NPM won't publish packages containing the word keygen | Hacker News Reader

NPM won't publish packages containing the word keygen

mamot.fr

245 pointsfranky47256 comments

I thought buttbuttination taught everyone how incredibly stupid this is 25-30 years or so ago already?

But no. Just a few years ago I tried to enter an answer into a Hungarian Q&A site recommending to take the Algeciras-Tangier ferry and the answer was refused. https://en.wiktionary.org/wiki/geci

The Scunthorpe problem all over again.

https://en.wikipedia.org/wiki/Scunthorpe_problem

tee hee.

wait... are you implying that "k*ygen" is a dirty word?

Dirty word in the context of security, copyright liability, etc.

Ah yes, the age-old hacking tool: ssh-keygen.

Don't spill the hacker secrets!

Just learned "keygen" is the term the script-kiddies use to describe the act of generating fake activation keys. Never let it be said HN is not educational. But I feel the same way I felt when I noticed idiots using "crypto" to refer to cryptocurrency instead of cryptography.

Keygen has been around for for at least 30 years, whereas people misusing the term “crypto” has only been around for five years or so.

Why is it a misuse to use "crypto" to refer to a currency whose design relies on secrets, but it's fine to use "crypto" to refer to keeping communications private using some secret information?

I do crypto the airport (opening the barriers with my passport, where the computer in my passport signs a challenge encrypted with its pubkey) and do crypto with my phone (making a call, which is encrypted with Ericsson SNOW), and do crypto at the corner shop (using my card, same as the passport).

If airports, phones, and corner shops claimed they 'work in crypto' it would be similarly misleading.

Even Toly refers to himself as a distributed systems engineer, because building a blockchain involves more DS work than crypto work.

FWIW I work in web3/defi, used to work in PKI.

"Crypto" has been around for much longer than 5 years. I remember someone using it in reference to a Motorola DES chip in the late 70s. And the IACR Crypto conference has been going on since the early 80s.

Greetings! I am here to derail the thread with a remark about "organic chemistry" versus "organic foods".

Sometimes being there first doesn't mean you get to use the simplification forever. Cryptography is an older thing than cryptocurrency, but both are unwieldy to pronounce and have been simplified to "crypto". Since cryptography is math and cryptocurrencies (in the "popular" sphere) is a get rich quick scheme, the abbreviation that works for both generally became applied to the latter.

I am sure organic chemists are a little weirded out when people tell them "oh yeah I love those new strawberries we got". This is that.

You're getting downvoted but I also don't understand the relevance here. Parent seems to imply this is a mistake by npm relying on partial censorship but aren't they literally banning this exact word?

Don't get me started

Shouldn't it be spelled "de Kok" if that's a surname?

No, because of Baantjer.

Met seej ow seej kaa.

De Kok, De Cock, De Kock, De Cok, ... All the same. Surname spelling was highly volatile before the French took over.

Beware reading Philip K Dick.

I only recently learned that my username for 20 years has "orgy" in it, and I've been getting blocked by many games

20+ years of this handle online without problems, and I found out trying to sign up for Stern Pinball Insider that "bint" is a dirty word: https://en.wiktionary.org/wiki/bint

Really isn't, it's about the same as calling a woman a cow.

Wrong.

Usage varies, but "bint" more commonly is akin to "b*tch", and is used in a very coarse and derogatory manner.

Love how you're trying to justify degrees of acceptable misogynist terms, though /s

Um? Here in the UK it's uncommon to hear it these days but it carries no special weight.

How come you're unwilling to spell the word bitch?

You yourself imply there are different degrees to how acceptable the two terms are.

Why else do you spell out one word but censor the other?

Yes, and your definition is by far the exception, not the rule. Maybe don't claim a definitive meaning when you're wrong to begin with.

One is much more likely to set off censors. Why do you feel the need to ask ridiculous questions? The word you use had already been said, censoring it would be meaningless -- whereas you ascertained the word I meant easily ;)

I’m not actually the first person you were talking to, so I didn’t give you any definition.

In fact, if you note, I’ve never actually used either word. I just refer to them obliquely.

"You yourself imply there are different degrees to how acceptable the two terms are."

I never claimed either were acceptable or unacceptable.

Interesting how you completely gloss over your needless language policing, especially when you - by your own admission -- haven't even used the terms in question (and presumably lack the nuance necessary to weigh in, despite jumping in anyway) shrug

> I never claimed either were acceptable or unacceptable

and

> Love how you're trying to justify degrees of acceptable misogynist terms

So you are not saying either are unacceptable, and you endorse 'acceptable' misogyny. So you are a misogynist, but an ok one.

Very well.

What the ever-loving fuck? I don't endorse ANY misogyny you utter melon, which was why I called you out on your "Really isn't, it's about the same as calling a woman a cow." nonsense.

The only one "endorsing" misogyny here is you. Stop projecting, pillock.

“I mean, if I went 'round saying I was an emperor, just because some moistened bint had lobbed a scimitar at me, they'd put me away!”

This page is a delight to read.

Filters like that are so trivial to bypass on a higher level too. Look at how many gamer or forum tags are “Lovecraft’s Cat”. And good luck catching those cases on a non-manual basis.

I once happened across a Github where all the repos were subtle little bits of anti-Semitic cant relating to the Holocaust. More than subverting them, they also often function as dog-whistles for fellow travelers.

(For those not getting the specific one used above, Lovecraft had a black cat and a common name for black cats at the time combined a now nigh-unprintable racial slur for black people with the word 'man'.)

Github has a reporting feature!

There’s an NFT collection called Milady which has subtle Holocaust references - ‘Treblinka’ written on shirts, the rarest traits are ‘SS’ tier etc.

Make sure you travel via Penistone on your way there

I assume that's near Scunthorpe

How does Massachusetts get a pass?

Related, here's a pretty impressive attempt to detect bad words, to allow a talking banana on a Twitch live stream, without being banned: https://www.youtube.com/watch?v=bJ5ppf0po3k

I use the same method for a Twitch TTS system I built and it works very, very well.

I call systems that attempt to filter out bad words and fall prey to the Scunthorpe problem as "failing the Scunthorpe test".

