in reply to What if someone liberated his Perl modules?

What if someone liberated his Perl modules?

There is a recent event where a Node.js developer decided to unpublish all of his 250 or so modules on npmjs.org (including some very popular modules, causing large breakage) following a corporate takedown notice for one of his modules. The ensuing HN discussion thread highlights a security issue where a malicious author could upload a malicious update to a previously existing (but then unpublished) module. I'm wondering how such issue is handled in the Perl (CPAN) community.

Calling deleting/removing your modules "liberation" is clownshoes; ok the guy called it that, but you're not that guy right? :P

CPAN/PAUSE is first come first serve

Once you register a namespace it is yours, even if you delete all releases, all other uploaders are "unauthorized"

It takes human intervention to make someone elses upload "authorized"

See http://pause.perl.org/pause/query?ACTION=pause_04about#takeover

I didn't read the rest of your post

  • Comment on Re: What if someone deleted his Perl modules? (cpan/pause unauthorized)

Replies are listed 'Best First'.
Re^2: What if someone deleted his Perl modules? (cpan/pause unauthorized)
by perlancar (Hermit) on Mar 23, 2016 at 12:42 UTC

    Once you register a namespace it is yours, even if you delete all releases, all other uploaders are "unauthorized"

    It takes human intervention to make someone elses upload "authorized"

    That's why I wrote "an extra step of giving up primary/co-maintainer status".
[reply]

      That's why I wrote "an extra step of giving up primary/co-maintainer status"..... once the original author makes the namespace available again, it's back to free for all: any other PAUSE author (malicious or not) can theoretically upload to the same namespace and spread malware or compromise users' systems via module update. It's easy to register a PAUSE account.

      IIRC (i'm not 100%) but it doesn't work like that, if you give up ownership, it still takes manual action by PAUSE administrators/moderators to grant somebody else ownership, unless you're giving it up to a co-maintainer, in which case ... you trusted the team once yeah, so :p

[reply]

        I happen to use two PAUSE ID's (old and new) and for the past 1.5 years have been uploading (using the new account) distributions that were once uploaded using the old account.

        Haven't specifically looked into it, but I admit in my experience it's a bit weird sometimes. Sometimes (1) I just need to delete my distribution on the old account, wait a few minutes (not even need to wait 72 hours), and then the related packages would automatically be free and when I upload the distribution using the new account, I get "first-come" again. But sometimes (2) I do have to go to Change Permissions page from my old PAUSE account and explicitly give up primary maintainership before my new distribution on my new PAUSE account gets indexed.

        Perhaps in the case of (1), the PAUSE admin was behind it?

[reply]

In Section Meditations