putting the author's wishes over the users' professional expectations isn't something they have agency to do.

View on HN

I am wondering if there is a niche for a paid repository (npm or maven) that actually verifies/tests/analyzes libraries and recommends/bans libraries/versions that didn't pass such verifications. That could potentially prevent Equifax hack, Log4j, etc. Could be good for the enterprise.

I am frankly surprised that dependency attacks are not a big thing yet (or they are?) as we devs just throw in any dependency in if it looks like its doing the job.

Also many corporate repos are just a garbage bin of crap. I can quietly replace a library in the repo, make sure the projects grab my modified version before the release and rollback shortly after). I remember called this a "maven bomb" and discussed with my teammates and a manager - who didn't give a shit

What would prevent a free (gratis) repository from tracking everything the paid repository recommends, and simply cloning that? Like CentOS did with Red Hat. It's a difficult question when all the underlying work is FOSS.

Perhaps customers would be able to sponsor the review of specific packages.

This is sorta what Linux distros do, though it doesn't work as well for Java as something like Python.

Saying the end users are entitled to those packages because FOSS is FOSS is also a philosophical reason.

No: a FOSS license is a concrete and enforceable legal document that entitles the end-users.

Entitles them to what, exactly? If I publish a package that people use and decide to remove it, either by deleting the repository, the package from registries, or simply publishing dead code, are you saying it's a license violation? How does that make any sense?

Users are entitled to the project as far as the License grants them.

It does not enforce how a project is run or distributed.

If the author of is-even deleted his package who can tell him he is in the wrong?

The host who can according to the license continue to host it for the other 99.999% of users. The host for example NPM is the one who owns the service and need not provide the uploader with the privilege of revocation.

And then if there is a CVE along the way someone has to go and maintain it and thats exactly what no one wants to do

Seems like they could simply provide a way to notify users and service of something like that without providing the ability to unilaterally yank it.

How are you going to distribute that message? Over NPM? No one is going to read that.

At best the community can stand up and fork which means they have to move ownership to some rando

Well first by communicating with NPM which could take an extraordinary action to break builds in the case where this is the least bad actions or by doing something logical and providing developers or company contacts to register to receive warnings ideally based on parsing actual dep versions and transmitting a message directly to the designated contact for a project.

Reply on news.ycombinator.com