There are people that fail the test, too - such as people who think that the terms "whitelist" and "blacklist" are offensive.

LOL, that is a great mnemonic! Now I will always remember how to spell assassination.

Also known as a clbuttic error.

For the uninitiated, the origin of (the popularity of) clbuttic: https://thedailywtf.com/articles/The-Clbuttic-Mistake-

Everyone did, but Microsoft continues to be terrible. Replace Edge with GitHub or npm or vscode and see what a trap this is.

- npm sends images you view online to GitHub

- vscode bakes a VPN into npm and turns it on

- The dark defaults of npm

- vscode records editing (browsing) history in InPrivate mode

Azure or OpenAI seem even worse. And Windows has a lot of Edge-like things built into it, including how it tries to get users to use Edge.

Did you reply to the wrong comment?

At the dawn of the search engine age I was in Japan, and so I spent some time not being able to learn about shitake mushrooms, as was a common western spelling at the time (they are not shi-ta-ke mushrooms, they are in fact shi-i-ta-ke mushrooms, hence the spelling change, even though we still pronounce them wrong).

You couldn’t say shit on the internet. I mean what the fuck.

... the dirty bastards https://www.youtube.com/watch?v=ndcPtU6Imc0

"shi-i-ta-ke" is not very accurate. It's a long vowel, and the word has three syllables.

But english mostly ignores long vowels, hence the alternate spelling.

It's funny, because in Old English ('Anglo-Saxon'), vowel and consonant length are both semantically important.

For those of you who want to have a better handle on the distinction, you can think of it as the sound having an extra 'beat', where a beat is the amount of time pronouncing that sound normally occupies.

It's easier if you take advantage of the one place English still distinguishes this: word boundaries.

Listen how you say, for example: Tibetan nitwit (you're holding the 'n' for two beats because your brain treats the distinction as important /when it's at a word boundary). You can do this with vowels too as an exercise, though they're a bit harder because English has a lot of vowels and finding good matches is a bit difficult.

I run a business called Keygen [^0], and own the @keygen namespace on npm. We’re working on a Node SDK, so this isn’t good to hear. I’ll open up a discussion with them and see what we can do.

[^0]: https://keygen.sh

Have you had any publishing issues? My last successful publish on this package was 3 months ago, and I started noticing issues with deploys a few weeks back.

Three fun days of CI/CD pipeline debugging to get to this..

After digging around, I found the org and I do own @keygen. And I was able to publish an empty package to the org: https://www.npmjs.com/package/@keygen/js.

But it doesn't look like it's searchable, unless there's a caching issue.

It is searchable now, at least: https://i.imgur.com/kFDSuHE.png

Try using a Russian Cyrillic е or к or у

Sure no one will be able to install the app from the CLI (unless there is a bug in npm’s parsing logic) but you should be fine distributing hyperlinks to skim-readers ;)

кейген

Unicode works under xterm and urxvt since long ago, also people can just copy and paste...

unrelated to your question: Your website's very pretty, but doesn't scroll horizontally on mobile. It also looks like there might be a bug in the code sample - where does "fingerprint" come from?

It doesn't scroll on desktop either, I guess the world still is not ready for people having multiple windows open in parallel.

It scrolls fine here with JS disabled.

You need to move your phone horizontally in order to scroll. It's a new spacial computing type of scrolling. /jk

Why would you want to scroll horizontally? Or are you referring to the code samples? It's only a code "sample" (i.e. non-working just to show off the platform), so fingerprint would likely come from something like https://github.com/denisbrodbeck/machineid. Full examples are available in the Go SDK docs [^0].

[^0]: https://github.com/keygen-sh/keygen-go

The functionality makes sense given this response. The code sample is not fully viewable without a horizontal scroll; it's cut off about 20 columns in. It's as if you're presenting 2/3 of your website, but not allowing the user to see anything else.

Please enable horizontal scrolling. I wanted to view the code sample on mobile.

Code samples are usually more relevant than marketing messages.

Thanks for the feedback. Makes total sense. I'll make this change.

(I wasn't expecting so much traffic and feedback today lol)

Could it be that they are doing this as a way of preventing packages spoofing the namespace (ex. 'keygen-core')?

That would be terrible, because if someone owns the @express namespace that isn't express team (not gonna happen, just illustrating why this idea is bad), then goodbye all `express-*` packages.

Time to change the name of your business to kexgen I guess.

GenKey?

Our CLI already uses genkey as a command so unfortunately that's no bueno:

    keygen genkey

Can't do genkey genkey. That's just weird...

I mean, you could just flip it around?

    genkey keygen

Sounds jankey...

GeyKen?

sounds too muck like JenKens.

it sounds too much like "janky" to me

Calling any modern software "janky" is just truth in advertisement.

kekgen

kek is orc for lol.

KeyJen.

I actually was going to originally name the company KeyGin. The first prototype was called that.

Thank God I didn't lol.

Better idea.

KeyDjinn

Keygyn

Get in that extra level of possible scandal.

Either way, the logos practically make themselves.

Unrelated, but your homepage has very bad FPS using firefox on mac due to the animation. Once I manage to scroll it works quite well.

Thanks. That shader doesn't seem to play nicely with some GPUs and I'm still working on edge cases. If possible, could you look at your console logs and email me your specs? They should be logged. Email is in bio. It should be doing automatic categorization of the GPU to determine render quality, but maybe something's still incorrect there.

Just turn it off.

It does turn off when it detects a low-end or integrated GPU. But something may not be working correctly, or is getting miscategorized.

That's why the debug information would help.

Or, again, turn it off and avoid the whole class of issues, wasted time and asking random HN folk for debug logs.

Don’t listen to random comments on hacker news. It looks cool OP. Don’t throw out the whole thing for a few bugs

Yeah, as long as we're focused on the really important things. Like animations that nobody actually needs or wants (apart from the person putting it there). That is, of course, until it ruins the user experience by bogging down the browser. And then, sure, let's debug that and make sure it runs on everyone's browser/os/cpu/gpu combo. That's a brilliant use of time.

Until someone turns up with a new combo where it doesn't work. Because judging by the comments, this seems to be a janky piece of code that isn't well understood.

