Hacker Newsnew | past | comments | ask | show | jobs | submit | everybackdoor's commentslogin

This is about NestJS, not NextJS.


You can also fire events on pretty much any object, essentially creating a channel where the message bus queue is the vm event queue.


> You can also fire events on pretty much any object,

Only if you have a reference to the object.

The reason I made up my own message queue pub/sub is because events required a lot of complexity in acquiring the correct reference to the correct object or subtree in the DOM.

With pub/sub type message queue, any element can emit a message with subject "POST /getnetpage" and the function listening for (subscribed) POST messages emits a RESPONSE message when the response comes back. This lets a third element listen (subscribe) for a "RESPONSE FROM /getnextpage" subject message, and handle it.

None of the 3 parties in the above need to have a reference to each other, nor do they even have to know about each other, and I can inject some nice observability tools because I can just add a subscriber for specific message types, which makes debugging a breeze.


In 2024 we have linters and other static analysis tools for catching these kinds of things right in the IDE.


And a backdoor in a build tree


Imaginary exercise for the reader: find a sneaky dot in a patch that implements this in Firefox.


- They’re saying ”the community wants less boilerplate”

- They introduce what is effectively a black-box system

- The new system is expected to handle all application state

- They try to push it for frontend folks while also remarking that it would be useful for build systems

This has the same red flags the xz saga had.

Have we learnt nothing.

Lots of ”users” here vouching for the pattern and hoping it gets adopted. I bet this gets some nice damage control replies because there’s social engineering going on here right now and most seem to not be aware of it.


Look at the newest commits, do you see anything suspicious:

https://git.alpinelinux.org/aports/log/main/gettext

libunistring could also be affected as that has also been pushed there


Seeing so many commits that are "skip failing test" is a very strong code smell.


Yes, but it is often a sad reality of trying to run projects mainly written for glibc on musl. Not many people write portable C these days.


It's still the wrong way to go about things. Tests are there for a reason, meaning if they fail you should try to understand them to the point where you can fix the problem (broken test or actual bug) instead of just wantonly distabling tests until you get a green light.


> do you see anything suspicious

No.

> libunistring could also be affected as that has also been pushed there

What do you mean by "that"?


Funny you should say that, given they definitely have exploit code in `vcpkg`


They may be right: https://git.alpinelinux.org/aports/log/main/gettext

Timeline matches and there is a sudden switch of maintainer. And they add dependency to xz!


psykose was a prolific contributor to Alpine's aports, with thousands of commits over the past few years[0]. So, I doubt They're involved.

[0]: https://git.alpinelinux.org/aports/stats/?period=y&ofs=10


JiaT75 was also a prolific contributor to xz over the past few years, so your assumptions are generally invalid at this point.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: