[HN Gopher] NPM won't publish packages containing the word keygen
___________________________________________________________________
NPM won't publish packages containing the word keygen
Author : franky47
Score : 222 points
Date : 2023-06-14 13:22 UTC (9 hours ago)
(HTM) web link (mamot.fr)
(TXT) w3m dump (mamot.fr)
| ezekg wrote:
| I run a business called Keygen [^0], and own the @keygen
| namespace on npm. We're working on a Node SDK, so this isn't good
| to hear. I'll open up a discussion with them and see what we can
| do.
|
| [^0]: https://keygen.sh
| y-curious wrote:
| I didn't know there was a name for this, what a fun Wikipedia
| rabbit hole[1]. Pretty entertaining that censors still don't
| get it right decades later.
|
| [1]: https://en.wikipedia.org/wiki/Scunthorpe_problem
| Dwedit wrote:
| The solution is to examine all words that contain that
| substring and explicitly whitelist them.
|
| Nowadays though, we have a different Scunthorpe problem. I
| call it the "Hidden Garfield" problem, because that phrase is
| detected as a racial slur after you run Double Metaphone on
| it and throw out spaces.
| franky47 wrote:
| Have you had any publishing issues? My last successful publish
| on this package was 3 months ago, and I started noticing issues
| with deploys a few weeks back.
|
| Three fun days of CI/CD pipeline debugging to get to this..
| ezekg wrote:
| After digging around, I found the org and I do own @keygen.
| And I was able to publish an empty package to the org:
| https://www.npmjs.com/package/@keygen/js.
|
| But it doesn't look like it's searchable, unless there's a
| caching issue.
| samtho wrote:
| It is searchable now, at least:
| https://i.imgur.com/kFDSuHE.png
| [deleted]
| retrocryptid wrote:
| Nice to see an alternative to FlexLM. That package was the bane
| of my existence when we had a bazillion RS/6000s running AIX.
| And when I worked at Borland, I campaigned (unsuccessfully)
| against its use.
| skrebbel wrote:
| Unrelated question, on your site, how do i close the cookie
| banner? On my phone it obscures most of the screen and i can't
| dismiss it.
| ezekg wrote:
| Bottom right cog icon, or tap anywhere outside of the drawer.
| mikrl wrote:
| Try using a Russian Cyrillic e or k or u
|
| Sure no one will be able to install the app from the CLI
| (unless there is a bug in npm's parsing logic) but you should
| be fine distributing hyperlinks to skim-readers ;)
| codetrotter wrote:
| keigen
| anthk wrote:
| Unicode works under xterm and urxvt since long ago, also
| people can just copy and paste...
| ijustlovemath wrote:
| unrelated to your question: Your website's very pretty, but
| doesn't scroll horizontally on mobile. It also looks like there
| might be a bug in the code sample - where does "fingerprint"
| come from?
| ezekg wrote:
| Why would you want to scroll horizontally? Or are you
| referring to the code samples? It's only a code "sample"
| (i.e. non-working just to show off the platform), so
| fingerprint would likely come from something like
| https://github.com/denisbrodbeck/machineid. Full examples are
| available in the Go SDK docs [^0].
|
| [^0]: https://github.com/keygen-sh/keygen-go
| ptspts wrote:
| Please enable horizontal scrolling. I wanted to view the
| code sample on mobile.
|
| Code samples are usually more relevant than marketing
| messages.
| ezekg wrote:
| Thanks for the feedback. Makes total sense. I'll make
| this change.
|
| (I wasn't expecting so much traffic and feedback today
| lol)
| ijustlovemath wrote:
| The functionality makes sense given this response. The code
| sample is not fully viewable without a horizontal scroll;
| it's cut off about 20 columns in. It's as if you're
| presenting 2/3 of your website, but not allowing the user
| to see anything else.
| Mystery-Machine wrote:
| You need to move your phone horizontally in order to scroll.
| It's a new spacial computing type of scrolling. /jk
| creshal wrote:
| It doesn't scroll on desktop either, I guess the world still
| is not ready for people having multiple windows open in
| parallel.
| xavxav wrote:
| Unrelated, but your homepage has very bad FPS using firefox on
| mac due to the animation. Once I manage to scroll it works
| quite well.
| sBqQu3U0wH wrote:
| >mac
|
| Sorry, that's what you get for not using a normal computer.
| ezekg wrote:
| Thanks. That shader doesn't seem to play nicely with some
| GPUs and I'm still working on edge cases. If possible, could
| you look at your console logs and email me your specs? They
| should be logged. Email is in bio. It should be doing
| automatic categorization of the GPU to determine render
| quality, but maybe something's still incorrect there.
| jeffhuys wrote:
| Works horrendously bad on Firefox, works great on
| Safari/Orion...
|
| Macbook Pro M1
| ezekg wrote:
| Interesting. I wonder if this is a retina display issue.
| I just pushed out a change that renders the shader at
| standard resolution even if the device has a retina
| display. I don't have a retina display on any of my
| devices except a 2019 MBA and it renders fine on it. I
| wonder why.
| definitelyauser wrote:
| > I wonder if this is a retina display issue
|
| I'm using an external monitor running at 5120x1440
| (Samsung, not retina) only, and am experiencing the the
| same on Firefox.
|
| At least not retina exclusive.
| ezekg wrote:
| Oh wow. Sounds like I should put an upper bound on
| resolution. I wasn't even thinking of somebody opening
| the page full-screen on an ultra-wide.
| lopkeny12ko wrote:
| With all due respect, this is possibly the dumbest rebuttal
| I've heard. Why do I need a powerful GPU or even need my
| GPU to waste compute cycles just to view a webpage?
|
| Just get rid of it entirely. The visual flair is not adding
| any value. It's a performance drag, highly distracting, and
| serves no useful purpose whatsoever. This "trend" in modern
| web design is truly infuriating.
| olaulaja wrote:
| So I took a look at the actual shader _, and it really
| should not require anything powerful (decade old, worst-
| you-can-get hardware might struggle). A much more likely
| explanation (that the gp is alluding to but didn 't
| explicitly say) is that the issue is related to your GPU
| drivers or related software. These are often buggy and/or
| hit a slow path for whatever reason. This is almost
| guaranteed to happen for some browser/os/hardware/driver
| combo (of which there are _many_) and you seem to have
| drawn today's short stick.
|
| The animation itself looks fine, its slow enough that it
| doesn't feel distracting. Just a bit of flavor.