"Turn it off" (or rather, "rip it out, and throw it away" is good advice. If there is even a slight chance this might come back to haunt you and screw the user experience, it isn't worth it. If your animation is more important than avoiding a horrible user experience, well, that's kind of useful for your customers I suppose.

How do you imagine user conversations take place, if not from "random HN folk"?

Do you want an appointment? A lab?

When you emailed me about this a few weeks ago I played around a bit with the shader, and just creating fewer blobs made the problem go away (reducing "for (int i = 0; i < 15; i += 1) {" to 5 in the "void main"), but I didn't really have the time to investigate in-depth or see what kind of visual effects that would give (dealing with this minified JS isn't exactly fun and I never worked with OpenGL shaders either), but just FYI.

Good to hear it's not just me though (and the effects also aren't disabled for me either).

No problems here with firefox on x11 and amdgpu/mesa drivers fwiw

With respect, all of that for some bokeh? Is it worth it for y’all? Do you know how many folks just leave when the stuttering starts?

The entire lava lamp effect is a shader, not just the bokeh. :)

I haven't noticed any drop in registrations, conversions, or any noticeable differences in traffic patterns after launching the redesign, so I'm not sure if this is actually happening. Though it's a valid concern and issue, and I do want to fix it. And I appreciate all the reports. I think it may be a retina resolution issue, but could be wrong.

On launch day, everyone loved the effect (it goes along with the new logo) and only a couple people said it performed badly, but they were on exotic devices.

I may have caused this a few days ago when I enabled rendering at retina resolution for tier 3 devices. What I wasn't expecting was so many tier 3 devices that aren't really what I'd consider "tier 3." I was expecting all tier 3 devices to be gaming-level GPUs.

I guess I should have read the source [^0] more closely and I could've avoid this.

[^0]: https://github.com/pmndrs/detect-gpu/

> What I wasn't expecting was so many tier 3 devices that aren't really what I'd consider "tier 3." I was expecting all tier 3 devices to be gaming-level GPUs.

Could be the detection of GPUs doesn't work correctly? My nVidia 1080Ti is detected as nVidia 980Ti, and a sibling comment mentions an integrated laptop GPU being detected as tier 3 with isMobile=false.

Another danger here is testing with the website being the only thing on the PC: some people use their computers like that but many others will have many different things open at once: just because it can run at an acceptable FPS on the detected hardware doesn't mean the resource use is acceptable on a system which is multitasking. I usually have >100 tabs in my browser and at least 20 of which are loaded: they cannot all demand what your site demands, even though the hardware is quite high-end.

How many tabs are simultaneously visible? An animation in a non-selected tab won't get much in the way of resources, so the number of loaded tabs shouldn't be a big factor.

I'm not the person you replied to, but it's janky for me, too.

Console logs: device: undefined, fps: 60, gpu: amd renoir, isMobile: false, tier: 3

FWIW, my laptop is a relatively beefy 2021 model (granted, with integrated GPU). For a business that's not about 3D rendering, spending an innovation token on making sure your landing page can have a smooth background animation seems like it's playing on hard mode.

Yeah this feels totally broken on my M1 Pro running Ventura.

It stutters on an M1 Macbook running Chrome, for example.

M1 running Safari (specifically Orion) works 60fps... How?!

Battery vs plugged into a power outlet? Maybe Apple throttles the GPU to save battery.

It's also horrifically slow on Chrome macOS:

    {
        "fps": 130,
        "gpu": "amd radeon pro 5300m",
        "isMobile": false,
        "tier": 3,
        "type": "BENCHMARK"
    }

Definitely wasn't 130 FPS and made the whole page stuttery.

Works horrendously bad on Firefox, works great on Safari/Orion...

Macbook Pro M1

Interesting. I wonder if this is a retina display issue. I just pushed out a change that renders the shader at standard resolution even if the device has a retina display. I don't have a retina display on any of my devices except a 2019 MBA and it renders fine on it. I wonder why.

> I wonder if this is a retina display issue

I'm using an external monitor running at 5120x1440 (Samsung, not retina) only, and am experiencing the the same on Firefox.

At least not retina exclusive.

Oh wow. Sounds like I should put an upper bound on resolution. I wasn't even thinking of somebody opening the page full-screen on an ultra-wide.

Your homepage needing a shader is at least a hot-pink flag for the whole company. Pretty janky here on Vivaldi as well unless I scroll really slowly.

What do you mean by this? I wrote the shader because gamedev is an interest of mine, and I wanted to give writing a fragment shader a try for the redesign.

Because it's not bad enough to be a red flag but it does make me wary of the company's priorities. You used a complicated shader to make a scroll bar that doesn't scroll, which may as well have been a static background image, and half-visible janky blobs in the background I thought at first were eye floaters. The crushed font looks like a rendering error and the e's and s's looking identical made me stare at the word "businesses" because I swore it was misspelled. I do have to say the color scheme is gorgeous though.

GPU: {device: undefined, fps: 342, gpu: 'apple m1 pro', isMobile: false, tier: 3, type: "BENCHMARK"}

Despite the supposedly high FPS it's very jumpy/laggy in Firefox, though fast in Safari.

With all due respect, this is possibly the dumbest rebuttal I've heard. Why do I need a powerful GPU or even need my GPU to waste compute cycles just to view a webpage?

Just get rid of it entirely. The visual flair is not adding any value. It's a performance drag, highly distracting, and serves no useful purpose whatsoever. This "trend" in modern web design is truly infuriating.

Wasn't expecting so much candid feedback today. There was a Launch HN yesterday that had a 3D rubik's cube on their home page. It was literally pointless. But kind of neat. But you probably hated that as well, if I could assume. But I say that to point out that lots of companies do it, sometimes simply because we can (just look at Stripe and GitHub).

I think the lava lamp effect is cool. The perf issues can and will be fixed.

I went and found that Launch HN, and yeah, that rubik's cube is horrendous on my computer. They did not do as much effort as you did to make it work on low end machines. I don't have a GPU at all; your site disables the background effect but their site shows the cube anyway. Their site drags once that rubik's cube appears, and the cube itself animates at 1-2 fps. It's a very poor experience and I don't really see what the cube adds, but I do see what the cube subtracts.

