against   2169

« earlier    

2016: I've Just Liberated My Modules | Hacker News
Unclear how this was solved.

[[The fact that this is possible with NPM seems really dangerous. The author unpublished (erm, "liberated") over 250 NPM modules, making those global names (e.g. "map", "alert", "iframe", "subscription", etc) available for anyone to register and replace with any code they wish.

Since these libs are now baked into various package.json configuration files (some with 10s of thousands of installs per month, "left-pad" with 2.5M/month), meaning a malicious actor could publish a new patch version bump (for every major and minor version combination) of these libs and ship whatever they want to future npm builds. Because most package.json configs use the "^1.0.1" caret convention (and npm --save defaults to this mode), the vast majority of future installs could grab the malicious version.

This is extremely severe. Any package i install might after x levels of sub-dependencies pull in one of these names which are potentially pwned. React and Babel pulled in a few of them to take some well known examples.

I would say the whole npm is pwned until these packages are either restored or that the package name is blacklisted/reserved.]]
security  exploit  against  npm  kik 
5 days ago by dandv
Microsoft tests ‘warning’ Windows 10 users not to install Chrome or Firefox - The Verge
"yet another example of Microsoft infesting Windows 10 with annoying ads and pop-ups. [...] Microsoft has previously pushed notifications to Chrome users to tempt them to switch to Edge, used OneDrive ads in File Explorer, and preloaded a variety of crapware apps in Windows 10."
against  Windows  Microsoft 
7 days ago by dandv
Do I need to stretch before exercising? - NHS
Stretching doesn't reduce the risk of injury, and decreases performance.
against  stretching 
8 days ago by dandv

« earlier    

related tags

#metoo  &  'bbc  'be  'bohemian  'butthole  'genocide'  'hetero-washing'  'jealous'  'last-chance  'no  'real'  'stunning'  'world  10  12  2008  2018  25  365  4  a  aberdeen  abiri  about  abuja  abuse  accomplices  accusation  act  acting  action.  action  adidas  adopting  advocate  affirmative  afghan  after  again.  agreeing  agrees  ai  airbnb  albania  alex  allegations  alternative  american  amp4email  an  and  anonymity  anonymous  another  anthem  any  appeal  apple/google  apple  are  argento  argument  ariana  ark  artists  asia  asian-americans  asians  assault  at  atrocities  attack  attacks  back  ban  barack  barely  basis  be  before  being  best  bezos  bias'  bitterness  blinking  blog  blood  boston  brett  brexit  brown  buterin  c.k.  calls  campaign  can’t  capitalism  card  cartoon  case  censorship  census  ceo  change  channel  charges  checks  china  church  ciara  cisco  cities  citizenship  claim  claims.  clarkson  climate  close  code  colin  colleges  collusion  comedy  company  competition  complaint  condemn  content  continues  cool!'  cop  costa  couple  court  coverup  cpj  craig  crisis  criticism  crowd  crypto  currency  customers  cyberattacks  dascalescu  data  davidson  deadly  deal'  deanonymize  death  deeper:  deepfake  defend  defended  defender's  defends  defense  delegated  deletionism  dem  department  destroy  detroit  developers  devlin:  didn’t  diet  digital  disciplinary  discriminate  discriminates  dismissed  dismisses  display  documents  doesn’t  dos  drop  eddie  ellison  elon  elysium  ethereum  everything  evidence  experts  explained  exploit  eyes'  fail  fake  false  family  fans  favorite  fbi  feds  festivals  fighting  fights  filed  files  fine  fit  flora  florida  food  for  founder  francis  fraud  freelance  from  full  funds  generals  genocide  gerrard  get  glasgow  globe  go  goal  goods  government  governor's  grande  grievance  gut  hair  hairline  happy  harass  harassment  harvard  has  he  health  hearts:  helping.  her  here  his  home  homophobic  horrifying  hot  how  huang  hypersonic  ibm  identity  ike  immigration  in  insecurity  international  into  investigation  invest’s  iran  is  islands  isn't  isn’t  it  its  i’ve  jack's  javascript  jeff  joe’s  john's  john  jones  journalist  justice  kaepernick’s  kavanaugh  keith  kelly  kenny  kik  killed  kilmarnock  knee  kneelers:  korean  launches  lawsuit  lawsuits  lee  legal  lesbian  letter  levein  liberal  library  limits  local  loss  louis  machine-learning  macros  make  maldives  malek  malicious  manafort  marriage  marshall  mass  match  material-design  mccain  mccain’s  mcdonald’s  mcgowan  media  medium  member  men  methodists  michael  microbiome  microsoft  might  miller  mirren  misconduct  mollie  more  musk  mutiny  my  myanmar  naismith  native  needed  negative  new  next  nfl  nicaraguan  nigerian  node.js  nootropics  north  not  npm  nvidia  ny  obama  of  office  on  one  ones  ongoing  op-ed  open  operating  opposition-aligned  order  osijek  ousts  out  outline  over  overturn  own  papa  part  patches  paul  peace'  people  performance  pete  pick  pills  pitino's  pizza  plans  playing  pledge  police  policies  policy  poor  pope  positional  press  private  process  profile.  progress  proof  prosecuted  prosecutor  protection  protests  pseudoscience  pushes  question  raajje  race  racially  racist  rages  rails  rami  rangers:  rape  rapper  react-router  read  real-time  rebel  rebelling  receding  red  reinstated  rejects  rep.  report  report:  republicans  restraining  retaliate  retaliatory  revenge  review  rhapsody'  rica  rick  rise.  rohingya  romance  rose  rules  russell  ryan  saloon'  same-sex  sanctions  saying  says  scare  scotland  scottish  security  seeks  seo  separation  serena  sessions  sexual  shakes  should  slim  social  speak  speaking  spectracell  spicy  st.  st  stackexchange  stackoverflow  stake  stand  steven  streets  stretching  strike  strikes:  students  studied  subtle  supplements  supreme  surefire  systems  take  taking  target  tariffs  tax  tay-k's  team  tesla  test  tested  testify  testing  the  their  these  thought  threatens  threats  thug  tibbetts’s  times  to  trader  transcript  transgender  transplants:  treatment  troll  truly  trump's  trump  trump’s  tv  tweets  twitter  u.s.  ubuntu  un  us  usa  used  venus  violated  violence  violent  viome  vitalik  vote  voter  wallace  war  warned  warns  was  watch  ways  weapon  where  who  will  williams  wilson  win  windows  wings  wins  wipe  with  women  won't  workers  writers  yas:  yourself  |   

Copy this bookmark:



description:


tags: