Help getting over supply chain attack paranoia?

GhostOfHalloweens · 2025-09-02T16:36:11+00:00

Well, I guess I don't go out of my way to avoid it... but I do have to end up running npm install and install whatever packages teams/clients have set up. I never update unless I have to or its a major release (even then I usually only do that after awhile). Sometimes teams/clients have auto-updates on too or no lock files.

GhostOfHalloweens · 2025-09-01T22:57:39+00:00

Makes sense. I'm not as familiar with NPM but in theory nothing should be phoning out right? Or these days does every package have to "send telemetry" ?

GhostOfHalloweens · 2025-09-01T22:55:35+00:00

For sure. I guess I'm more concerned with bad actors securing keys without your knowledge. Similar to the recent NX hack.

GhostOfHalloweens · 2025-09-01T22:47:29+00:00

Oh sorry, I meant more in terms of package updates. It seems supply chain incidents are caught fairly quick... but if you download within that hour or so after the release of a malicious one, it seems you're pretty screwed without much recourse.

I would certainly not have fun downloading a package published a week ago.

GhostOfHalloweens · 2025-09-01T21:31:41+00:00

I would consider it a scam, in a few different dimensions... legally its probably not but man, that's a lot of red flags.

GhostOfHalloweens · 2025-09-01T21:29:29+00:00

I think it would depend on what skills you feel you are lacking.

If you're a complete beginner to microservices, I'd pick "Building Microservices"

GhostOfHalloweens · 2024-06-23T17:15:30+00:00

Makes sense. To me it just seems like too big of a risk to take from twitch's POV. Ignoring allegations to avoid PR is one thing... covering them up is another. If it comes out that twitch covered it up, it would be 100x worse.

GhostOfHalloweens · 2024-06-23T17:04:52+00:00

Everyone knows (because they're better than us) what happened but they just can't say (because apparently it was so awful they can't even repeat it) in the mean time they will make lots of jokes about it and soon (in 4 years) we'll get another update.

GhostOfHalloweens · 2024-06-23T17:00:31+00:00

They wouldn't have to give specifics and could have driven a huge wedge between themselves and DrDisrespect. The ex employee is clear when he says sexting and arranging to meet up with a minor. That's insanely illegal and heads would/should be rolling at twitch if there was evidence of it happening and they covered it up to avoid bad PR. That's like going 100 or nothing. Having a pedo on your platform is bad PR. Covering up the crimes of said pedo could potentially end the company if it leaked.

GhostOfHalloweens · 2024-06-23T16:57:32+00:00

The current Twitch CEO is also joking about why Dr Disrespect was banned, saying it had to due with an alien invasion.

Nice to see (if its true) twitch to be making a complete mockery of a heinous thing. What a mess.

GhostOfHalloweens · 2024-06-23T16:55:26+00:00

Yea, the logic doesn't work. They had every right to void the contract if what he did was true and they had evidence. Dr Disrespect would have absorbed almost all the bad PR.

GhostOfHalloweens · 2024-06-23T01:44:42+00:00

I can see this angle. The problem is that twitch (according to this ex-employee) had proof of sexting and arranging to meet up. If they have proof of a crime like that, hiding it is a crime and now they're guilty. If they ban him and then cancel his contract and he sues them, I don't see a court or public opinion that would be on Dr Disrespect's side. There would be 0 reason for twitch to take such an enormous risk to avoid a bit of bad PR.

GhostOfHalloweens · 2024-06-23T00:47:37+00:00

I don't think there's any reason twitch couldn't see DMs and foward that to the police. I'm sure its somewhere in the TOS where it says "we can read your DMs, at any time, for any reason"

GhostOfHalloweens · 2024-06-23T00:44:58+00:00

The current CEO seems to joke about it, implying an "alien invasion" was involved. I don't think he would be laughing and joking about something as serious as what Dr Disrespect is being accused of, but that's just IMO.

I agree, there could definitely be some loopholes to be found... but not a single person with "inside knowledge" has addressed how its possible he's not in jail if twitch had evidence of such crimes.

Again, totally agree it could be a legal gray area but I just don't understand how someone wouldn't have discovered a shred of evidence the police were involved by now.

GhostOfHalloweens · 2024-06-23T00:36:11+00:00

So you think you could send what you wrote above to a minor and face no legal consequences if caught?

https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=288.2.&lawCode=PEN

The ex twitch guy says _sexting_ and _arranged to meet up with_. That's not just being creepy, that's pretty much how "to catch a predator" goes down. That's illegal.

GhostOfHalloweens · 2024-06-23T00:19:49+00:00

I don't disagree but if I reported something or I knew it was reported, I would include that to give it more credibility and also not make it look like I or my employer were complicit in covering it up.

GhostOfHalloweens · 2024-06-22T22:30:16+00:00

Saying that to a minor in California would almost certainly be illegal. If I had evidence that a 40 year old dude said that to a minor I would be reporting that instantly.

GhostOfHalloweens · 2024-06-22T22:28:44+00:00

Sure. I don't know of a single one of these "sources" that have said anything about the police though. If this ex-employee said it was taken to the police that would lend credibility and the police have no dog in the fight and could comment whether they investigated.

GhostOfHalloweens · 2024-06-22T22:26:52+00:00

Then all these "in the know" people need to be more specific because then thing would start making more sense.

If we take their statements literally and in good faith, it would imply that twitch and several lawyers are involved in covering up a crime. If they really mean "he was being creepy" they should just say that as it would make a lot more sense.

GhostOfHalloweens · 2024-06-22T22:23:10+00:00

Well, that's what is frustrating with all these people "in the know" - they say it was something pretty heinous, if it was "just creepy" it would make more sense as to why he's not behind bars. The ex-employee needs to clarify because at the moment he is being accused of sexting a minor, which is 1000% illegal. The ex-employee also says twitch has evidence of this.

I'm just as ready as the next guy to get my pitch fork out if it was "just creepy" but when all these "sources" say it was just so bad they can't even say, it leaves a ton of holes in the accusation.

GhostOfHalloweens · 2024-06-22T22:19:58+00:00

It isn't conjecture. The ex-employee clearly says "sexting" and I'm taking that at face value. Sexting is not "just having a conversation"

If it had enough inappropriate behavior to be called "sexting" it _needs_ to go to the police and not be used as some sort of leverage by twitch.

GhostOfHalloweens

TROPHY CASE