(Your site works fine on my computer. The effect is disabled and it's not a problem.)

I'm sorry, but what should just. be a _progressive enhancement_ in this case completely ruins the user experience for me. However, I'm probably not your target audience, I'm just commenting on this trend in general.

It literally is a progressive enhancement, so I'm not sure what your point is.

There's clearly bugs where it's enabled where it shouldn't be, and that's certainly an issue, but the comments here make it clear that it gets disabled automatically on lower-end devices.

I appreciate you engaging with commenters on this, it’s nice to see.

From my perspective I agree with a lot of the other commenters - it’s just design for design’s sake. It’s an expensive way to add minor visual flair that heavily degrades the experience for a sizeable number of users. In terms of value provided to the user: it’s basically zero, or often worse than zero.

Personally, it feels over-designed, which the stretched font for the headings really reinforces. I’d drop the shader, re-evaluate your font choice for the headings, and focus on layout and readability a little more - using the site on my iPhone feels really cramped and like the whole page is getting cut off on the right-hand side constantly. I can’t scroll horizontally to see the rest of the code, for example.

I do like the little text-flicker/flipboard animation on the “keygen” logo though. That looks clean and well-suited to the theme of the site.

I spent weeks on the typography and on choosing a font. Went through so many different styles. I ended up on Owners by MCKL [^0] because I personally like the ultra-wide font trend, and I liked its Text variant as well. Bummed to hear that others aren't a fan of it. Oh well, design is pretty subjective.

And it may be over-designed. It was my first foray back into design since switching careers to programming about 10 years ago. Maybe I took it a bit too far? Felt good to stretch those muscles, though. :)

[^0]: https://mckltype.com/owners/

That wide font is on purpose?! No offense, but I was sure something went wrong with rendering the page.

It didn't quite register as a "display" font variant usually does for me either -- the only feature is the width (it's a nonfancy sans-serif, what do you expect) so it somehow just feels like it's been squished. Intellectually I know it's definitely not a simple scale-transformation and must have involved some curve work to make it look less off, but I just can't shake the feeling of having seen text getting run over by a truck.

Yes other companies have animations but they make sure it performs well across browsers and OSs.

Mac+Firefox users are probably in your customer base. Listen to the feedback.

Looks good on the 4090 here, ship it

Not sure why people are hating so hard on your site, but I liked the effect, and it didn't cause any problems for me.

Speaking as someone that blocks javascript by default, the page doesn't look too bad!

That’s just your opinion, man. I checked the site on iPhone and would say that it’s better than 80% of the sites I see. No performance issues at all. The extra wide font I don’t like however.

So I took a look at the actual shader, and it really should not require anything powerful (decade old, worst-you-can-get hardware might struggle). A much more likely explanation (that the gp is alluding to but didn't explicitly say) is that the issue is related to your GPU drivers or related software. These are often buggy and/or hit a slow path for whatever reason. This is almost guaranteed to happen for some browser/os/hardware/driver combo (of which there are _many_) and you seem to have drawn today's short stick.
The animation itself looks fine, its slow enough that it doesn't feel distracting. Just a bit of flavor.

Its mostly just a few calls to a cheap noise function and no footguns I can see. Also hurrah for dev tools and open text formats! If you're looking for better performance, it looks like the noise could be precomputed (the same blob always gets the same noise)". Might be faster, might just hit more bugs.

It's working fine for me on windows and firefox

device: undefined

fps: 30

gpu: "intel mesa dri intel hd graphics 400"

isMobile: false

tier: 2

type: "BENCHMARK"

I'm questioning whether or not I should continue into the realm of gamedev... the amount of "works on my igpu from 2015 in low power mode" and "stutters on my rtx 4070 ti" here is making me laugh out loud.

Tbh, games with the most problems usually run home-grown engines that try to do too much.

Janky for me even when scrolling has started. 2021 M1 MBP.

The pixel shader is cool, but consumes too much resources. On my 1080Ti, uses about 20% of GPU to render, which is too expensive for such a simple graphics.

I’ve looked at the source, and it seems you’re doing too much computations there. Metaballs are usually rather simple, and they don’t require any trigonometric functions. Compute something like `sum( ball.z / length( pixel - ball.xy ) )` and apply the threshold. If you want anti-aliasing, use fwidth() for the screen-space partial derivative of that value after the loop, compute two thresholds around the iso-value, then smoothstep() instead of a hard threshold.

Also, consider moving the ball parameters (center and size) into a constant buffer and update them on CPU. Because there’s just a few balls, JavaScript is good enough for the job. Your current version computes these things from time for each pixel for each frame. There’re about 8 megapixels on my display, so these computation costs are escalating very quickly.

My lack of knowledge in shaders is showing. :)

I sent you an email with a job offer.

this works fine for me on mobile brave

+1 the website is borderline unusable on my work laptop. I have an M1 Pro in my standard MacBook Pro 2021. I am using the latest version Chrome and this animation causes a huge performance regression on my computer when it's visible.

Also runs terrible on my Pixel 5 with Firefox. As for your design choices, they remind me of the Mezmo landing page...

It's very laggy for me, and I'm on high end hardware.

{"CANVASES":2,"GPU":{"fps":209,"gpu":"apple m2","isMobile":false,"tier":3,"type":"BENCHMARK"},"RESOLUTION_RATIO":2,"BLOB_COUNT":20,"BLOB_AMPLITUDE":"52.60","BLOB_RADIUS":"2.54","POSITION_X":"4.43","POSITION_Y":"1.72","RANGE_X":"4.64","RANGE_Y":"6.51","SPEED_X":"9.60","SPEED_Y":"4.51"}

>mac

Sorry, that's what you get for not using a normal computer.

The VC partners who call the shots here all use macs, give me a break. http://gg.gg/14h9m9

Nice to see an alternative to FlexLM. That package was the bane of my existence when we had a bazillion RS/6000s running AIX. And when I worked at Borland, I campaigned (unsuccessfully) against its use.

I didn't know there was a name for this, what a fun Wikipedia rabbit hole[1]. Pretty entertaining that censors still don't get it right decades later.

[1]: https://en.wikipedia.org/wiki/Scunthorpe_problem

The solution is to examine all words that contain that substring and explicitly whitelist them.

Nowadays though, we have a different Scunthorpe problem. I call it the "Hidden Garfield" problem, because that phrase is detected as a racial slur after you run Double Metaphone on it and throw out spaces.

Unrelated, but I ahev been a user for some years, you rock.

Unrelated question, on your site, how do i close the cookie banner? On my phone it obscures most of the screen and i can’t dismiss it.

Bottom right cog icon, or tap anywhere outside of the drawer.

Keyword moderation feels like an unspirited attempt by developers to satisfy incompetent managers telling them to get other incompetent managers, upset about piracy, off their backs. I don't believe anyone involved actually thinks this will make a difference. It's just to address a complaint.

That's almost certainly the case. "What can we do that has an observable effect we can demonstrate as us being responsive, but doesn't have a significant cost [to ourselves]".

It's the same as any other "this shouldn't be done, but a manager asks me to do it". If you aren't ready to die on that hill as I would, then there is nothing you can do. I'd easily take that fight but that's coming from a very privileged position (i.e., I'd not risk not having food on the table if I said no when a manager asked me to add keyword moderation or a dark-pattern cookie banner).

"see boss, nothing is using the word "keygen", so obviously we have removed all keygens".

keyword moderation is terrible and only affects the language(s) you know about. It doesn't actually prevent the content (the goal of these types of filters) from being served. It'd be like a virus scanner preventing a program from running because it had the name 'virus' in it ... which would prevent itself from running -- probably.

My favorite is the online name censoring in video games. Dark Souls infamously just does a straight check of any string match within the name against a big list of no-no words. So in this fantasy game where everyone is running around as a knight, anyone who has "knight" in their game will appear as "k***ht" to other players.

There's also a famous image I've seen online from another game where the guy's name was Nasser which appeared for everyone else in-game as "N***er"

I remember a conversation with some using an in-house file transfer system “Oh you won’t be able to send more than X GBytes, at that point the chances that the base64 encoding contains a banned rude word become too high, and the transfer will fail”

I wonder what the optimal encoding is given a list of banned words for any substring of a message.

Just use a r-ANS entropy coder with feedback skipping symbols that would result in a ban from being possible to encode at that moment... I think.

Unless I've gotten confused about the limits of dynamic prediction abilities in ANS.

I think it's just that the encoder and decoder run in opposite directions through the encoded symbols, but read-ahead during decoding shouldn't be a problem...

gzip?

A random binary string will be accepted until something between 4 and 8 times the size.

Wow that may be the dumbest thing I’ve heard today

Maybe it's time to convert base64 to high UTF8-areas. I guess there won't be any keyword-filter yet for ancient egyptian hieroglyphs. I'm curious whether there are already emoji-filters...

https://github.com/qntm/base32768

https://github.com/keith-turner/ecoji

> ecoji

In a similar vein, a former colleague of mine created this Python package: https://pypi.org/project/piickle/

It's functionally the same as pickle, except it binary-encodes the data with spaces and pickle emoji.

Matt Grey & Tom Scott had to build an emoji filter, I believe. https://www.youtube.com/watch?v=GsyhGHUEt-k

This is awesome

Here's list of substrings World of Warcraft checks in character names.

https://wow.tools/dbc/?dbc=namesprofanity&build=10.0.5.47660...

They spent great effort to build this list.

Most character names in the game are lame anyway and some are just offensive or inappropriate.

"colgate" is rude.

"bra" is rude.

"maxipad" is rude.

"masterbaiter" is rude and funny.

"amputee" is rude, even.

This goes far...

Why is "amputee" rude?

It makes sense for Dark Souls games because multiplayer is a lot less optional. Player names will appear in your game, and turning this feature off really hurts the experience.

Their hamfisted approach leaves a lot to be desired. I have a feeling it is a product of being designed and implemented by non-native English speakers.

My favorite is Fark's word-changing filters and their unintended side effects. The no-no words are scanned across whitespace and reversed, and any hits get translated to the approved word. "Shit" becomes "Shiat", the N word becomes "nubian", etc

Every so often someone will find their sentence that contains something like "I will have ham or egg in my sandwich" becomes "I will have ham onaibun my sandwich"

Reminds me of Yahoo's botched e-mail filter in the early 2000s, when in an attempt to prevent Javascript exploits they automatically replaced all occurrences of a few script-related keywords with alternative terms – even in the text body of a mail and without regards to word boundaries. "eval" got replaced by "review", leading to such words as "medireview" (medieval), "reviewuation" (evaluation), "rereviewuation" (reevaluation), "prreviewent" (prevalent) and suchlike.

If you search for some of those terms, you can still find traces of them across the internet and even in some published scientific papers.

> My favorite is the online name censoring in video games.

I don't know what the filters are like in EverQuest nowadays [1], but back in 2000 EQ didn't allow "cock" in chat. Then in April 2000 the expansion "The Ruins of Kunark" came and some of the zones that pretty much everyone making their first trips to Kunark would visit contained a variety of hostile cockatrices, and the chat filter would not let you mention them because of the "cock" at the start of their names.

I once had occasion to implement a chat system for a small online gaming service and was supposed to filter out bad language. What I did was something like this:

1. Split the message into words.

2. For each word that is in /usr/share/dict/words or our own list of good words and is not on our bad words list, mark each character in that word as being good.

3. Concatenate all the words.

4. Find all places where words from the bad list appear as substrings of that concatenated string.

5. For any such bad words in the concatenated string mask the corresponding characters in the original message with asterisks unless all of the bad word's characters in the concatenated string are marked as good.

For example the word "cockatrice" would have been uncensored even if "cock" was on our bad list because "cockatrice" is in /usr/share/dict/words and would not have been on the bad list. On the other hand "cocksucker" would have had the "cock" masked.

If someone had tried to slip "cocksucker" by by inserting spaces such as "c o c k s u c k e r" the "cock" part would have still been masked, because the "c o c k" would have ended up as "cock" in the concatenated string, and not marked as good.

Note that you would have been able to call someone a "peacock sucker" just fine, because "peacock" is in /usr/share/dict/words. Misspell that as "peecock sucker" though and then the "cock" part would have been masked.

I was fine with that. I figured it encouraged good spelling among those who want to insult others. :-)

(There was a little more, such as dealing with tricks like using 3 for e or \/\/ for w but those aren't really relevant to the general idea).

[1] Yes, EQ is still around...and with the changes it has undergone over the years it is actually a pretty nice solo or small group game even on a free play account, especially if you have an old account to reactive so you get veteran rewards. Here's a description of some of the major changes [2]. When I returned to EQ a few years ago, I had no trouble playing a solo Bard to around level 60 on free play. Things got a bit slow then and I switched to paid. I then made reasonable progress up until I had finally satisfied my

[2] https://news.ycombinator.com/item?id=31368588

> keyword moderation is terrible and only affects the language(s) you know about.

It doesn't seem that hard for npm to review lists of the most common keyword searches and identify the ones strongly associated with piracy (or other things negative for their business).

I agree, though, that keyword moderation is pretty terrible. It might work from npm's perspective, in that it might be annoying enough to pirates that they'll find some more convenient place to upload/download. I don't think it will have any overall impact on privacy though.

I love keyword moderation. I love finding ways to demonstrate to those using it that it's futile by using only non-offensive words to thoroughly offend people. I was given a talking-to by a game administrator once for naming a match "Your granny rides my throbbing purple rod." It didn't contain any no-no words, though!

Author here, with some context: the relevant package [1] generates key material to setup an end-to-end encryption SDK [2], based on libsodium and OPAQUE.

[1] https://www.npmjs.com/package/@socialgouv/e2esdk-keygen

[2] https://github.com/SocialGouv/e2esdk

Oh. As the creator and reluctant maintainer of npm's "ssh-keygen", this is awkward!

First question: does this mean I won't be able to publish patches to the package?

Why do I not want this package under my control? The original package simply calls spawn for your real `ssh-keygen` with the appropriate arguments. No real problem, (although there is very little value here). But a contributor added support for Windows by uploading opaque binary builds for Windows. While I have no reason to distrust the contributor, it is scary to be "responsible" for opaque executables that I did not personally produce.

So, what should I do with this package? Assuming npm lets me do anything?

Fortunately this package is "only" downloaded ~1600 times/week, miniscule for npm. If you are tempted to use ssh-keygen, I recommend you learn how to use execFile/spawn, and use the native program directly.

For context, I published this 10 years ago, as one of my earliest contributions to open source. I probably wouldn't have gone near any security-essential contributions if I had more experience at the time.

> But a contributor added support for Windows by uploading opaque binary builds for Windows

> "only" downloaded ~1600 times/week

This begs for an audit.

Yes.

If npm lets me publish a new version, I'd be happy to remove the Windows binaries.

Reminds me of the times I've seen junior devs changing "password" to "wordpass" to bypass automated commit checks for sensitive data.

These kinds of checks are so trivially defeated, the only people they actually stop is people trying to do legitimate work.

Presumably some of those devs will see the warning and think "oh yeah, I probably shouldn't commit the password" rather than find a workaround.

I really hope their password isn't literally "password", so I can't see how blocking that word improves anything.

Tbh in this case that check is useful. It prevents devs from accidentally including passwords in their commits.

Not a perfect example, but the point is that it's not stopping anyone from doing anything malicious.

Such rules are so dumb and easy to circumvent, it is like parent filtering all over again!

Oh btw, do they allow "breast" in package names?

I have a pet theory that the language police learned their habits from these systems that have no better way than keyword moderation.

It's the 80s all over again. But instead of puritanical sysops it's huge multinational corporations. Maybe we'll just call them k3yg3n5.

𝔎𝔢𝔶𝔤𝔢𝔫 𝕶𝖊𝖞𝖌𝖊𝖓 𝐊€ｙģ€ℕ 𝓚𝓮𝔂𝓰𝓮𝓷 𝒦𝑒𝓎𝑔𝑒𝓃 𝕂𝕖𝕪𝕘𝕖𝕟 Ｋｅｙｇｅｎ ᛕꫀꪗᧁꫀꪀ Kꫀׁׅܻᨮ꫶ׁׅ֮ᧁׁꫀׁׅܻꪀׁׅ

K⃞ e⃞ y⃞ g⃞ e⃞ n⃞

Ⓚⓔⓨⓖⓔⓝ кєץﻮєภ Nguyen ᏦᏋᎩᎶᏋᏁ kēฯງēຖ 𝐊𝐞𝐲𝐠𝐞𝐧 𝗞𝗲𝘆𝗴𝗲𝗻 𝘒𝘦𝘺𝘨𝘦𝘯 𝙆𝙚𝙮𝙜𝙚𝙣 𝙺𝚎𝚢𝚐𝚎𝚗

I must be missing something obvious. What's malicious about the word "keygen"?

What's the issue with ssh-keygen? gpg --gen-key?

Back in the day, paid software used to use serial keys for activation. Keygens made valid reg keys using the same algorithm so you could pirate software easily.

Piracy. Programs that generate activation codes for proprietary software are called keygens. They usually come with interesting musical accompaniments.

Keygens may or may not facilitate piracy, but they're not themselves piracy.

This is just some ridiculous NPM policy. What will be next? Cracks?

Yeah what was it about keygens always having the most unhinged synth soundtracks

It sparked a whole new genre, Demoscene. I miss those days.

https://en.wikipedia.org/wiki/Demoscene

It's part of the demoscene culture, which overlaps a lot

https://en.wikipedia.org/wiki/Demoscene

https://files.scene.org/

> musical accompaniments

Can someone please explain this to me?

back in the old days, keygens were a way for hacking groups to show off, so they had cool graphics and played music.

| back in the old days

Thank you for my daily memento morì.

"Keygens" are programs that generate valid product keys in order to crack software copyright protection. Under the DMCA or similar laws in many other countries, they are illegal to use, create, or distribute.

Jokes on them, I run a keygen almost daily, for software I don't have, because I like the cool chiptune.