|
| _ Its mostly just a few calls to a cheap noise function
| and no footguns I can see. Also hurrah for dev tools and
| open text formats! If you're looking for better
| performance, it looks like the noise could be precomputed
| (the same blob always gets the same noise)". Might be
| faster, might just hit more bugs.
| ilkka_es wrote:
| That's just your opinion, man. I checked the site on
| iPhone and would say that it's better than 80% of the
| sites I see. No performance issues at all. The extra wide
| font I don't like however.
| ezekg wrote:
| Wasn't expecting so much candid feedback today. There was
| a Launch HN yesterday that had a 3D rubik's cube on their
| home page. It was literally pointless. But kind of neat.
| But you probably hated that as well, if I could assume.
| But I say that to point out that lots of companies do it,
| sometimes simply because we can (just look at Stripe and
| GitHub).
|
| I think the lava lamp effect is cool. The perf issues can
| and will be fixed.
| vvilliamperez wrote:
| Yes other companies have animations but they make sure it
| performs well across browsers and OSs.
|
| Mac+Firefox users are probably in your customer base.
| Listen to the feedback.
| CamperBob2 wrote:
| Looks good on the 4090 here, ship it
| richard_nixon wrote:
| Speaking as someone that blocks javascript by default,
| the page doesn't look too bad!
| zb3 wrote:
| I'm sorry, but what should just. be a _progressive
| enhancement_ in this case completely ruins the user
| experience for me. However, I'm probably not your target
| audience, I'm just commenting on this trend in general.
| mynameisvlad wrote:
| It literally _is_ a progressive enhancement, so I 'm not
| sure what your point is.
|
| There's clearly bugs where it's enabled where it
| shouldn't be, and that's certainly an issue, but the
| comments here make it clear that it gets disabled
| automatically on lower-end devices.
| jlarocco wrote:
| Not sure why people are hating so hard on your site, but
| I liked the effect, and it didn't cause any problems for
| me.
| Daneel_ wrote:
| I appreciate you engaging with commenters on this, it's
| nice to see.
|
| From my perspective I agree with a lot of the other
| commenters - it's just design for design's sake. It's an
| expensive way to add minor visual flair that heavily
| degrades the experience for a sizeable number of users.
| In terms of value provided to the user: it's basically
| zero, or often worse than zero.
|
| Personally, it feels over-designed, which the stretched
| font for the headings really reinforces. I'd drop the
| shader, re-evaluate your font choice for the headings,
| and focus on layout and readability a little more - using
| the site on my iPhone feels really cramped and like the
| whole page is getting cut off on the right-hand side
| constantly. I can't scroll horizontally to see the rest
| of the code, for example.
|
| I do like the little text-flicker/flipboard animation on
| the "keygen" logo though. That looks clean and well-
| suited to the theme of the site.
| ezekg wrote:
| I spent weeks on the typography and on choosing a font.
| Went through so many different styles. I ended up on
| Owners by MCKL [^0] because I personally like the ultra-
| wide font trend, and I liked its Text variant as well.
| Bummed to hear that others aren't a fan of it. Oh well,
| design is pretty subjective.
|
| And it _may_ be over-designed. It was my first foray back
| into design since switching careers to programming about
| 10 years ago. Maybe I took it a bit too far? Felt good to
| stretch those muscles, though. :)
|
| [^0]: https://mckltype.com/owners/
| oefnak wrote:
| That wide font is on purpose?! No offense, but I was sure
| something went wrong with rendering the page.
| arthur2e5 wrote:
| It didn't quite register as a "display" font variant
| usually does for me either -- the only feature is the
| width (it's a nonfancy sans-serif, what do you expect) so
| it somehow just feels like it's been squished.
| Intellectually I know it's definitely not a simple scale-
| transformation and must have involved some curve work to
| make it look less off, but I just can't shake the feeling
| of having seen text getting run over by a truck.
| electroly wrote:
| I went and found that Launch HN, and yeah, that rubik's
| cube is horrendous on my computer. They did not do as
| much effort as you did to make it work on low end
| machines. I don't have a GPU at all; your site disables
| the background effect but their site shows the cube
| anyway. Their site _drags_ once that rubik 's cube
| appears, and the cube itself animates at 1-2 fps. It's a
| very poor experience and I don't really see what the cube
| adds, but I do see what the cube subtracts.
|
| (Your site works fine on my computer. The effect is
| disabled and it's not a problem.)
| causi wrote:
| Your homepage needing a shader is at least a hot-pink flag
| for the whole company. Pretty janky here on Vivaldi as well
| unless I scroll really slowly.
| ezekg wrote:
| What do you mean by this? I wrote the shader because
| gamedev is an interest of mine, and I wanted to give
| writing a fragment shader a try for the redesign.
| causi wrote:
| Because it's not bad enough to be a red flag but it does
| make me wary of the company's priorities. You used a
| complicated shader to make a scroll bar that doesn't
| scroll, which may as well have been a static background
| image, and half-visible janky blobs in the background I
| thought at first were eye floaters. The crushed font
| looks like a rendering error and the e's and s's looking
| identical made me stare at the word "businesses" because
| I swore it was misspelled. I do have to say the color
| scheme is gorgeous though.
| internetter wrote:
| It's very laggy for me, and I'm on high end hardware.
|
| {"CANVASES":2,"GPU":{"fps":209,"gpu":"apple m2","isMobile":
| false,"tier":3,"type":"BENCHMARK"},"RESOLUTION_RATIO":2,"BL
| OB_COUNT":20,"BLOB_AMPLITUDE":"52.60","BLOB_RADIUS":"2.54",
| "POSITION_X":"4.43","POSITION_Y":"1.72","RANGE_X":"4.64","R
| ANGE_Y":"6.51","SPEED_X":"9.60","SPEED_Y":"4.51"}
| spdustin wrote:
| With respect, all of that for some bokeh? Is it worth it
| for y'all? Do you know how many folks just _leave_ when the
| stuttering starts?
| ezekg wrote:
| The entire lava lamp effect is a shader, not just the
| bokeh. :)
|
| I haven't noticed any drop in registrations, conversions,
| or any noticeable differences in traffic patterns after
| launching the redesign, so I'm not sure if this is
| actually happening. Though it's a valid concern and
| issue, and I do want to fix it. And I appreciate all the
| reports. I think it may be a retina resolution issue, but
| could be wrong.
|
| On launch day, everyone loved the effect (it goes along
| with the new logo) and only a couple people said it
| performed badly, but they were on exotic devices.
