6 ms·

Please stop harassing me. Let's set the record straight. The Koa organization did not write, maintain, or ever help with this package. I wrote it. I maintained

Please stop harassing me. Let's set the record straight. The Koa organization did not write, maintain, or ever help with this package. I wrote it. I maintained it, with help from people who reached out to me directly (and actually contributed code). @ZijianHe offered to maintain it, and I agreed to let him maintain it. Our relationship is not anyone's business. I don't have a relationship to the koa organization. I don't know them. Furthermore, @niftylettuce has repeatedly in emails to npm asserted that ZijianHe is Chinese, despite this having nothing to do with anything, or even knowing whether ZijianHe lives in China. Chinese developers have contributed more to this repository than anyone from the Koa organization. This kind of racial scaremongering or guilt by association is not acceptable. Its offensive. Let's be very clear: Developers from any ethnicity and nationality are welcome to contribute to open source. I'm not going to say anything more on this issue. This is beyond ridiculous.

niftylettuce 8y ago
To clarify things for the community: 1) No, they (Chinese developers) have not contributed more. You revoked access from @jbielick who was #2 contributor to the package behind you. He messaged me in Slack today that he received zero notification from you and simply received a notification from NPM that he was removed access from the package. You removed his access completely from NPM. 2) My email to you prefaced the concern of the China-based user with "completely unknown" and "To an outsider". Here's the original email to clarify it for people viewing this from an incorrect context: Hi Alex, Thanks for your work in the open source community. I am curious, since the project is open source, if you will be transparent as to the transfer of the koa-router repository and NPM ownership to a completely unknown user "ZijianHe" to the community. Was there a monetary transaction? Why did you choose him? Why not transfer to the KOA org? To an outsider, this is all a huge red flag, as an unknown Chinese GitHub user suddenly has full control of a NPM package with 130K weekly downloads and is used by major corporations. 3) I did not "repeatedly" assert that. I stated the word "Chinese" one time. One time is not "repeatedly". I would share with the community your response to my message, but I am not going to do so.
- pryce 8y ago
  I notice that Alex's claim about you "repeatedly" making accusation(s) regarding "Chinese" users seems to refer to your emails to NPM, not your email to Alex himself that you have provided above. I hope my attempt to clarify this aspect doesn't take the focus off the other parts of your responses, because the issues you raise are concerning to me and I share your belief that the community deserves info about all this.
  - deleted 8y ago
    [deleted]
shaunw321 8y ago
Hey amingoia, thanks for responding. I think the worry here is bigger than this single situation and is really about package maintenance and ownership for the community at large. This is a very popular package. Selling it to anyone just to move on is a burden on open source. I will say it is completely your choice here, but as a consumer of the package and the other 130K+ a week I would urge you and others to be a bit more careful when transferring ownership.
_bxg1 8y ago
Setting aside everything racial, do you know @ZijianHe personally, or was he simply the highest bidder? That's what this all comes down to. Thousands of people (apparently) put trust in you not to backdoor their codebases, and if you simply sold that vector to a random person, that's at best a hugely irresponsible decision.
- pryce 8y ago
  It may even be completely innocent and valid for a developer to do this, but : 1. there seems to be -intentionally- very little transparency about it, 2. the second most prominent contributor - who was also the most prominent contributor for the last two years - was, we are told, locked out without notice 3. the original developer has repeatedly declined to acknowledge that the community has (or could have) any concerns worth even discussing. 4. the Github history indicates a strong possibility the package was bought. If someone wants to sell their package, perhaps they have every right to, but the author's repeated dismissal that anyone might be legitimately concerned or legitimately want to know more about this process is bizarre and alarming.
gnahckire 8y ago
> Let's set the record straight... @ZijianHe offered to maintain it, and I agreed to let him maintain it. Our relationship is not anyone's business. Why not be transparent about selling the package? Or attempting to do so? > Chinese developers have contributed more to this repository than anyone from the Koa organization. This kind of racial scaremongering or guilt by association is not acceptable. Its offensive. Nice rhetoric here. But you know the Country of origin of most cyber attacks is China right? Source: https://www.csis.org/programs/cybersecurity-and-governance/technology-policy-program/other-projects-cybersecurity https://www.csis.org/programs/cybersecurity-and-governance/t... > I'm not going to say anything more on this issue. This is beyond ridiculous. Suit yourself. But it really isn't. Sorry for all the harassment you're getting but, it's not exactly unwarranted...
- deleted 8y ago
  [deleted]
- chrischen 8y ago
  If you pulled up crime statics on black people vs white people, you'd have similar damning statistics. Rather than prejudicing this "unknown Chinese" guy why not treat him as a person first and find out who he is, and what he has to say?
  - deleted 8y ago
    [deleted]
  - gnahckire 8y ago
    Fair point. Although one shouldn't discount statistics altogether. Security experts lean on skepticism to help minimize exposure and discover new things. Race and nationality aside, the transfer of ownership to an entity that has zero open source contributions in the js space does look very suspicious. I'm just surprised that an open source author didn't provide that disclosure to users of his work.
    - chrischen 8y ago
      In almost all cases, including this one, you will have better signals than to bucket a whole race or culture under a generalized stereotype. For example i can see at least another Chinese contributor who is against this who works at Alibaba that commented. The principle issue here is that the repo was put up for sale, and anyone paying for the opportunity to maintain a free library should be scrutinized. This would be true regardless of if they were Chinese, black, or a white guy from San Francisco.
deleted 8y ago
[deleted]