Cool, now I can name my internal packages keygen to avoid dependency confusion /s

Every time npm comes up I remind everybody that npm is shit, and nobody should use it. They have a bad track record of doing things right and bad attitude when told.

But you keep using it.

I refuse to use it at work and refuse to use it in personal life. It’s not real software and will cause you harm.

Fun fact. Several years ago I started getting charges from NPM, which although I am a software developer I have never used. I cancelled my credit card multiple times, but they kept appearing each month.

I went to my bank, Bank of America, and they claimed that there was nothing they could do because NPM was using some sort of option they had to follow me when I got new credit cards. I don't know what kind of option that is, as every time I get a new credit card I have to update it with literally every other company. I also don't know how a bank wouldn't have some sort of manual override. Nevertheless, I called NPM, who said I had to talk with my bank. Eventually, after months of dealing with this loop, I threatened to leave my bank, and my bank advised me to call them and threaten to get the BBB involved if they didn't fix it, and a few days later NPM admitted it was an error on their end and reversed all of the charges.

To this day I wonder what kind of shady thing NPM was doing to not just charge someone who had never been a customer of theirs, but to follow them across cancelled credit cards.

Ok, I'll bite. There is no way a merchant can learn a new card number other than from the cardholder, or from a thief who got it from the card/cardholder. Not from any upstanding entity.

If you merely got a new expiration date, security code, etc. without also changing the card number, they could "follow" that by submitting a transaction without those extra pieces of information, at greater cost and risk to themselves, though.

I'll happily take downvotes if I'm wrong, for being assertive without a source.

Are you sure NPM was actually charging your card directly, and not a digital wallet or similar virtual card thing which you kept active?

Some banks have a service where if you use your card for ongoing regular payments and the card is replaced for any reason, the bank will allow those regular charges to continue on the new card when the service provider uses the old number.

It's very convenient if that's what you want -- it means you don't have to go to all of the ongoing services to update your card immediately. But it does mean that you can't count on changing a card to stop unwanted ongoing charges.

I recently replaced a card at my bank, and they offered this as an opt-in service (which I opted in to), but I hear that some banks make it opt-out, instead.

Ah. So in that case, NPM is not learning a new card number, and probably isn't even aware of anything at all, given that the card issuer is simply accepting transactions (instead of declining them as this person expected) on the old card number.

NPM was in the wrong for continuing to place unwanted transactions, but they were not actively participating in this "follow" scheme so the blame stops short of that.

No, they get the new number.

The way the update services is work is that you send them the card type, card number, and expiration date of a card you have on file, and they respond typically with one of these four responses:

1. Still good.

2. The account is closed.

3. The card is still good but has a new expiration date, which is YYMM.

4. The account has a new card. The card number is XXXXXXXXXXXXXXXX and the expiration date is YYMM.

Oh, ok. Still doesn't feel right blaming the merchant for utilizing #4 in exactly the intended manner.

The existence of #4 seems odd though. If someone just wanted different card perks they could do a "product change" which I believe retains the same number anyway, so a new number should only occur if the old number was reported stolen, in which case why provide the new number to the potential thief?

The update service is only available to merchants, and even then I believe there is extra vetting beyond simply being allowed to accept credit card payments. The intersection of that set and the set of credit card thieves is small.

For a typical user who has their card stolen it will go something like this. Fraudulent charges start appearing on their card, which is when they realize their card number has been stolen. The bank issues them a new card, makes sure the fraudulent charges get refunded, and invalidates the old card so the thieves won't be able to put new charges on it.

Without the updater service the user would have to deal with contacting every place they have subscriptions and update their on file card to avoid having their services disrupted.

With the updater service many or most of those will update automatically.

If the thieves used the card to buy some subscriptions, and those are from merchants who are able to use the update services, then those services may get the new number so the user might have to contact them to cancel.

For most people in that case though the number of subscriptions they legitimately have will be much less than the number of subscriptions that the credit card thieves purchased on the user's stolen card.

According to Stripe,

"Stripe works with card networks and automatically attempts to update saved card details whenever a customer receives a new card (for example, replacing an expired card or one that was reported lost or stolen)."

https://stripe.com/docs/saving-cards#:~:text=Automatic%20car...).

I was as shocked as you, and was absolutely infuriated over the bank telling me that they couldn't manually override whatever was going on. I can assure you it was a real thing that happened, and I did cancel my credit card and get a new number, if I remember I tried that at least twice.

I found the email from NPM when they fixed it, though in the email they still claim that my card details were stolen and it should be closed, ignoring that I had done that multiple times already. The email is below. Apparently there were 28 charges, so it must have been around 2 years that this was ongoing, I was dealing with some major issues at that time so I had to put it on the backburner for that time.

As far as digital wallets and virtual cards, I have none of those things. I may be a programmer, but I haven't gone techy with my finances, I just have a checking account and a credit card, and this charge kept appearing on my credit card across at least two card cancellations. Having said that, I have no idea what would happen if a fraudulent digital wallet or virtual card was set up that I was unaware of. The issue did start in 2015 though, so I'm not sure if those even existed back then.

Email from <Redacted>@npmjs.com: "We've completed the investigation into the charges we believe linked to your card ending in [Redacted]. We've refunded each individual charge for a total of $196 (28 refunds at $7/each). You should see those credited back to your account within a few business days.

We've canceled the subscription the charges were linked to, and removed the billing details. That said, we'd still encourage you to notify your bank that the card information was stolen and that the card should be closed.

Thanks for your patience while we worked through this on our end. I understand it wasn't ideal and even frustrating at times. I'm sorry for that.

Please let us know if there is anything else we can do for you. We’ll be here to help."

How do you install Node packages? Do you use Deno, or go to each one's Github and copy it manually? Or just implement the entire feature yourself?

This reminds me of the supply chain attack experts who's only solution seems to be blocking postinstall scripts.

That sounds completely different. Blocking the word 'keygen' accomplishes absolutely nothing and is clearly stupid. Blocking build scripts absolutely stops a major attack vector.

Malicious unchecked code in postinstall can just be moved to runtime so blanket blocking postinstall is as effective a solution to supply chain attacks as the solution of blocking npm packages with the word "keygen" in them is to the problem of .... js based keygens???