|
| I may have caused this a few days ago when I enabled
| rendering at retina resolution for tier 3 devices. What I
| wasn't expecting was so many tier 3 devices that aren't
| really what I'd consider "tier 3." I was expecting all
| tier 3 devices to be gaming-level GPUs.
|
| I guess I should have read the source [^0] more closely
| and I could've avoid this.
|
| [^0]: https://github.com/pmndrs/detect-gpu/
| tpxl wrote:
| > What I wasn't expecting was so many tier 3 devices that
| aren't really what I'd consider "tier 3." I was expecting
| all tier 3 devices to be gaming-level GPUs.
|
| Could be the detection of GPUs doesn't work correctly? My
| nVidia 1080Ti is detected as nVidia 980Ti, and a sibling
| comment mentions an integrated laptop GPU being detected
| as tier 3 with isMobile=false.
| rcxdude wrote:
| Another danger here is testing with the website being the
| only thing on the PC: some people use their computers
| like that but many others will have many different things
| open at once: just because it can run at an acceptable
| FPS on the detected hardware doesn't mean the resource
| use is acceptable on a system which is multitasking. I
| usually have >100 tabs in my browser and at least 20 of
| which are loaded: they _cannot_ all demand what your site
| demands, even though the hardware is quite high-end.
| Dylan16807 wrote:
| How many tabs are simultaneously visible? An animation in
| a non-selected tab won't get much in the way of
| resources, so the number of loaded tabs shouldn't be a
| big factor.
| RobotToaster wrote:
| It's working fine for me on windows and firefox
|
| _device: undefined
|
| fps: 30
|
| gpu: "intel mesa dri intel hd graphics 400"
|
| isMobile: false
|
| tier: 2
|
| type: "BENCHMARK"_
| ezekg wrote:
| I'm questioning whether or not I should continue into the
| realm of gamedev... the amount of "works on my igpu from
| 2015 in low power mode" and "stutters on my rtx 4070 ti"
| here is making me laugh out loud.
| tpxl wrote:
| Tbh, games with the most problems usually run home-grown
| engines that try to do too much.
| robertlagrant wrote:
| Janky for me even when scrolling has started. 2021 M1 MBP.
| morgannewman wrote:
| +1 the website is borderline unusable on my work laptop. I
| have an M1 Pro in my standard MacBook Pro 2021. I am using
| the latest version Chrome and this animation causes a huge
| performance regression on my computer when it's visible.
| cldellow wrote:
| I'm not the person you replied to, but it's janky for me,
| too.
|
| Console logs: device: undefined, fps: 60, gpu: amd renoir,
| isMobile: false, tier: 3
|
| FWIW, my laptop is a relatively beefy 2021 model (granted,
| with integrated GPU). For a business that's not about 3D
| rendering, spending an innovation token on making sure your
| landing page can have a smooth background animation seems
| like it's playing on hard mode.
| oefnak wrote:
| Also runs terrible on my Pixel 5 with Firefox. As for your
| design choices, they remind me of the Mezmo landing page...
| sandyarmstrong wrote:
| Yeah this feels totally broken on my M1 Pro running
| Ventura.
| loeg wrote:
| It stutters on an M1 Macbook running Chrome, for example.
| jeffhuys wrote:
| M1 running Safari (specifically Orion) works 60fps...
| How?!
| ezekg wrote:
| Battery vs plugged into a power outlet? Maybe Apple
| throttles the GPU to save battery.
| definitelyauser wrote:
| GPU: {device: undefined, fps: 342, gpu: 'apple m1 pro',
| isMobile: false, tier: 3, type: "BENCHMARK"}
|
| Despite the supposedly high FPS it's very jumpy/laggy in
| Firefox, though fast in Safari.
| richrichardsson wrote:
| It's also horrifically slow on Chrome macOS:
| { "fps": 130, "gpu": "amd radeon
| pro 5300m", "isMobile": false,
| "tier": 3, "type": "BENCHMARK" }
|
| Definitely wasn't 130 FPS and made the whole page stuttery.
| djbusby wrote:
| Just turn it off.
| ezekg wrote:
| It does turn off when it detects a low-end or integrated
| GPU. But something may not be working correctly, or is
| getting miscategorized.
|
| That's why the debug information would help.
| djbusby wrote:
| Or, again, turn it off and avoid the whole class of
| issues, wasted time and asking random HN folk for debug
| logs.
| BudaDude wrote:
| Don't listen to random comments on hacker news. It looks
| cool OP. Don't throw out the whole thing for a few bugs
| bborud wrote:
| Yeah, as long as we're focused on the really important
| things. Like animations that nobody actually needs or
| wants (apart from the person putting it there). That is,
| of course, until it ruins the user experience by bogging
| down the browser. And then, sure, let's debug _that_ and
| make sure it runs on everyone 's browser/os/cpu/gpu
| combo. That's a brilliant use of time.
|
| _Until someone turns up with a new combo where it doesn
| 't work. Because judging by the comments, this seems to
| be a janky piece of code that isn't well understood_.
|
| "Turn it off" (or rather, "rip it out, and throw it away"
| is good advice. If there is even a slight chance this
| might come back to haunt you and screw the user
| experience, it isn't worth it. If your animation is more
| important than avoiding a horrible user experience, well,
| that's kind of useful for your customers I suppose.
| Zetice wrote:
| How do you imagine user conversations take place, if not
| from "random HN folk"?
|
| Do you want an appointment? A lab?
| arp242 wrote:
| When you emailed me about this a few weeks ago I played
| around a bit with the shader, and just creating fewer
| blobs made the problem go away (reducing "for (int i = 0;
| i < 15; i += 1) {" to 5 in the "void main"), but I didn't
| really have the time to investigate in-depth or see what
| kind of visual effects that would give (dealing with this
| minified JS isn't exactly fun and I never worked with
| OpenGL shaders either), but just FYI.
|
| Good to hear it's not just me though (and the effects
| also aren't disabled for me either).
| [deleted]
| Const-me wrote:
| The pixel shader is cool, but consumes too much resources.
| On my 1080Ti, uses about 20% of GPU to render, which is too
| expensive for such a simple graphics.
|
| I've looked at the source, and it seems you're doing too
| much computations there. Metaballs are usually rather
| simple, and they don't require any trigonometric functions.
| Compute something like `sum( ball.z / length( pixel -
| ball.xy ) )` and apply the threshold. If you want anti-
| aliasing, use fwidth() for the screen-space partial
| derivative of that value after the loop, compute two
| thresholds around the iso-value, then smoothstep() instead
| of a hard threshold.
