3 ms·
It’s about ethically handing off a package. No one is forcing him to maintain it. But when you make a package used by millions of people, you become responsible
by xvector 8y ago
It’s about ethically handing off a package. No one is forcing him to maintain it. But when you make a package used by millions of people, you become responsible for their safety. To then hand over a package to a hacker or unknown party is just morally wrong.
Just mark it as deprecated and call it a day, like a normal and responsible person.
- perfunctory 8y agoWell, he didn't really hand it over to a hacker, did he?
- pcnix 8y agoHis responsibility as a maintainer is to signal when there's a change in power, since the package is trusted via his credentials.
- perfunctory 8y ago> the package is trusted via his credentials. Somebody really needs to explain to me how this works. The dude's bio on github is "antipodean wandering albatross". Nothing against it btw.
- sergiotapia 8y ago>But when you make a package used by millions of people, you become responsible for their safety. Says you! I don't agree with that. Author clearly doesn't either. You're painting it as though the author knowingly handed it over to some hacker when in reality he had 0 cares about this package and just handed it over to the first guy who asked. I would have done the same probably.
- quaunaut 8y agoThis is incredibly irresponsible. If you don't have the care to maintain it or do any sort of vetting, you shouldn't have the care to do anything at all. Literally, leaving this unmaintained would have been a better solution.
- program9 8y agoNo -- downstream devs are responsible for the safety of their own apps, users, and org.