niftylettuce 8y ago

To clarify things for the community: 1) No, they (Chinese developers) have not contributed more. You revoked access from @jbielick who was #2 contributor to the package behind you. He messaged me in Slack today that he received zero notification from you and simply received a notification from NPM that he was removed access from the package. You removed his access completely from NPM. 2) My email to you prefaced the concern of the China-based user with "completely unknown" and "To an outsider". Here's the original email to clarify it for people viewing this from an incorrect context: Hi Alex, Thanks for your work in the open source community. I am curious, since the project is open source, if you will be transparent as to the transfer of the koa-router repository and NPM ownership to a completely unknown user "ZijianHe" to the community. Was there a monetary transaction? Why did you choose him? Why not transfer to the KOA org? To an outsider, this is all a huge red flag, as an unknown Chinese GitHub user suddenly has full control of a NPM package with 130K weekly downloads and is used by major corporations. 3) I did not "repeatedly" assert that. I stated the word "Chinese" one time. One time is not "repeatedly". I would share with the community your response to my message, but I am not going to do so.

pryce 8y ago
I notice that Alex's claim about you "repeatedly" making accusation(s) regarding "Chinese" users seems to refer to your emails to NPM, not your email to Alex himself that you have provided above. I hope my attempt to clarify this aspect doesn't take the focus off the other parts of your responses, because the issues you raise are concerning to me and I share your belief that the community deserves info about all this.
- deleted 8y ago
  [deleted]

shaunw321 8y ago

Hey amingoia, thanks for responding. I think the worry here is bigger than this single situation and is really about package maintenance and ownership for the community at large. This is a very popular package. Selling it to anyone just to move on is a burden on open source. I will say it is completely your choice here, but as a consumer of the package and the other 130K+ a week I would urge you and others to be a bit more careful when transferring ownership.

_bxg1 8y ago

Setting aside everything racial, do you know @ZijianHe personally, or was he simply the highest bidder? That's what this all comes down to. Thousands of people (apparently) put trust in you not to backdoor their codebases, and if you simply sold that vector to a random person, that's at best a hugely irresponsible decision.

pryce 8y ago
It may even be completely innocent and valid for a developer to do this, but : 1. there seems to be -intentionally- very little transparency about it, 2. the second most prominent contributor - who was also the most prominent contributor for the last two years - was, we are told, locked out without notice 3. the original developer has repeatedly declined to acknowledge that the community has (or could have) any concerns worth even discussing. 4. the Github history indicates a strong possibility the package was bought. If someone wants to sell their package, perhaps they have every right to, but the author's repeated dismissal that anyone might be legitimately concerned or legitimately want to know more about this process is bizarre and alarming.

gnahckire 8y ago

> Let's set the record straight... @ZijianHe offered to maintain it, and I agreed to let him maintain it. Our relationship is not anyone's business. Why not be transparent about selling the package? Or attempting to do so? > Chinese developers have contributed more to this repository than anyone from the Koa organization. This kind of racial scaremongering or guilt by association is not acceptable. Its offensive. Nice rhetoric here. But you know the Country of origin of most cyber attacks is China right? Source: https://www.csis.org/programs/cybersecurity-and-governance/technology-policy-program/other-projects-cybersecurity https://www.csis.org/programs/cybersecurity-and-governance/t... > I'm not going to say anything more on this issue. This is beyond ridiculous. Suit yourself. But it really isn't. Sorry for all the harassment you're getting but, it's not exactly unwarranted...

deleted 8y ago
[deleted]
chrischen 8y ago
If you pulled up crime statics on black people vs white people, you'd have similar damning statistics. Rather than prejudicing this "unknown Chinese" guy why not treat him as a person first and find out who he is, and what he has to say?
- deleted 8y ago
  [deleted]
- gnahckire 8y ago
  Fair point. Although one shouldn't discount statistics altogether. Security experts lean on skepticism to help minimize exposure and discover new things. Race and nationality aside, the transfer of ownership to an entity that has zero open source contributions in the js space does look very suspicious. I'm just surprised that an open source author didn't provide that disclosure to users of his work.
  - chrischen 8y ago
    In almost all cases, including this one, you will have better signals than to bucket a whole race or culture under a generalized stereotype. For example i can see at least another Chinese contributor who is against this who works at Alibaba that commented. The principle issue here is that the repo was put up for sale, and anyone paying for the opportunity to maintain a free library should be scrutinized. This would be true regardless of if they were Chinese, black, or a white guy from San Francisco.

deleted 8y ago

[deleted]