|
| Also, consider moving the ball parameters (center and size)
| into a constant buffer and update them on CPU. Because
| there's just a few balls, JavaScript is good enough for the
| job. Your current version computes these things from time
| for each pixel for each frame. There're about 8 megapixels
| on my display, so these computation costs are escalating
| very quickly.
| dvngnt_ wrote:
| this works fine for me on mobile brave
| ezekg wrote:
| My lack of knowledge in shaders is showing. :)
|
| I sent you an email with a job offer.
| bmicraft wrote:
| No problems here with firefox on x11 and amdgpu/mesa
| drivers fwiw
| ricardobeat wrote:
| Could it be that they are doing this as a way of preventing
| packages spoofing the namespace (ex. 'keygen-core')?
| joshmanders wrote:
| That would be terrible, because if someone owns the @express
| namespace that isn't express team (not gonna happen, just
| illustrating why this idea is bad), then goodbye all
| `express-*` packages.
| codetrotter wrote:
| Time to change the name of your business to kexgen I guess.
| sixothree wrote:
| GenKey?
| retrocryptid wrote:
| sounds too muck like JenKens.
| philsnow wrote:
| it sounds too much like "janky" to me
| ezekg wrote:
| Our CLI already uses genkey as a command so unfortunately
| that's no bueno: keygen genkey
|
| Can't do genkey genkey. That's just weird...
| TheFreim wrote:
| I mean, you could just flip it around?
| genkey keygen
| myself248 wrote:
| Sounds jankey...
| throwaway019254 wrote:
| GeyKen?
| RobotToaster wrote:
| KeyJen.
| ezekg wrote:
| I actually was going to originally name the company KeyGin.
| The first prototype was called that.
|
| Thank God I didn't lol.
| sshine wrote:
| kekgen
|
| kek is orc for lol.
| mdekkers wrote:
| Unrelated, but I ahev been a user for some years, you rock.
| tomatbebo wrote:
| Cool, now I can name my internal packages keygen to avoid
| dependency confusion /s
| slowmovintarget wrote:
| This is why LLMs that have censorship applied seem lobotomized.
| Clbuttic problem is clbuttic.
| HeckFeck wrote:
| What if I write a package to provide generic key generation for
| other software packages, then share it, generous man that I am?
| AndrewKemendo wrote:
| Name it kee-gin
| cm_silva wrote:
| How about Key Djinn ;-)
| AndrewKemendo wrote:
| Meshuggah is now the "replace:" for "keygen"
| NamTaf wrote:
| That's djent, not (d)jinn
|
| https://en.wikipedia.org/wiki/Jinn
| AndrewKemendo wrote:
| Ha, whoops you're right.
| jojobas wrote:
| Believe it or not, jail.
| simiones wrote:
| For anyone not aware of the reference, this is from an
| episode of Parks and Recreation:
|
| https://www.youtube.com/watch?v=eiyfwZVAzGw
| faefox wrote:
| We have the best package repository in the world because of
| jail.
| dylan604 wrote:
| %s/keygen/keymaker/g OR %s/keygen/keymaster/g depending on what
| era of movie buff you are
| adql wrote:
| name it negyek
| trieloff wrote:
| Apparently it's the same for the word "cheat"
| https://mastodon.online/@macdonst/110492821135085935
| macdonst wrote:
| Can confirm.
| 2OEH8eoCRo0 wrote:
| I have a pet theory that the language police learned their habits
| from these systems that have no better way than keyword
| moderation.
| [deleted]
| rmnclmnt wrote:
| Such rules are so dumb and easy to circumvent, it is like parent
| filtering all over again!
| nottorp wrote:
| Oh btw, do they allow "breast" in package names?
| nateguchi wrote:
| Surely this must just be a dumb WAF rule?
| sneak wrote:
| NPM is owned by Microsoft, who sell proprietary software, the
| kind that keygens are made to defeat.
|
| Don't expect to see KMS spoofers on GitHub anytime soon for the
| same reason.
| aurareturn wrote:
| Microsoft was probably also traumatized by keygens for PC games
| in the 2000s - 2010s.
| mynameisvlad wrote:
| There's _several_ KMS-based activation scripts and servers on
| GitHub. Did you even take a second to do the briefest of checks
| before saying that so confidently?
|
| https://github.com/topics/kms
| IggleSniggle wrote:
| Okay but what about keygen for ssh/git/pgp/certs or really
| _anything in software that relates to security_ , which
| fundamentally rely on, at some point, the generation of
| encryption keys? It's just such a dumb counterproductive step
| to take.
| kholdstayr wrote:
| What about this?
|
| https://github.com/massgravel/Microsoft-Activation-Scripts
| sneak wrote:
| Those are scripts that talk to KMS servers on the internet -
| they would not fall under DMCA prohibitions on
| anticircumvention as I understand it.
|
| KMS spoofers are the services running on those internet hosts
| the scripts talk to.
|
| py-kms is on GitHub but I assume it won't remain there for
| the same reasons as yt-dlp.
| mynameisvlad wrote:
| > py-kms is on GitHub but I assume it won't remain there
| for the same reasons as yt-dlp.
|
| You mean this yt-dlp that isn't on there?
| https://github.com/yt-dlp/yt-dlp
|
| That script also does more than just Online KMS activation,
| which would be clear from a few seconds skimming.
|
| There's also been no indication that any of these repos
| _would_ get taken down. At all. py-kms has been there since
| 2017. You 'd think if Microsoft had such a big problem with
| its existence, it'd have gotten pulled in the last 6 years.
| anthk wrote:
| KMS it's a literal module from Linux/BSD tied to the display
| technology.
| sgjohnson wrote:
| py-kms is a thing
| ethbr0 wrote:
| genkey
| franky47 wrote:
| Author here, with some context: the relevant package [1]
| generates key material to setup an end-to-end encryption SDK [2],
| based on libsodium and OPAQUE.
|
| [1] https://www.npmjs.com/package/@socialgouv/e2esdk-keygen
|
| [2] https://github.com/SocialGouv/e2esdk
| withinboredom wrote:
| keyword moderation is terrible and only affects the language(s)
| you know about. It doesn't actually prevent the content (the goal
| of these types of filters) from being served. It'd be like a
| virus scanner preventing a program from running because it had
| the name 'virus' in it ... which would prevent itself from
| running -- probably.
| [deleted]
| maxk42 wrote:
| I love keyword moderation. I love finding ways to demonstrate
| to those using it that it's futile by using only non-offensive
| words to thoroughly offend people. I was given a talking-to by
| a game administrator once for naming a match "Your granny rides
| my throbbing purple rod." It didn't contain any no-no words,
| though!
| hbn wrote:
| My favorite is the online name censoring in video games. Dark
| Souls infamously just does a straight check of any string match
| within the name against a big list of no-no words. So in this
| fantasy game where everyone is running around as a knight,
| anyone who has "knight" in their game will appear as "k***ht"
| to other players.
|
| There's also a famous image I've seen online from another game
| where the guy's name was Nasser which appeared for everyone
| else in-game as "N***er"
| tzs wrote:
| > My favorite is the online name censoring in video games.
|
| I don't know what the filters are like in EverQuest nowadays
| [1], but back in 2000 EQ didn't allow "cock" in chat. Then in
| April 2000 the expansion "The Ruins of Kunark" came and some
| of the zones that pretty much everyone making their first
| trips to Kunark would visit contained a variety of hostile
| cockatrices, and the chat filter would not let you mention
| them because of the "cock" at the start of their names.
|
| I once had occasion to implement a chat system for a small
| online gaming service and was supposed to filter out bad
| language. What I did was something like this:
|
| 1. Split the message into words.
|
| 2. For each word that is in /usr/share/dict/words or our own
| list of good words and is not on our bad words list, mark
| each character in that word as being good.
|
| 3. Concatenate all the words.
|
| 4. Find all places where words from the bad list appear as
| substrings of that concatenated string.
|
| 5. For any such bad words in the concatenated string mask the
| corresponding characters in the original message with
| asterisks unless _all_ of the bad word 's characters in the
| concatenated string are marked as good.
|
| For example the word "cockatrice" would have been uncensored
| even if "cock" was on our bad list because "cockatrice" is in
| /usr/share/dict/words and would not have been on the bad
| list. On the other hand "cocksucker" would have had the
| "cock" masked.
|
| If someone had tried to slip "cocksucker" by by inserting
| spaces such as "c o c k s u c k e r" the "cock" part would
| have still been masked, because the "c o c k" would have
| ended up as "cock" in the concatenated string, and not marked
| as good.
|
| Note that you would have been able to call someone a "peacock
| sucker" just fine, because "peacock" is in
| /usr/share/dict/words. Misspell that as "peecock sucker"
| though and then the "cock" part would have been masked.
|
| I was fine with that. I figured it encouraged good spelling
| among those who want to insult others. :-)
|
| (There was a little more, such as dealing with tricks like
| using 3 for e or \/\/ for w but those aren't really relevant
| to the general idea).
|
| [1] Yes, EQ is still around...and with the changes it has
| undergone over the years it is actually a pretty nice solo or
| small group game even on a free play account, especially if
| you have an old account to reactive so you get veteran
| rewards. Here's a description of some of the major changes
| [2]. When I returned to EQ a few years ago, I had no trouble
| playing a solo Bard to around level 60 on free play. Things
| got a bit slow then and I switched to paid. I then made
| reasonable progress up until I had finally satisfied my
|
| [2] https://news.ycombinator.com/item?id=31368588
| vbezhenar wrote:
| Here's list of substrings World of Warcraft checks in
| character names.
|
| https://wow.tools/dbc/?dbc=namesprofanity&build=10.0.5.47660.
| ..
|
| They spent great effort to build this list.
|
| Most character names in the game are lame anyway and some are
| just offensive or inappropriate.
| jeffhuys wrote:
| "colgate" is rude.
|
| "bra" is rude.
|
| "maxipad" is rude.
|
| "masterbaiter" is rude and funny.
|
| "amputee" is rude, even.
|
| This goes far...
| Nifty3929 wrote:
| Why is "amputee" rude?
| levi_n wrote:
| My favorite is Fark's word-changing filters and their
| unintended side effects. The no-no words are scanned across
| whitespace and reversed, and any hits get translated to the
| approved word. "Shit" becomes "Shiat", the N word becomes
| "nubian", etc
|
| Every so often someone will find their sentence that contains
| something like "I will have ham or egg in my sandwich"
| becomes "I will have ham onaibun my sandwich"
| babypuncher wrote:
| It makes sense for Dark Souls games because multiplayer is a
| lot less optional. Player names will appear in your game, and
| turning this feature off really hurts the experience.
|
| Their hamfisted approach leaves a lot to be desired. I have a
| feeling it is a product of being designed and implemented by
| non-native English speakers.
| vmilner wrote:
| I remember a conversation with some using an in-house file
| transfer system "Oh you won't be able to send more than X
| GBytes, at that point the chances that the base64 encoding
| contains a banned rude word become too high, and the transfer
| will fail"
| reuben364 wrote:
| I wonder what the optimal encoding is given a list of
| banned words for any substring of a message.
| namibj wrote:
| Just use a r-ANS entropy coder with feedback skipping
| symbols that would result in a ban from being possible to
| encode at that moment... I think.
|
| Unless I've gotten confused about the limits of dynamic
| prediction abilities in ANS.
|
| I think it's just that the encoder and decoder run in
| opposite directions through the encoded symbols, but
| read-ahead during decoding shouldn't be a problem...
| quesera wrote:
| gzip?
| marcosdumay wrote:
| A random binary string will be accepted until something
| between 4 and 8 times the size.
| willsmith72 wrote:
| This is awesome
| klysm wrote:
| Wow that may be the dumbest thing I've heard today
| PurpleRamen wrote:
| Maybe it's time to convert base64 to high UTF8-areas. I
| guess there won't be any keyword-filter yet for ancient
| egyptian hieroglyphs. I'm curious whether there are already
| emoji-filters...
| jazzyjackson wrote:
| https://github.com/qntm/base32768
|
| https://github.com/keith-turner/ecoji
|
| :D
| jwestbury wrote:
| > ecoji
|
| In a similar vein, a former colleague of mine created
| this Python package: https://pypi.org/project/piickle/
|
| It's functionally the same as pickle, except it binary-
| encodes the data with spaces and pickle emoji.
| TRiG_Ireland wrote:
| Matt Grey & Tom Scott had to build an emoji filter, I
| believe. https://www.youtube.com/watch?v=GsyhGHUEt-k
| jmull wrote:
| > keyword moderation is terrible and only affects the
| language(s) you know about.
|
| It doesn't seem that hard for npm to review lists of the most
| common keyword searches and identify the ones strongly
| associated with piracy (or other things negative for their
| business).