There are many legitimate purposes for postinstall scripts yet the anti-postinstall crowd acts like they solved security issues with this one easy step.

Postinstall scripts run without any interaction before the developer has any chance of reviewing the code.

They are a very bad thing.

"any chance"???

I can't square this circle of someone being paranoid about postinstall script but at the same time thinks the first chance to review dependency code is after doing a `npm i`.

Check the git repo of the library you are installing beforehand if you're so paranoid about postinstall.

And above that, never install any library for which the source is not readily available. This is the most basic first line of defense.

username checks out.

> Check the git repo of the library you are installing beforehand if you're so paranoid about postinstall.

> And above that, never install any library for which the source is not readily available.

Whether source is available or not is mostly irrelevant when you're potentially dealing with malicious code, you need to review artifacts that are being fetched from NPM since those can differ from source code on Github.

Attackers aren't going to announce their malicious code through meaningful git commit messages in a prominently displayed GitHub repository. They will make innocent-looking commits on Github, then publish a new version containing a single additional line of malicious code on NPM.

> ...NPM since those can differ from source code on Github.

True. How about people act their threat model? Instead of removing a feature for many users, just do whatever you need to do to be sure you're safe yourself?

In what other major situation is the solution to nuke a feature due to security concerns?

Afaik the main conversation about postinstall is around leeches complaining about political messages in their console and one or two other incidents

Runtime can be anything from browser to quickjs to Node in a docker. In many such cases the only time code runs on your dev machine completely unsandboxed is install scripts.

Yes it is good to never install malicious NPM packages anyway but if you develop for any of those runtimes and you do not bother to check dep tree the anti install script crowd saved your ass.

> moved to runtime

So a completely different scenario? Let's assume for a moment that developers only ever 'build' or 'check' their code, but all actual runtime behavior is in production. In production we have toooooons of security tooling for monitoring and constraining program behavior. On dev computers? Basically nothing.

Of course, developers run `test` as well, and sometimes they run the whole program but these use cases, especially at companies, are increasingly moving to CI.

Not running your tests locally to make sure stuff actually compiles/works before commiting to the repo and blowing up everyone else is a great way to piss off your QA group.

Please, make sure it runs locally first. CI often costs $$$, and when you nab a QA for debugging support, nothing irritates more than the answer "Well, no..." to the question "Did you even compile/run this?"

> Not running your tests locally to make sure stuff actually compiles/works before commiting to the repo and blowing up everyone else is a great way to piss off your QA group.

Uh... branches? Obviously?

> Blocking the word 'keygen' accomplishes absolutely nothing and is clearly stupid.

The intent is almost certainly to stop a spam campaign which was using NPM package pages to host links to outside sites. Similar pages have been discussed on HN previously [1].

The fact that there was actual installable software involved was irrelevant to the attacker. All they were after was a way to put their content on a high-reputation domain -- and NPM was perfect for that.

[1]: https://news.ycombinator.com/item?id=35370728

What if I write a package to provide generic key generation for other software packages, then share it, generous man that I am?

Name it kee-gin

How about Key Djinn ;-)

Meshuggah is now the “replace:” for “keygen”

That's djent, not (d)jinn

https://en.wikipedia.org/wiki/Jinn

Ha, whoops you’re right.

Key-Gone-Jin?

Believe it or not, jail.

For anyone not aware of the reference, this is from an episode of Parks and Recreation:

https://www.youtube.com/watch?v=eiyfwZVAzGw

We have the best package repository in the world because of jail.

FreeBSD? Makes sense, isolate the repo process so nothing nasty escapes.

%s/keygen/keymaker/g OR %s/keygen/keymaster/g depending on what era of movie buff you are

name it negyek

Surely this must just be a dumb WAF rule?

So,... has anyone with this issue actually contacted the NPM team and asked what is is about?

I have, yes. Awaiting a response.

Official response from NPM (a week later):

> You are correct, keygen is a stopword. We blocked users from using this word for security purposes.

> Apologize for the inconvenience and we highly suggest you choose a different word for your package going forward.

Apparently it’s the same for the word “cheat” https://mastodon.online/@macdonst/110492821135085935

Can confirm.

NPM is owned by Microsoft, who sell proprietary software, the kind that keygens are made to defeat.

Don't expect to see KMS spoofers on GitHub anytime soon for the same reason.

What about this?

https://github.com/massgravel/Microsoft-Activation-Scripts

Those are scripts that talk to KMS servers on the internet - they would not fall under DMCA prohibitions on anticircumvention as I understand it.

KMS spoofers are the services running on those internet hosts the scripts talk to.

py-kms is on GitHub but I assume it won't remain there for the same reasons as yt-dlp.

> py-kms is on GitHub but I assume it won't remain there for the same reasons as yt-dlp.

You mean this yt-dlp that isn't on there? https://github.com/yt-dlp/yt-dlp

That script also does more than just Online KMS activation, which would be clear from a few seconds skimming.

There's also been no indication that any of these repos would get taken down. At all. py-kms has been there since 2017. You'd think if Microsoft had such a big problem with its existence, it'd have gotten pulled in the last 6 years.

py-kms is a thing

Okay but what about keygen for ssh/git/pgp/certs or really anything in software that relates to security, which fundamentally rely on, at some point, the generation of encryption keys? It’s just such a dumb counterproductive step to take.

Microsoft was probably also traumatized by keygens for PC games in the 2000s - 2010s.

There’s several KMS-based activation scripts and servers on GitHub. Did you even take a second to do the briefest of checks before saying that so confidently?

https://github.com/topics/kms

KMS it's a literal module from Linux/BSD tied to the display technology.

This is why LLMs that have censorship applied seem lobotomized. Clbuttic problem is clbuttic.

I'm assuming keygen must not be part of the package name specifically, right? Because keygen can be part of contained JS content without probs, as the sgml package is demonstrating (containing the legacy keygen element as part of its embedded HTML DTD grammar).

But I'm still curious why keygen would be problematic as part of a package name?

genkey

Where will I get my Кейген now?

Reply on news.ycombinator.com