7 ms·

Former developer at software company deletes his code to protest its ties to ICE

75 points by konceptz 7y ago

konceptz 7y ago
The technicals of the story are interesting around the software supply chain. I’m put off by the statement: “I want to be clear that this decision is not about contract value—it is about maintaining a consistent and fair business approach in these volatile times,” he wrote. “I do not believe that it is appropriate, practical, or within our mission to examine specific government projects with the purpose of selecting which U.S. agencies we should or should not do business.” I hear about practicality all the time at my office and sometimes it’s real and sometimes it’s laziness. This sounds like a little of both but also profit motivated (not saying that’s wrong for a for-profit company). Interested in your options on code of ethics and the above.
- SpicyLemonZest 7y ago
  It's definitely impractical to say you won't do business with anyone who does things you don't endorse. Imagine an electrician trying to demand a certification that the buildings he works on will host only ethical tenants. You just can't run a company that way; even people who do meet your ethical standards won't do business with you. If you think that ICE is so uniquely bad that they specifically need to be boycotted, that makes sense. Without inviting any debate on whether it's true, it's a consistent position that can be reasonably applied.
  - cco 7y ago
    There were a lot of electricians on the Death Star...
  - sneak 7y ago
    You absolutely can run a company that way. I do, as do many others. My company has grossed multiple millions of dollars operating that way.
    - SpicyLemonZest 7y ago
      I'm glad to hear that you can make it work. About how frequently do you cancel contracts because you've discovered your client is doing something unethical?
      - sneak 7y ago
        I recently declined a client who appears to be a white supremacist. I have declined work in the past due to the potential client organizations working with the military, police, or other violent organizations. We all have this responsibility to place nonviolence above profit.
        SpicyLemonZest 7y ago
        I think that's a very different thing than, as Chef is being asked to do here, terminating existing clients because they got some bad press on Twitter. Both in terms of your own operations (sudden cashflow interruptions are hard) and your clients' willingness to do business (can I justify the risk of waking up one Monday to learn that our CI provider is cutting me off and all development is dead in the water?)
    - kortilla 7y ago
      Congrats, you have very mainstream ethics. Imagine trying to run a business that uses no fossil fuels and does no business with anyone using fossil fuels.
- bradleyjg 7y ago
  It does seem odd and convenient to say I’ve got no problem making money from this part of the government but I won’t sell to that part of the government. It’s the same Congress and President making decisions for all the parts. Either it’s beyond the pale or it isn’t. I mean, would you do business with ISIS so long as the particular sub-project you were providing material for was innocuous?
  - moomin 7y ago
    I don’t think this tracks. I mean, the American Government is also part of the human race. Because we object to one part of the human race should we refuse to deal with any of it? Humans have to make moral choices about where they personally draw the line and where they draw the boundary. Around the organisation that falsely imprisons Americans and runs concentration camps seems like a starting point.
    - mcguire 7y ago
      Yes? (Having a misanthropic moment here.)
    - bradleyjg 7y ago
      No one is in charge of making decisions for the human race. The President and Congress make decisions for all of the federal government. If you thought the Windows division of Microsoft was acting extremely unethically would you still do business with the XBox division? It’s one CEO and one board that runs both.
      - extra88 7y ago
        Yes, because I know from experience with large organizations that there can be a lot of variance between different parts of an organization. Also, relatively little that happens is directly controlled or decided at the top.
      - kube-system 7y ago
        > The President and Congress make decisions for all of the federal government. That’s fundamentally not true. Appropriations and appointments are not the same as “making decisions”, but even if they were, the judiciary still exists.
- rjf72 7y ago
  It's a PR statement so I wouldn't read much into it. It's designed solely to yield the least negative response possible in a polarizing situation. But if we ignore the meaningfulness or truthfulness of the statement, let's take two hypothetical societies. In one society people agree to cooperate and trade with others when there's a mutual self interest, even if they happen to despise their partner otherwise. In the other society, people engage in a substantial degree of scrutiny and only trade and cooperate with others whom they are meaningfully aligned with. Which society do you think would have the better outcomes for whichever metrics you might imagine? I'd start with economic/technological progress, war vs peace, tribal vs unified (not to say homogeneous) society, etc. I think there is a clear answer to my hypothetical, but perhaps people see things differently. I'd be quite curious to know how.
schmookeeg 7y ago
I expect that, to be ethically consistent, this developer will also return all salary or payments he received while creating this now-deleted code. I think leaving a job is a better protest than doing damage to your employer. And perhaps for his next contract, he might insert a clause limiting what his code can be used for. In limiting the utility of the code he sells, I expect he'd be taking a lesser pay rate for it.
- konceptz 7y ago
  If you read the article, the developer already was not working for Chef. Chef was/is relying on OSS components which the former develop pulled from the open repository. -edit for clarity.
  - schmookeeg 7y ago
    Thanks, I overlooked that somehow. (pre-morning tea over here :) ) I haven't read many OSS licenses. Can't someone just publish an 'unethical' fork and life goes on?
    - konceptz 7y ago
      Interesting approach. Makes me wonder if you authored a component and extended a license to say that “use of this code must abide by [inert relevant code of ethics]”, could you enforce that?
      - garmaine 7y ago
        Such licenses exist, and yes. But it wouldn’t apply retroactively.
        temac 7y ago
        Also such licenses are not Free Software. And from a practical point of view (existing in the ecosystem) that matters a lot.
      - 7y ago
mcguire 7y ago
"Another user pointed out that Chef isn’t the only company to profit from working with ICE. Microsoft has raked in $4.6 million, IBM has received $1.6 million, and CISCO has received about $500,000 through their work with ICE." Those numbers seem very low. Is this just for one year or one contract?
- thrower123 7y ago
  The 4.6 million for Microsoft is just for Office 365 subscriptions, if I recall correctly.
- remarkEon 7y ago
  Does each government agency have to individually enter into a contract with Microsoft et al.? That sounds wildly inefficient and silly. My guess is that this "user" pulled those numbers out of thin air.
  - kube-system 7y ago
    The purpose of a contract isn’t to be efficient with paperwork or describe a high-level view of transactions. It’s a document that very granularly describes those transactions. Any large organization has many people with the authority to spend money, and each one of those transactions will be supported by a contract.
  - mcguire 7y ago
    Yes. Mostly. The contracts are generally for specific products or services, for a specific time. High-level agencies have a great deal of autonomy and also get to pull their needs out of their own budgets. Lower-level elements within an agency (a NASA center, for example) can also have more or less autonomy.
    - remarkEon 7y ago
      Yeah I shouldn't been more clear in my question. I was more referring to high-level services (e.g. Office). For specific use-cases, it makes sense for lower level agencies to have at least a little autonomy.
doggydogs94 7y ago
You would be a fool to hire this guy after this stunt.
- dehrmann 7y ago
  It's also pretty short-sighted because ICE does some uncontroversial things (border crossings, customs), and a lot of the flak they've been getting is from actions pushed down to the from the administration. Now, they're also not known for being defenders for human--or even constitutional--rights. It seems more effective to donate $2,800 to pick-a-democrat. Or Mark Sanford.
  - bobthepanda 7y ago
    While border crossings and customs are themselves not controversial for merely existing, how they are administered is definitely a source of controversy.
- WrtCdEvrydy 7y ago
  What stunt? He removed an open source library from his own personal account because he felt the nazis shouldn't be using his software. It's kinda like when IBM sold the nazis hardware to keep track of the Jews.
  - onepointsixC 7y ago
    If you honestly believe that ICE are Nazi's what are you doing posting here? The second amendment is a thing. Why are you not fighting Nazi's?
    - WrtCdEvrydy 7y ago
      Violent protests are not the way to fix things... pulling support from them is...
      - onepointsixC 7y ago
codegeek 7y ago
"Earlier today, a former Chef employee removed several Ruby Gems, impacting production systems for a number of our customers." So the developer already had left the company but one of his own Open Source code hosted on his personal github was used in production by Chef Customers ? Really ? That is just Wow. I don't have any strong opinions on whether he did the right thing but this absolutely surprises me. Running a small company, I am very strict against any of us using any personal accounts for anything that impacts our company work especially production. This has to be a no no by default I would assume.
- WrtCdEvrydy 7y ago
  Remember leftpad?
  - CaptainJustin 7y ago
    For those interested see: How one developer just broke Node, Babel and thousands of projects in 11 lines of JavaScript https://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos/ https://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos/
  - codegeek 7y ago
    Yes and even though they are similar but I would still argue that npm hellhole is quite different than a direct github library being used by a company in production.
sethvargo 7y ago
Hi there. I’m around to answer any questions!
- pertsix 7y ago
  If I was you, I would not answer any questions, and I would consult a lawyer. edit: Looks like they were public gems, but in general it's always good advice to consult a lawyer before disrupting commercial or public systems.
  - pjc50 7y ago
    He's not under arrest, Miranda.
    - deleted 7y ago
      [deleted]
  - AdmiralAsshat 7y ago
    That would be an insane precedent to send if breaking or removing a FOSS project becomes a crime simply because your project happens to be used in some mission-critical system. Good way of making sure no one ever contributes to FOSS again.
    - bobthepanda 7y ago
      While it’s not a crime, at the very least they might be liable for damages. To establish criminality or liability intent is often looked at, and this is a pretty clear-cut intent to injure the other party.
- corndoge 7y ago
  Do you think this action had any net impact on ICE operations?
  - adamnemecek 7y ago
saagarjha 7y ago
Not completely related, but the tone of the two tweets linked in the article doesn’t make sense to me. The first is a reasonable request for a comment about an issue that Shanley cares about, but it’s immediately followed by a comment a minute later screaming at Chef to take a certain action while hurling epithets at them in all-caps. How can you possibly assume good faith from the first comment after reading the second? Why didn’t she just go straight to attacking them if that was clearly her intention?
- thrower123 7y ago
  Expecting good faith from shanley given her track record is like yet another frog offering a ride across the river to the scorpion, despite the frog corpses nearly damming the flow downstream. This is just not a person who deserves to be taken seriously.
- dogma1138 7y ago
  She has a book to sell :)
RickJWagner 7y ago
The developer's tweet from 2 hours ago: "Tech collaboration with ICE is over. ANTIFA IN TECH: YOU ARE ACTIVATED NOW. GET READY TO GO FOR THE LONG HAUL. STAY RESTED, STAY SAFE, AND GET READY TO TAKE IT ALL DOWN." Yeah, he won't be trusted again.
ykevinator 7y ago
Hero. Too many vanity talkers today, not enough doers.
handlegoeshere 7y ago
Seth, as a person that has learned a lot from you over the years and benefited from your work while at Chef, Hashicorp, and Google Cloud, this act has only increased my respect for you. Thank you for taking a stand against oppression and injustice.

