I guess we now live in the post-"ads in the npm install log" erapic.twitter.com/pSnBnMDNSg
Show this thread
-
This is probably a good time to start investigating mitigations for the kind of scenario where an npm install script tries to make HTTP requests
Show this thread
Because an npm install script which dynamically loads ad code is a really amazing opportunity to inject "ad" code which, I don't know, scoops up secrets from the local environment and sends them somewhere
-
-
To be clear: we got to this point because people want money. As long as we live in a capitalist society, there's no point where people stop wanting more money. That means ads will eventually permeate every electron of our universe. It is/was inevitable
Show this thread -
No amount of revamping open source software funding structures would have prevented this from happening eventually, nor can it make this go away now it's begun
Show this thread -
Advertising in your install log is going to be as simple as dropping a banner ad on your website. Install log ads are going to have all the same problems and very familiar solutions
Show this thread
End of conversation
New conversation -
-
-
fopen("~/.ssh/id_rsa","rb");
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.