|
| I agree, though, that keyword moderation is pretty terrible. It
| might work from npm's perspective, in that it might be annoying
| enough to pirates that they'll find some more convenient place
| to upload/download. I don't think it will have any overall
| impact on privacy though.
| Waterluvian wrote:
| Keyword moderation feels like an unspirited attempt by developers
| to satisfy incompetent managers telling them to get other
| incompetent managers, upset about piracy, off their backs. I
| don't believe anyone involved actually thinks this will make a
| difference. It's just to address a complaint.
| alkonaut wrote:
| That's almost certainly the case. "What can we do that has an
| observable effect we can demonstrate as us being responsive,
| but doesn't have a significant cost [to ourselves]".
|
| It's the same as any other "this shouldn't be done, but a
| manager asks me to do it". If you aren't ready to die on that
| hill as I would, then there is nothing you can do. I'd easily
| take that fight but that's coming from a very privileged
| position (i.e., I'd not risk not having food on the table if I
| said no when a manager asked me to add keyword moderation or a
| dark-pattern cookie banner).
| RobotToaster wrote:
| "see boss, nothing is using the word "keygen", so obviously we
| have removed all keygens".
| mrweasel wrote:
| So,... has anyone with this issue actually contacted the NPM team
| and asked what is is about?
| franky47 wrote:
| I have, yes. Awaiting a response.
| tannhaeuser wrote:
| I'm assuming keygen must not be part of the package name
| specifically, right? Because keygen can be part of contained JS
| content without probs, as the sgml package is demonstrating
| (containing the legacy keygen element as part of its embedded
| HTML DTD grammar).
|
| But I'm still curious why keygen would be problematic as part of
| a package name?
| smashah wrote:
| This reminds me of the supply chain attack experts who's only
| solution seems to be blocking postinstall scripts.
| insanitybit wrote:
| That sounds completely different. Blocking the word 'keygen'
| accomplishes absolutely nothing and is clearly stupid. Blocking
| build scripts absolutely stops a major attack vector.
| smashah wrote:
| Malicious unchecked code in postinstall can just be moved to
| runtime so blanket blocking postinstall is as effective a
| solution to supply chain attacks as the solution of blocking
| npm packages with the word "keygen" in them is to the problem
| of .... js based keygens???
|
| There are many legitimate purposes for postinstall scripts
| yet the anti-postinstall crowd acts like they solved security
| issues with this one easy step.
| marcosdumay wrote:
| Postinstall scripts run without any interaction before the
| developer has any chance of reviewing the code.
|
| They are a very bad thing.
| smashah wrote:
| "any chance"???
|
| I can't square this circle of someone being paranoid
| about postinstall script but at the same time thinks the
| first chance to review dependency code is after doing a
| `npm i`.
|
| Check the git repo of the library you are installing
| beforehand if you're so paranoid about postinstall.
|
| And above that, never install any library for which the
| source is not readily available. This is the most basic
| first line of defense.
|
| username checks out.
| [deleted]
| dns_snek wrote:
| > Check the git repo of the library you are installing
| beforehand if you're so paranoid about postinstall.
|
| > And above that, never install any library for which the
| source is not readily available.
|
| Whether source is available or not is mostly irrelevant
| when you're potentially dealing with malicious code, you
| need to review artifacts that are being fetched from NPM
| since those can differ from source code on Github.
|
| Attackers aren't going to announce their malicious code
| through meaningful git commit messages in a prominently
| displayed GitHub repository. They will make innocent-
| looking commits on Github, then publish a new version
| containing a single additional line of malicious code on
| NPM.
| smashah wrote:
| > ...NPM since those can differ from source code on
| Github.
|
| True. How about people act their threat model? Instead of
| removing a feature for many users, just do whatever you
| need to do to be sure you're safe yourself?
|
| In what other major situation is the solution to nuke a
| feature due to security concerns?
|
| Afaik the main conversation about postinstall is around
| leeches complaining about political messages in their
| console and one or two other incidents
| throwaway290 wrote:
| Runtime can be anything from browser to quickjs to Node in
| a docker. In many such cases the only time code runs on
| your dev machine completely unsandboxed is install scripts.
|
| Yes it is good to never install malicious NPM packages
| anyway but if you develop for any of those runtimes and you
| do not bother to check dep tree the anti install script
| crowd saved your ass.
| duskwuff wrote:
| > Blocking the word 'keygen' accomplishes absolutely nothing
| and is clearly stupid.
|
| The intent is almost certainly to stop a spam campaign which
| was using NPM package pages to host links to outside sites.
| Similar pages have been discussed on HN previously [1].
|
| The fact that there was actual installable software involved
| was irrelevant to the attacker. All they were after was a way
| to put their content on a high-reputation domain -- and NPM
| was perfect for that.
|
| [1]: https://news.ycombinator.com/item?id=35370728
| lopkeny12ko wrote:
| I must be missing something obvious. What's malicious about the
| word "keygen"?
|
| What's the issue with ssh-keygen? gpg --gen-key?
| bitwize wrote:
| "Keygens" are programs that generate valid product keys in
| order to crack software copyright protection. Under the DMCA or
| similar laws in many other countries, they are illegal to use,
| create, or distribute.
| Etrnl_President wrote:
| Jokes on them, I run a keygen almost daily, for software I
| don't have, because I like the cool chiptune.
| solardev wrote:
| Back in the day, paid software used to use serial keys for
| activation. Keygens made valid reg keys using the same
| algorithm so you could pirate software easily.
| franky47 wrote:
| Piracy. Programs that generate activation codes for proprietary
| software are called keygens. They usually come with interesting
| musical accompaniments.
| distortionfield wrote:
| Yeah what was it about keygens always having the most
| unhinged synth soundtracks
| franky47 wrote:
| It sparked a whole new genre, Demoscene. I miss those days.
|
| https://en.wikipedia.org/wiki/Demoscene
| NamTaf wrote:
| It's part of the demoscene culture, which overlaps a lot
|
| https://en.wikipedia.org/wiki/Demoscene
| megous wrote:
| Keygens may or may not facilitate piracy, but they're not
| themselves piracy.
|
| This is just some ridiculous NPM policy. What will be next?
| Cracks?
| dyingkneepad wrote:
| > musical accompaniments
|
| Can someone please explain this to me?
| Suppafly wrote:
| back in the old days, keygens were a way for hacking groups
| to show off, so they had cool graphics and played music.
