3 ms·

To an extent it's because his name is in the repo name (dominictarr/event-stream) https://github.com/dominictarr/event-stream https://github.com/dominictarr/eve

To an extent it's because his name is in the repo name (dominictarr/event-stream) https://github.com/dominictarr/event-stream https://github.com/dominictarr/event-stream so he is an easy and obvious scapegoat. But it seems people in general forgot that they are not paying and are not entitled to any sort of support.

nailer 8y ago
People in this case aren't asking for support, they're asking for the project to have been given to a trusted maintainer or declared abandoned.
- mehrdadn 8y ago
  To be honest I wouldn't expect an abandoned project to be any different. I would expect it to have lost its maintainer, not switched from a trustworthy maintainer to a malicious one. Edit: Clarified second sentence.
  - madrox 8y ago
    No maintainer is malicious...until they are. Be honest with yourself: how many dependencies have you vetted the maintainer before including? If n > 0 then you're just as susceptible.
    - mifreewil 8y ago
      I wouldn't just add some random maintainer with a new GitHub account to a project I controlled. If they had made some contributions via pull requests, I would consider it or if they were a maintainer of other projects with actual users. In this case, there was no vetting at all. A brand new GitHub account with a couple forks. I'm not placing all the blame on the original maintainer as I understand his philosophy of handing off the torch, but I think it's a naive thing to do, as this has shown. Ultimately, this has been a good demonstration of a weakness with the ecosystem and I think there are a lot of things that could be improved here to help mitigate this in the future.
- sytelus 8y ago
  How do you suggest finding trusted maintainer who would not turn malicious at later date?
  - nailer 8y ago
    I don’t. No guarantees of anything. But we can probably do better than random Chinese dude with no other projects or contribs

nailer 8y ago

People in this case aren't asking for support, they're asking for the project to have been given to a trusted maintainer or declared abandoned.

mehrdadn 8y ago
To be honest I wouldn't expect an abandoned project to be any different. I would expect it to have lost its maintainer, not switched from a trustworthy maintainer to a malicious one. Edit: Clarified second sentence.
- madrox 8y ago
  No maintainer is malicious...until they are. Be honest with yourself: how many dependencies have you vetted the maintainer before including? If n > 0 then you're just as susceptible.
  - mifreewil 8y ago
    I wouldn't just add some random maintainer with a new GitHub account to a project I controlled. If they had made some contributions via pull requests, I would consider it or if they were a maintainer of other projects with actual users. In this case, there was no vetting at all. A brand new GitHub account with a couple forks. I'm not placing all the blame on the original maintainer as I understand his philosophy of handing off the torch, but I think it's a naive thing to do, as this has shown. Ultimately, this has been a good demonstration of a weakness with the ecosystem and I think there are a lot of things that could be improved here to help mitigate this in the future.
sytelus 8y ago
How do you suggest finding trusted maintainer who would not turn malicious at later date?
- nailer 8y ago
  I don’t. No guarantees of anything. But we can probably do better than random Chinese dude with no other projects or contribs