5 ms·

People are dealing with a lot of negativity in their life, they shouldn't have to deal with that entitled bull-crap online, especially when doing unpaid work. S

by aikah 8y ago

People are dealing with a lot of negativity in their life, they shouldn't have to deal with that entitled bull-crap online, especially when doing unpaid work. Should the maintainer have been more cautious? no, he should have straight out closed the project and just ask people to fork it or use something else. If you are not going to maintain something anymore, don't even bother worrying about passing the torch. That way nothing is your responsibility anymore. The people who complain, insult the maintainer in Github issues right now will be at the root of a shift of mindset from contributors that will end the "golden age of open source".

kylecordes 8y ago
I think this is the clearest, easiest, correct answer. If you no longer have the time and motivation to maintain a project, and are also not in a position to hand over control to someone you have good reason to trust, the easy, safe answer is to retire it, and have others fork. Then in the original project you can say “the last version of this project is N.N; here are some possible candidate successor forks, which have not been vetted”. This way no one who is merely keeping up with version numbers will accidentally step off of a reasonably good package on to a fraudulent package.
- Novashi 8y ago
  >I think this is the clearest, easiest, correct answer. If you no longer have the time and motivation to maintain a project, and are also not in a position to hand over control to someone you have good reason to trust, the easy, safe answer is to retire it, and have others fork. To prescribe some preventative advice based on this: it's probably not a good idea if your project gets popular to continue being a solo developer in open source. So plan ahead based on your popularity. And your project isn't likely to explode in popularity over-night and be a dependency for 1000+ other projects, so you should be able to see this coming. Of course, this is super-easy to prescribe in hindsight.
- wpietri 8y ago
  I 100% guarantee you that if he did that, he'd be getting a lot of static about how he should have handed the package over to some contributor.
  - danso 8y ago
    Which other similar situations are you thinking of?
    - Rotten194 8y ago
      left-pad
      - mifreewil 8y ago
        left-pad was a very different situation. The maintainer unpublished the module from npm. I forget the reason, but I want to say it was some sort of rage quit.
        beaconstudios 8y ago
        he had a package called kik, which npm dropped for the benefit of kik the company (though I don't know whether they requested they do so). In response the author unpublished everything from npm.
  - jonreem 8y ago
    “You can please some of the people all of the time, you can please all of the people some of the time, but you can’t please all of the people all of the time”
  - QuantumGood 8y ago
    This is mitigated if enough notice can be given in advance.
BeeOnRope 8y ago
I agree that's what he should have done. Isn't that being more cautious?
danso 8y ago
I'm being naive probably, but I have a hard time believing that this controversy would be so big had it been a case of an abandoned library. Users do whine a bit in the Github Issues for dead projects, but at least they can tell the project's dead and/or broken. In this case, the maintainer, who is a security professional, made the active decision to give ownership to an untrusted party. He shouldn't be held liable in any legal/financial sense, but why wouldn't users be alarmed/unhappy?
- deleted 8y ago
  [deleted]
_pmf_ 8y ago
> People are dealing with a lot of negativity in their life, they shouldn't have to deal with that entitled bull-crap online, especially when doing unpaid work. They are practicing resume driven development. While this is unpaid, it's not completely altruistic.

by aikah 8y ago

kylecordes 8y ago

I think this is the clearest, easiest, correct answer. If you no longer have the time and motivation to maintain a project, and are also not in a position to hand over control to someone you have good reason to trust, the easy, safe answer is to retire it, and have others fork. Then in the original project you can say “the last version of this project is N.N; here are some possible candidate successor forks, which have not been vetted”. This way no one who is merely keeping up with version numbers will accidentally step off of a reasonably good package on to a fraudulent package.

Novashi 8y ago
>I think this is the clearest, easiest, correct answer. If you no longer have the time and motivation to maintain a project, and are also not in a position to hand over control to someone you have good reason to trust, the easy, safe answer is to retire it, and have others fork. To prescribe some preventative advice based on this: it's probably not a good idea if your project gets popular to continue being a solo developer in open source. So plan ahead based on your popularity. And your project isn't likely to explode in popularity over-night and be a dependency for 1000+ other projects, so you should be able to see this coming. Of course, this is super-easy to prescribe in hindsight.
wpietri 8y ago
I 100% guarantee you that if he did that, he'd be getting a lot of static about how he should have handed the package over to some contributor.
- danso 8y ago
  Which other similar situations are you thinking of?
  - Rotten194 8y ago
    left-pad
    - mifreewil 8y ago
      left-pad was a very different situation. The maintainer unpublished the module from npm. I forget the reason, but I want to say it was some sort of rage quit.
      - beaconstudios 8y ago
        he had a package called kik, which npm dropped for the benefit of kik the company (though I don't know whether they requested they do so). In response the author unpublished everything from npm.
- jonreem 8y ago
  “You can please some of the people all of the time, you can please all of the people some of the time, but you can’t please all of the people all of the time”
- QuantumGood 8y ago
  This is mitigated if enough notice can be given in advance.

BeeOnRope 8y ago

I agree that's what he should have done. Isn't that being more cautious?

danso 8y ago

I'm being naive probably, but I have a hard time believing that this controversy would be so big had it been a case of an abandoned library. Users do whine a bit in the Github Issues for dead projects, but at least they can tell the project's dead and/or broken. In this case, the maintainer, who is a security professional, made the active decision to give ownership to an untrusted party. He shouldn't be held liable in any legal/financial sense, but why wouldn't users be alarmed/unhappy?

deleted 8y ago
[deleted]

_pmf_ 8y ago

> People are dealing with a lot of negativity in their life, they shouldn't have to deal with that entitled bull-crap online, especially when doing unpaid work. They are practicing resume driven development. While this is unpaid, it's not completely altruistic.