| ok123456 wrote:
| It's the 80s all over again. But instead of puritanical sysops
| it's huge multinational corporations. Maybe we'll just call them
| k3yg3n5.
| Etrnl_President wrote:
| Keygen Keygen KEURygEURN Keygen Keygen Keygen Keygen p
| K[?]i[?][?]i[?]
|
| K e y g e n
|
| keygen kietsieph Nguyen tsoquvgiloquvne ke~ngeth Keygen Keygen
| Keygen Keygen Keygen
| chx wrote:
| I thought buttbuttination taught everyone how incredibly stupid
| this is 25-30 years or so ago already?
|
| But no. Just a few years ago I tried to enter an answer into a
| Hungarian Q&A site recommending to take the Algeciras-Tangier
| ferry and the answer was refused.
| https://en.wiktionary.org/wiki/geci
| franky47 wrote:
| The Scunthorpe problem all over again.
|
| https://en.wikipedia.org/wiki/Scunthorpe_problem
| ricardo81 wrote:
| tee hee.
| retrocryptid wrote:
| wait... are you implying that "k*ygen" is a dirty word?
| [deleted]
| Kiro wrote:
| You're getting downvoted but I also don't understand the
| relevance here. Parent seems to imply this is a mistake by
| npm relying on partial censorship but aren't they literally
| banning this exact word?
| MSFT_Edging wrote:
| Dirty word in the context of security, copyright liability,
| etc.
| jrockway wrote:
| Ah yes, the age-old hacking tool: ssh-keygen.
| MSFT_Edging wrote:
| Don't spill the hacker secrets!
| georgyo wrote:
| I only recently learned that my username for 20 years has
| "orgy" in it, and I've been getting blocked by many games
| jbinto wrote:
| 20+ years of this handle online without problems, and I
| found out trying to sign up for Stern Pinball Insider that
| "bint" is a dirty word: https://en.wiktionary.org/wiki/bint
| _a_a_a_ wrote:
| Really isn't, it's about the same as calling a woman a
| cow.
| 0ct4via wrote:
| Wrong.
|
| Usage varies, but "bint" more commonly is akin to
| "b*tch", and is used in a very coarse and derogatory
| manner.
|
| Love how you're trying to justify degrees of acceptable
| misogynist terms, though /s
| _a_a_a_ wrote:
| Um? Here in the UK it's uncommon to hear it these days
| but it carries no special weight.
|
| How come you're unwilling to spell the word bitch?
| DropInIn wrote:
| Unless you're equally vocal about the terms Dick, Prick,
| Cock and all the other male specific derogatory terms,
| then you're just a foolish and socially harmful bigot
| masquerading as an activist.
|
| And I KNOW you are silent on those terms and use them
| frequently...
| true_religion wrote:
| You yourself imply there are different degrees to how
| acceptable the two terms are.
|
| Why else do you spell out one word but censor the other?
| nomel wrote:
| Related, here's a pretty impressive attempt to detect bad
| words, to allow a talking banana on a Twitch live stream,
| without being banned:
| https://www.youtube.com/watch?v=bJ5ppf0po3k
| EvanDotPro wrote:
| I use the same method for a Twitch TTS system I built and
| it works very, very well.
| ta1243 wrote:
| Make sure you travel via Penistone on your way there
| politelemon wrote:
| I assume that's near Scunthorpe
| sebastialonso wrote:
| This page is a delight to read.
| joostdecock wrote:
| Don't get me started
| zo1 wrote:
| Shouldn't it be spelled "de Kok" if that's a surname?
| oefnak wrote:
| No, because of Baantjer.
| efdee wrote:
| Met seej ow seej kaa.
| efdee wrote:
| De Kok, De Cock, De Kock, De Cok, ... All the same.
| Surname spelling was highly volatile before the French
| took over.
| LeifCarrotson wrote:
| [flagged]
| 8675309t wrote:
| Don't do this here.
| franky47 wrote:
| I don't see the problem, it's a perfectly cromulent word.
| 8675309t wrote:
| [flagged]
| chrsig wrote:
| I mean, just to push one onto the stack...
|
| > When disagreeing, please reply to the argument instead
| of calling names. "That is idiotic; 1 + 1 is 2, not 3"
| can be shortened to "1 + 1 is 2, not 3."
|
| > Please don't post comments saying that HN is turning
| into Reddit. It's a semi-noob illusion, as old as the
| hills.
|
| > Don't feed egregious comments by replying; flag them
| instead. If you flag, please don't also comment that you
| did.
| 0ct4via wrote:
| FYI, barking orders at people and swearing at them
| because you're personally offended by something said in
| humor, is much more stupid, and is arguably more
| unwelcome here than GP's comment.
| jorvi wrote:
| Filters like that are so trivial to bypass on a higher level
| too. Look at how many gamer or forum tags are "Lovecraft's
| Cat". And good luck catching those cases on a non-manual
| basis.
| zelse wrote:
| I once happened across a Github where all the repos were
| subtle little bits of anti-Semitic cant relating to the
| Holocaust. More than subverting them, they also often
| function as dog-whistles for fellow travelers.
|
| (For those not getting the specific one used above,
| Lovecraft had a black cat and a common name for black cats
| at the time combined a now nigh-unprintable racial slur for
| black people with the word 'man'.)
| throwaway290 wrote:
| Github has a reporting feature!
| benatkin wrote:
| Everyone did, but Microsoft continues to be terrible. Replace
| Edge with GitHub or npm or vscode and see what a trap this is.
|
| - npm sends images you view online to GitHub
|
| - vscode bakes a VPN into npm and turns it on
|
| - The dark defaults of npm
|
| - vscode records editing (browsing) history in InPrivate mode
|
| Azure or OpenAI seem even worse. And Windows has a lot of Edge-
| like things built into it, including how it tries to get users
| to use Edge.
| rafram wrote:
| Did you reply to the wrong comment?
| [deleted]
| sieabahlpark wrote:
| [dead]
| hinkley wrote:
| At the dawn of the search engine age I was in Japan, and so I
| spent some time not being able to learn about shitake
| mushrooms, as was a common western spelling at the time (they
| are not shi-ta-ke mushrooms, they are in fact shi-i-ta-ke
| mushrooms, hence the spelling change, even though we still
| pronounce them wrong).
|
| You couldn't say shit on the internet. I mean what the fuck.
| jjgreen wrote:
| ... the dirty bastards
| https://www.youtube.com/watch?v=ndcPtU6Imc0
| Dylan16807 wrote:
| "shi-i-ta-ke" is not very accurate. It's a long vowel, and
| the word has three syllables.
