Post AHYE5UvgexspthdKDo by ruff@social.librem.one
(DIR) More posts by ruff@social.librem.one
(DIR) Post #AHY3D7jdgFsimZQp7Y by Gargron@mastodon.social
2022-03-18T20:17:52Z
3 likes, 10 repeats
"Select versions of the massively popular 'node-ipc' package were caught containing malicious code that would overwrite or delete arbitrary files on a system for users based in Russia and Belarus"https://www.bleepingcomputer.com/news/security/big-sabotage-famous-npm-package-deletes-files-to-protest-ukraine-war/Do not do this
(DIR) Post #AHY6Ab6eK476rwgJjU by AgreeableLandscape@mastodon.social
2022-03-18T20:19:25Z
3 likes, 0 repeats
@Gargron "We hate your government, not you. So we're going to screw you over just for being in a specific place."
(DIR) Post #AHY6AeNm8qaz1viXLM by Nach@mastodon.social
2022-03-18T20:51:21Z
3 likes, 7 repeats
@Gargron fuck fuck FUCK people really need to knock it off with this poorly thought through performative shit. Ticket removed from github, but it links here now: https://snippet.host/kvcb
(DIR) Post #AHY6bEwqoVrhxwnooa by groosha@mastodon.ml
2022-03-18T21:02:37Z
0 likes, 0 repeats
@Nach @Gargron friendly fire, lol
(DIR) Post #AHY8ZX0CuxdrHygYgy by a1ba@expired.mentality.rip
2022-03-18T21:24:42.400475Z
0 likes, 0 repeats
@Nach @Gargron saw the stupidest take on it today, like "We can thank the author for fake and other shit got deleted".I can't even describe what happens in their mind.
(DIR) Post #AHY8kZEMyNOJNyZWjI by idanoo@mastodon.nz
2022-03-18T21:07:00Z
1 likes, 0 repeats
@Nach Not excusing the actions of the maintainer... but why would you wildly bump a major version in prod (At least I read it was a major version patch) 🤔
(DIR) Post #AHY8kZhREIdwq8Ak2S by dave@gleasonator.com
2022-03-18T21:26:40.422803Z
1 likes, 0 repeats
As I’ve said before, this post is probably fake. As mentioned by others, the actual code didn’t do a thorough wipe, and the files were easily recoverable. Additionally, why the fuck would you be an American NGO and only have copies of your data stored in the adversarial country you’re keeping track of? And why does the post not say the name of said NGO?It comes across as a fake story specifically crafted so everyone could gloat about how poorly thought out this idea was. And to be clear, it was already a massive fuckup, and it would make my day if any companies he did hurt with his actions sue the fuck out of the dev and he gets buried in legal fees. But I still doubt that this story is real.
(DIR) Post #AHYAER2c5OS0cysZCy by stux@mstdn.social
2022-03-18T21:43:06Z
0 likes, 0 repeats
@Gargron wow..
(DIR) Post #AHYAF45otPBlkDgB7Y by rin@patch.cx
2022-03-18T21:43:19.519979Z
1 likes, 0 repeats
@dave @idanoo @Nach yeah it sounds quite fake to my russian ear. even regular russian organizations prefer hosting out of the country when possible
(DIR) Post #AHYAjkjGw6skfMlXg8 by michal@toot.kottman.xyz
2022-03-18T21:48:51Z
0 likes, 1 repeats
@stux @Gargron Playing the devil's advocate, it's right there in license [1]:THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ... FITNESS FOR A PARTICULAR PURPOSE ... IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY...Open source is a double-edged sword. Dick move nonetheless.[1] https://github.com/RIAEvangelist/node-ipc/blob/master/licence
(DIR) Post #AHYE5UvgexspthdKDo by ruff@social.librem.one
2022-03-18T21:29:35Z
0 likes, 0 repeats
@Gargron Do not do what what exactly, protest against the war?
(DIR) Post #AHYE5VRakLP7UeYnx2 by Gargron@mastodon.social
2022-03-18T21:36:52Z
1 likes, 0 repeats
@ruff Protesting the war is fine, but protesting the war in the west is also completely performative. Putin won’t change his plans because somebody in the west went to a rally or a celebrity recorded a touching message.Turning your software package into malware that targets Russian civilians is pointless cruelty. They have no say over this war either, and it will hit the ones that are against it just as much. It already hit an NGO that documents Russian war crimes.
(DIR) Post #AHYEuS1xCIv1fvrR4K by evelyn@misskey.bubbletea.dev
2022-03-18T22:35:44.143Z
0 likes, 0 repeats
@Nach@mastodon.social @Gargron@mastodon.social I'd be inclined to say that this specific issue is likely fake, there's a few things here that don't entirely add up. Of course, there's no excuse for such actions in any event, the fact this is targeting ordinary Russians and Belarusians is inexcusable in its own right.
(DIR) Post #AHYGZ3mgLitMIte4X2 by keith@anarchism.space
2022-03-18T22:53:54Z
1 likes, 0 repeats
@a1ba @Gargron @Nach the answer is nothing. it's completely empty in there, you could look through one ear and out the other like a telescope
(DIR) Post #AHYGZjsppElks8qZxA by a1ba@expired.mentality.rip
2022-03-18T22:54:24.600723Z
0 likes, 0 repeats
@keith @Gargron @Nach yes, indeed
(DIR) Post #AHYOqHhwdNzQ2k9as4 by Iutech@fosstodon.org
2022-03-18T20:56:03Z
0 likes, 0 repeats
@Gargron You're Russian, right ?How does the diaspora interacts with the motherland ?Are you able to give different informations than the official medias or is the effect extremely limited ?
(DIR) Post #AHYOqICQo2NNZIPwOG by Gargron@mastodon.social
2022-03-18T21:03:44Z
1 likes, 0 repeats
@Iutech I try not to give too many personal details away online. So I’m afraid i can’t give you a satisfying answer.
(DIR) Post #AHYUuUXTTBvAine5NA by WAHa_06x36@mastodon.social
2022-03-18T20:41:23Z
1 likes, 0 repeats
@Gargron I think the real problem here is that it is *possible* to do this in the first place. So many package managers are absolute security nightmares on every level.
(DIR) Post #AHYe3qpSrdH82yb94C by nerthos@shitposter.club
2022-03-19T03:17:33.301579Z
0 likes, 0 repeats
@Nach A lesson on never recklessly updating non-testing systems
(DIR) Post #AHYtUKFlaQvm97yzbc by grishka@friends.grishka.me
2022-03-18T21:35:33Z
1 likes, 0 repeats
ruff, this is pure vandalism, not a protest. Do protest. Don't vandalize stuff. That simple.
(DIR) Post #AHYtUKm1eUjdlB4kt6 by ruff@social.librem.one
2022-03-18T21:37:04Z
0 likes, 0 repeats
@grishka Oh right, of course. When your family is hot you request authorities to allow protest. got it. and if they reject - you oblige. Of course.
(DIR) Post #AHYtULIdhEp5OKKniq by ruff@social.librem.one
2022-03-18T21:37:17Z
0 likes, 0 repeats
@grishka *is shot
(DIR) Post #AHYtULn7rtD2usb9F2 by grishka@friends.grishka.me
2022-03-18T21:42:36Z
1 likes, 0 repeats
ruff, you aren't making any sense. Please answer this simple question: how exactly a piece of malware unleashed upon innocent people is an act of protest?