<story><title>Post-mortem of this weekend&apos;s NPM incident</title><url>http://blog.npmjs.org/post/169582189317/incident-report-npm-inc-operations-incident-of</url></story><parent_chain><item><author>smt88</author><text>Why allow namespace recycling at all? The potential harm is high and the potential benefit is some slight convenience.&lt;p&gt;If npm packages used a Github-style &amp;quot;author&amp;#x2F;package&amp;quot; format, name collision would never be an issue again.</text></item><item><author>bhuga</author><text>This is a good post-mortem with clear, policy-based remediations. Nicely done.&lt;p&gt;I wonder why they are only preventing republishing for 24 hours. Is there a good reason to allow a package namespace to be recycled with less than, say, a week? Is it based on the assumption that the only case where it comes up is during an incident, and 24 hours is enough time to assume an incident will be resolved? I&amp;#x27;m curious what went in to that number.</text></item></parent_chain><comment><author>colanderman</author><text>When your code deployment model is effectively &amp;quot;download stuff from random websites&amp;quot;, I feel like namespace recycling is the least of your worries.&lt;p&gt;(That is to say, trusting that any given named package that `npm install` downloads is what you think it is is really no different that trusting `wget &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;example.com&amp;#x2F;thecode.tgz`&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;example.com&amp;#x2F;thecode.tgz`&lt;/a&gt;.  Even if you verify that the domain hasn&amp;#x27;t switched hands, you have no guarantee that the author&amp;#x27;s pipeline wasn&amp;#x27;t compromised, or that the author didn&amp;#x27;t add malware themselves.  There&amp;#x27;s a reason Debian, Red Hat et. al. put a lot of effort into ensuring integrity of their repositories.)</text></comment>
<story><title>Post-mortem of this weekend&apos;s NPM incident</title><url>http://blog.npmjs.org/post/169582189317/incident-report-npm-inc-operations-incident-of</url></story><parent_chain><item><author>smt88</author><text>Why allow namespace recycling at all? The potential harm is high and the potential benefit is some slight convenience.&lt;p&gt;If npm packages used a Github-style &amp;quot;author&amp;#x2F;package&amp;quot; format, name collision would never be an issue again.</text></item><item><author>bhuga</author><text>This is a good post-mortem with clear, policy-based remediations. Nicely done.&lt;p&gt;I wonder why they are only preventing republishing for 24 hours. Is there a good reason to allow a package namespace to be recycled with less than, say, a week? Is it based on the assumption that the only case where it comes up is during an incident, and 24 hours is enough time to assume an incident will be resolved? I&amp;#x27;m curious what went in to that number.</text></item></parent_chain><comment><author>Ajedi32</author><text>Seems like they&amp;#x27;re only allowing name reuse in the case of spam packages. Not allowing name reuse in that case might result in lots of names being rendered permanently unusable by automated spambots.&lt;p&gt;Assuming no actual users are depending on packages which are literally just spam, I don&amp;#x27;t really see an issue with reusing the names of those packages.</text></comment>