|
| But english mostly ignores long vowels, hence the alternate
| spelling.
| zelse wrote:
| It's funny, because in Old English ('Anglo-Saxon'), vowel
| and consonant length are both semantically important.
|
| For those of you who want to have a better handle on the
| distinction, you can think of it as the sound having an
| extra 'beat', where a beat is the amount of time
| pronouncing that sound normally occupies.
|
| It's easier if you take advantage of the one place English
| still distinguishes this: word boundaries.
|
| Listen how you say, for example: Tibetan nitwit (you're
| holding the 'n' for two beats because your brain treats the
| distinction as important /when it's at a word boundary).
| You can do this with vowels too as an exercise, though
| they're a bit harder because English has a lot of vowels
| and finding good matches is a bit difficult.
| hoherd wrote:
| LOL, that is a great mnemonic! Now I will always remember how
| to spell assassination.
| jaggederest wrote:
| Also known as a clbuttic error.
| jwestbury wrote:
| For the uninitiated, the origin of (the popularity of)
| clbuttic: https://thedailywtf.com/articles/The-Clbuttic-
| Mistake-
| 40yearoldman wrote:
| Every time npm comes up I remind everybody that npm is shit, and
| nobody should use it. They have a bad track record of doing
| things right and bad attitude when told.
|
| But you keep using it.
|
| I refuse to use it at work and refuse to use it in personal life.
| It's not real software and will cause you harm.
| tobiasSoftware wrote:
| Fun fact. Several years ago I started getting charges from NPM,
| which although I am a software developer I have never used. I
| cancelled my credit card multiple times, but they kept
| appearing each month.
|
| I went to my bank, Bank of America, and they claimed that there
| was nothing they could do because NPM was using some sort of
| option they had to follow me when I got new credit cards. I
| don't know what kind of option that is, as every time I get a
| new credit card I have to update it with literally every other
| company. I also don't know how a bank wouldn't have some sort
| of manual override. Nevertheless, I called NPM, who said I had
| to talk with my bank. Eventually, after months of dealing with
| this loop, I threatened to leave my bank, and my bank advised
| me to call them and threaten to get the BBB involved if they
| didn't fix it, and a few days later NPM admitted it was an
| error on their end and reversed all of the charges.
|
| To this day I wonder what kind of shady thing NPM was doing to
| not just charge someone who had never been a customer of
| theirs, but to follow them across cancelled credit cards.
| hunter2_ wrote:
| Ok, I'll bite. There is no way a merchant can learn a new
| card number other than from the cardholder, or from a thief
| who got it from the card/cardholder. Not from any upstanding
| entity.
|
| If you merely got a new expiration date, security code, etc.
| without also changing the card number, they could "follow"
| that by submitting a transaction without those extra pieces
| of information, at greater cost and risk to themselves,
| though.
|
| I'll happily take downvotes if I'm wrong, for being assertive
| without a source.
|
| Are you sure NPM was actually charging your card directly,
| and not a digital wallet or similar virtual card thing which
| you kept active?
| JohnFen wrote:
| Some banks have a service where if you use your card for
| ongoing regular payments and the card is replaced for any
| reason, the bank will allow those regular charges to
| continue on the new card when the service provider uses the
| old number.
|
| It's very convenient if that's what you want -- it means
| you don't have to go to all of the ongoing services to
| update your card immediately. But it does mean that you
| can't count on changing a card to stop unwanted ongoing
| charges.
|
| I recently replaced a card at my bank, and they offered
| this as an opt-in service (which I opted in to), but I hear
| that some banks make it opt-out, instead.
| hunter2_ wrote:
| Ah. So in that case, NPM is not learning a new card
| number, and probably isn't even aware of anything at all,
| given that the card issuer is simply accepting
| transactions (instead of declining them as this person
| expected) on the old card number.
|
| NPM was in the wrong for continuing to place unwanted
| transactions, but they were not actively participating in
| this "follow" scheme so the blame stops short of that.
| piperswe wrote:
| According to Stripe,
|
| "Stripe works with card networks and automatically attempts
| to update saved card details whenever a customer receives a
| new card (for example, replacing an expired card or one
| that was reported lost or stolen)."
|
| https://stripe.com/docs/saving-
| cards#:~:text=Automatic%20car...).
| devmor wrote:
| Reminds me of the times I've seen junior devs changing "password"
| to "wordpass" to bypass automated commit checks for sensitive
| data.
|
| These kinds of checks are so trivially defeated, the only people
| they actually stop is people trying to do legitimate work.
| sebzim4500 wrote:
| Presumably some of those devs will see the warning and think
| "oh yeah, I probably shouldn't commit the password" rather than
| find a workaround.
| marcosdumay wrote:
| I really hope their password isn't literally "password", so I
| can't see how blocking that word improves anything.
| zirgs wrote:
| Tbh in this case that check is useful. It prevents devs from
| accidentally including passwords in their commits.
| devmor wrote:
| Not a perfect example, but the point is that it's not
| stopping anyone from doing anything malicious.
| throwaway22032 wrote:
| Where will I get my Keigen now?
| evv wrote:
| Oh. As the creator and reluctant maintainer of npm's "ssh-
| keygen", this is awkward!
|
| First question: does this mean I won't be able to publish patches
| to the package?
|
| Why do I _not want_ this package under my control? The original
| package simply calls spawn for your real `ssh-keygen` with the
| appropriate arguments. No real problem, (although there is very
| little value here). But a contributor added support for Windows
| by uploading opaque binary builds for Windows. While I have no
| reason to distrust the contributor, it is scary to be
| "responsible" for opaque executables that I did not personally
| produce.
|
| So, what should I do with this package? Assuming npm lets me do
| anything?
|
| Fortunately this package is "only" downloaded ~1600 times/week,
| miniscule for npm. If you are tempted to use ssh-keygen, I
| recommend you learn how to use execFile/spawn, and use the native
| program directly.
|
| For context, I published this 10 years ago, as one of my earliest
| contributions to open source. I probably wouldn't have gone near
| any security-essential contributions if I had more experience at
| the time.
| franky47 wrote:
| > But a contributor added support for Windows by uploading
| opaque binary builds for Windows
|
| > "only" downloaded ~1600 times/week
|
| This begs for an audit.
| evv wrote:
| Yes.
|
| If npm lets me publish a new version, I'd be happy to remove
| the Windows binaries.
___________________________________________________________________
(page generated 2023-06-14 23:02 UTC)