3 ms·

To answer your question: if you want your project used by others, it's best not to rock the boat. Which leads me to ask why anyone would muck about with somethi

To answer your question: if you want your project used by others, it's best not to rock the boat. Which leads me to ask why anyone would muck about with something that could affect other projects' production code? My response to this little fiasco: why is anyone relying on externally-hosted, malleable code in a production environment? Run a repo, package it with your app ... whatever it takes to have a stable release.

crooked-v 8y ago
It sounds from the description like this "feature" was added in an earlier version, not something literally released on Christmas.
- c22 8y ago
  The point still stands. If open source code is vital to your business you should probably at the very least audit it.
  - mp3k 8y ago
    Good advice. Funny thing is, from May I'm working on a big project, where we use ant extensively. We pushed the limits of almost all the available components, found several issues, enhanced it in our custom wrappers. In that time, I was going through the sources of components several times, not only of the ant itself but also through sources of react-components on which the ant is built. YET I HAVEN'T EVER INSPECTED THE BUTTON COMPONENT. Would be super funny if I would have found that christmas egg this summer... Now as I'm thinking about it, we have EnhancedButton, which gets 'block' boolean prop to make it full-width. I was used to that from react-bootstrap and even had the idea to open feature request on antd... In that case I would certainly open the button.tsx... Anyway, great episode in the frontend world.
  - aaron695 8y ago
    Do you audit Linux if you use it? Why only audit open source? Part of the whole reason of open source is trust. At what point does an audit cost more than doing it yourself? Then do you need to audit the audit since you have no trust? Can't we not pass the buck in a just world situation and blame the user and instead encourage open source not to mess with the codebase.
mp3k 8y ago
The code was there for months, there was just time trigger for 25th of Dec. I'm loving ant, but this was stupid. At least it's free advertising so the project's user base can grow.

crooked-v 8y ago

It sounds from the description like this "feature" was added in an earlier version, not something literally released on Christmas.

c22 8y ago
The point still stands. If open source code is vital to your business you should probably at the very least audit it.
- mp3k 8y ago
  Good advice. Funny thing is, from May I'm working on a big project, where we use ant extensively. We pushed the limits of almost all the available components, found several issues, enhanced it in our custom wrappers. In that time, I was going through the sources of components several times, not only of the ant itself but also through sources of react-components on which the ant is built. YET I HAVEN'T EVER INSPECTED THE BUTTON COMPONENT. Would be super funny if I would have found that christmas egg this summer... Now as I'm thinking about it, we have EnhancedButton, which gets 'block' boolean prop to make it full-width. I was used to that from react-bootstrap and even had the idea to open feature request on antd... In that case I would certainly open the button.tsx... Anyway, great episode in the frontend world.
- aaron695 8y ago
  Do you audit Linux if you use it? Why only audit open source? Part of the whole reason of open source is trust. At what point does an audit cost more than doing it yourself? Then do you need to audit the audit since you have no trust? Can't we not pass the buck in a just world situation and blame the user and instead encourage open source not to mess with the codebase.

mp3k 8y ago

The code was there for months, there was just time trigger for 25th of Dec. I'm loving ant, but this was stupid. At least it's free advertising so the project's user base can grow.