4 ms·

This, I think, is a sucker's argument. Responsibility is not putting trust in a dependency they themselves have no control over. Responsibility is not letting y

by madrox 8y ago

This, I think, is a sucker's argument. Responsibility is not putting trust in a dependency they themselves have no control over. Responsibility is not letting yourself get into an obviously bad situation. It's not even the first time this has happened to NPM. Remember left pad? No, this thread didn't happen because a bunch of developed chose to make this a conversation about responsibility more than fault. They're mad they got suckered and Dominic is the best scapegoat.

mehrdadn 8y ago
> This, I think, is a sucker's argument. Responsibility is not putting trust in a dependency they themselves have no control over. Responsibility can fall on multiple people. I don't understand why everyone looks at things in such a binary way. Responsibility, fault, etc. are not binary things. Two or more people responsible for one problem can be both upset at each other perfectly justifiably.
- randallsquared 8y ago
  Responsibility is a hard problem. It's quite true that more than one person can be responsible for something, in part, but there's only so much responsibility to go around: whatever damage irresponsibility causes, more than one person cannot be responsible for the full damage, if we're going to maintain any consistency.
  - marcus_holmes 8y ago
    Authority and Responsibility go hand-in-hand. If you have authority over something/someone, then you are responsible for it/them. You cannot be responsible for something you have no authority over, and you should not have authority for something you have no responsibility for. In this case, every developer has authority over their own code base. If I decide to include some random code from the internet in my project then I am responsible for that decision. If whoever has commit privileges on that random code decides to commit malicious code, then they have responsibility for that. However, that doesn't make them responsible for my project, because they have no authority over my project. Including a dependency in a project is a security vulnerability. It may be worth the risk, it may not, but it is definitely a risk. And responsibility for taking that risk is entirely on the person who took the decision to include that dependency.
  - mehrdadn 8y ago
    > whatever damage irresponsibility causes, more than one person cannot be responsible for the full damage, if we're going to maintain any consistency. This may be a moot point if you consider that "full damage" can be more than what one person can be expected to take responsibility for and handle.

by madrox 8y ago

mehrdadn 8y ago

> This, I think, is a sucker's argument. Responsibility is not putting trust in a dependency they themselves have no control over. Responsibility can fall on multiple people. I don't understand why everyone looks at things in such a binary way. Responsibility, fault, etc. are not binary things. Two or more people responsible for one problem can be both upset at each other perfectly justifiably.

randallsquared 8y ago
Responsibility is a hard problem. It's quite true that more than one person can be responsible for something, in part, but there's only so much responsibility to go around: whatever damage irresponsibility causes, more than one person cannot be responsible for the full damage, if we're going to maintain any consistency.
- marcus_holmes 8y ago
  Authority and Responsibility go hand-in-hand. If you have authority over something/someone, then you are responsible for it/them. You cannot be responsible for something you have no authority over, and you should not have authority for something you have no responsibility for. In this case, every developer has authority over their own code base. If I decide to include some random code from the internet in my project then I am responsible for that decision. If whoever has commit privileges on that random code decides to commit malicious code, then they have responsibility for that. However, that doesn't make them responsible for my project, because they have no authority over my project. Including a dependency in a project is a security vulnerability. It may be worth the risk, it may not, but it is definitely a risk. And responsibility for taking that risk is entirely on the person who took the decision to include that dependency.
- mehrdadn 8y ago
  > whatever damage irresponsibility causes, more than one person cannot be responsible for the full damage, if we're going to maintain any consistency. This may be a moot point if you consider that "full damage" can be more than what one person can be expected to take responsibility for and handle.