4 ms·

A lot of butthurt people railing on the guy. Maybe he just doesn't care anymore about a dead package he has no intention of maintaining. Blame yourselves devs,

A lot of butthurt people railing on the guy. Maybe he just doesn't care anymore about a dead package he has no intention of maintaining. Blame yourselves devs, not the author who donated hours and hours of free work for your benefit.

xvector 8y ago
It’s about ethically handing off a package. No one is forcing him to maintain it. But when you make a package used by millions of people, you become responsible for their safety. To then hand over a package to a hacker or unknown party is just morally wrong. Just mark it as deprecated and call it a day, like a normal and responsible person.
- perfunctory 8y ago
  Well, he didn't really hand it over to a hacker, did he?
  - pcnix 8y ago
    His responsibility as a maintainer is to signal when there's a change in power, since the package is trusted via his credentials.
    - perfunctory 8y ago
      > the package is trusted via his credentials. Somebody really needs to explain to me how this works. The dude's bio on github is "antipodean wandering albatross". Nothing against it btw.
- sergiotapia 8y ago
  >But when you make a package used by millions of people, you become responsible for their safety. Says you! I don't agree with that. Author clearly doesn't either. You're painting it as though the author knowingly handed it over to some hacker when in reality he had 0 cares about this package and just handed it over to the first guy who asked. I would have done the same probably.
  - quaunaut 8y ago
    This is incredibly irresponsible. If you don't have the care to maintain it or do any sort of vetting, you shouldn't have the care to do anything at all. Literally, leaving this unmaintained would have been a better solution.
- program9 8y ago
  No -- downstream devs are responsible for the safety of their own apps, users, and org.
tashoecraft 8y ago
A dead package with 2million downloads a week, not very dead no matter what the maintainer thinks of it.

xvector 8y ago

It’s about ethically handing off a package. No one is forcing him to maintain it. But when you make a package used by millions of people, you become responsible for their safety. To then hand over a package to a hacker or unknown party is just morally wrong. Just mark it as deprecated and call it a day, like a normal and responsible person.

perfunctory 8y ago
Well, he didn't really hand it over to a hacker, did he?
- pcnix 8y ago
  His responsibility as a maintainer is to signal when there's a change in power, since the package is trusted via his credentials.
  - perfunctory 8y ago
    > the package is trusted via his credentials. Somebody really needs to explain to me how this works. The dude's bio on github is "antipodean wandering albatross". Nothing against it btw.
sergiotapia 8y ago
>But when you make a package used by millions of people, you become responsible for their safety. Says you! I don't agree with that. Author clearly doesn't either. You're painting it as though the author knowingly handed it over to some hacker when in reality he had 0 cares about this package and just handed it over to the first guy who asked. I would have done the same probably.
- quaunaut 8y ago
  This is incredibly irresponsible. If you don't have the care to maintain it or do any sort of vetting, you shouldn't have the care to do anything at all. Literally, leaving this unmaintained would have been a better solution.
program9 8y ago
No -- downstream devs are responsible for the safety of their own apps, users, and org.

tashoecraft 8y ago

A dead package with 2million downloads a week, not very dead no matter what the maintainer thinks of it.