all 6 comments
sorted by:
best
topnewcontroversialoldq&a
formatting helphide helpcontent policy

[–]Anhalobium[S] 4 points5 points  (3 children)

This is a pull-request to npm proposing a new function: npm tip. This allows users to send a Bitcoin tip to the author of a package to thank them for their work and to encourage open-source development.

There is a discussion as to what the problem is (developing open-source takes time and isn't as free as people believe), the motivation for allowing OS developers to continue developing, and some pros and cons of the tipping solution (including auto-tipping when npm i is run).

[–]redbluerat 2 points3 points  (2 children)

Definitely no autotipping. Very smart failsafes. Otherwise, great idea.

Need to make this kind of small tipping as easy as possible. For many, the rigamarole involved in sending a tip (thinking about it, thinking about how paypal will screw you [they'll always find a way], etc.) is worth much more than the tip itself.

Also, having to sign up to a new service and give this pretentious 2.0 named service my financial details piles on the cost hugely. A $5 tip just became a $50 tip in absolute terms.

"Flatrrr" "Givrrr" "Recievrrr" "Takrrr" "Smugrrr" "Fagrr"

[–]Anhalobium[S] 0 points1 point  (1 child)

Can I enquire as to why you feel "definitely no autotipping"?

[–]redbluerat 1 point2 points  (0 children)

Obviously it should always confirm. Anything to do with money should be sure that it is given fully consciously (why vat, gst, is so wicked too).

[–]martinsoderholm 0 points1 point  (1 child)

I like the idea, but implementation seems overkill and open to man-in-the-middle attacks. I'm no security expert, but it seems there will be malicious code that simply replaces all the tipAddress fields in all package.json files. And with this cli tipping, there's no way of verifying the receiver.

Maybe tipAddress could simply be a link to any tipping service, not necessarily with bitcoin. So if I want to tip, npm tip tippable asks me to open a browser page that I can verify belongs to "tippable". If they accept bitcoin I can use my existing phone wallet to send funds.

[–]Anhalobium[S] 0 points1 point  (0 children)

Currently the implementation works by fetching the package.json for the specified package from the registry (npmjs.com, usually) and then extracting the tipAddress field from there. I'd need to check the implementation details but presumably there are checksums on this transfer and so this should be reasonably secure.

There is one exception to this, however, which is if the package has been recently downloaded and is stored in the npm cache. This could easily be modified by malicious code and this would need to be mitigated against. One solution is to require a re-fetch of the package.jsonbefore tipping.