75 points by konceptz 7y ago

The technicals of the story are interesting around the software supply chain. I’m put off by the statement: “I want to be clear that this decision is not about contract value—it is about maintaining a consistent and fair business approach in these volatile times,” he wrote. “I do not believe that it is appropriate, practical, or within our mission to examine specific government projects with the purpose of selecting which U.S. agencies we should or should not do business.” I hear about practicality all the time at my office and sometimes it’s real and sometimes it’s laziness. This sounds like a little of both but also profit motivated (not saying that’s wrong for a for-profit company). Interested in your options on code of ethics and the above.

SpicyLemonZest 7y ago
It's definitely impractical to say you won't do business with anyone who does things you don't endorse. Imagine an electrician trying to demand a certification that the buildings he works on will host only ethical tenants. You just can't run a company that way; even people who do meet your ethical standards won't do business with you. If you think that ICE is so uniquely bad that they specifically need to be boycotted, that makes sense. Without inviting any debate on whether it's true, it's a consistent position that can be reasonably applied.
- cco 7y ago
  There were a lot of electricians on the Death Star...
- sneak 7y ago
  You absolutely can run a company that way. I do, as do many others. My company has grossed multiple millions of dollars operating that way.
  - SpicyLemonZest 7y ago
    I'm glad to hear that you can make it work. About how frequently do you cancel contracts because you've discovered your client is doing something unethical?
    - sneak 7y ago
      I recently declined a client who appears to be a white supremacist. I have declined work in the past due to the potential client organizations working with the military, police, or other violent organizations. We all have this responsibility to place nonviolence above profit.
      - SpicyLemonZest 7y ago
        I think that's a very different thing than, as Chef is being asked to do here, terminating existing clients because they got some bad press on Twitter. Both in terms of your own operations (sudden cashflow interruptions are hard) and your clients' willingness to do business (can I justify the risk of waking up one Monday to learn that our CI provider is cutting me off and all development is dead in the water?)
  - kortilla 7y ago
    Congrats, you have very mainstream ethics. Imagine trying to run a business that uses no fossil fuels and does no business with anyone using fossil fuels.
bradleyjg 7y ago
It does seem odd and convenient to say I’ve got no problem making money from this part of the government but I won’t sell to that part of the government. It’s the same Congress and President making decisions for all the parts. Either it’s beyond the pale or it isn’t. I mean, would you do business with ISIS so long as the particular sub-project you were providing material for was innocuous?
- moomin 7y ago
  I don’t think this tracks. I mean, the American Government is also part of the human race. Because we object to one part of the human race should we refuse to deal with any of it? Humans have to make moral choices about where they personally draw the line and where they draw the boundary. Around the organisation that falsely imprisons Americans and runs concentration camps seems like a starting point.
  - mcguire 7y ago
    Yes? (Having a misanthropic moment here.)
  - bradleyjg 7y ago
    No one is in charge of making decisions for the human race. The President and Congress make decisions for all of the federal government. If you thought the Windows division of Microsoft was acting extremely unethically would you still do business with the XBox division? It’s one CEO and one board that runs both.
    - extra88 7y ago
      Yes, because I know from experience with large organizations that there can be a lot of variance between different parts of an organization. Also, relatively little that happens is directly controlled or decided at the top.
    - kube-system 7y ago
      > The President and Congress make decisions for all of the federal government. That’s fundamentally not true. Appropriations and appointments are not the same as “making decisions”, but even if they were, the judiciary still exists.
rjf72 7y ago
It's a PR statement so I wouldn't read much into it. It's designed solely to yield the least negative response possible in a polarizing situation. But if we ignore the meaningfulness or truthfulness of the statement, let's take two hypothetical societies. In one society people agree to cooperate and trade with others when there's a mutual self interest, even if they happen to despise their partner otherwise. In the other society, people engage in a substantial degree of scrutiny and only trade and cooperate with others whom they are meaningfully aligned with. Which society do you think would have the better outcomes for whichever metrics you might imagine? I'd start with economic/technological progress, war vs peace, tribal vs unified (not to say homogeneous) society, etc. I think there is a clear answer to my hypothetical, but perhaps people see things differently. I'd be quite curious to know how.

schmookeeg 7y ago

I expect that, to be ethically consistent, this developer will also return all salary or payments he received while creating this now-deleted code. I think leaving a job is a better protest than doing damage to your employer. And perhaps for his next contract, he might insert a clause limiting what his code can be used for. In limiting the utility of the code he sells, I expect he'd be taking a lesser pay rate for it.

konceptz 7y ago
If you read the article, the developer already was not working for Chef. Chef was/is relying on OSS components which the former develop pulled from the open repository. -edit for clarity.
- schmookeeg 7y ago
  Thanks, I overlooked that somehow. (pre-morning tea over here :) ) I haven't read many OSS licenses. Can't someone just publish an 'unethical' fork and life goes on?
  - konceptz 7y ago
    Interesting approach. Makes me wonder if you authored a component and extended a license to say that “use of this code must abide by [inert relevant code of ethics]”, could you enforce that?
    - garmaine 7y ago
      Such licenses exist, and yes. But it wouldn’t apply retroactively.
      - temac 7y ago
        Also such licenses are not Free Software. And from a practical point of view (existing in the ecosystem) that matters a lot.
    - 7y ago

mcguire 7y ago

"Another user pointed out that Chef isn’t the only company to profit from working with ICE. Microsoft has raked in $4.6 million, IBM has received $1.6 million, and CISCO has received about $500,000 through their work with ICE." Those numbers seem very low. Is this just for one year or one contract?

thrower123 7y ago
The 4.6 million for Microsoft is just for Office 365 subscriptions, if I recall correctly.
remarkEon 7y ago
Does each government agency have to individually enter into a contract with Microsoft et al.? That sounds wildly inefficient and silly. My guess is that this "user" pulled those numbers out of thin air.
- kube-system 7y ago
  The purpose of a contract isn’t to be efficient with paperwork or describe a high-level view of transactions. It’s a document that very granularly describes those transactions. Any large organization has many people with the authority to spend money, and each one of those transactions will be supported by a contract.
- mcguire 7y ago
  Yes. Mostly. The contracts are generally for specific products or services, for a specific time. High-level agencies have a great deal of autonomy and also get to pull their needs out of their own budgets. Lower-level elements within an agency (a NASA center, for example) can also have more or less autonomy.
  - remarkEon 7y ago
    Yeah I shouldn't been more clear in my question. I was more referring to high-level services (e.g. Office). For specific use-cases, it makes sense for lower level agencies to have at least a little autonomy.

doggydogs94 7y ago

You would be a fool to hire this guy after this stunt.

dehrmann 7y ago
It's also pretty short-sighted because ICE does some uncontroversial things (border crossings, customs), and a lot of the flak they've been getting is from actions pushed down to the from the administration. Now, they're also not known for being defenders for human--or even constitutional--rights. It seems more effective to donate $2,800 to pick-a-democrat. Or Mark Sanford.
- bobthepanda 7y ago
  While border crossings and customs are themselves not controversial for merely existing, how they are administered is definitely a source of controversy.
WrtCdEvrydy 7y ago
What stunt? He removed an open source library from his own personal account because he felt the nazis shouldn't be using his software. It's kinda like when IBM sold the nazis hardware to keep track of the Jews.
- onepointsixC 7y ago
  If you honestly believe that ICE are Nazi's what are you doing posting here? The second amendment is a thing. Why are you not fighting Nazi's?
  - WrtCdEvrydy 7y ago
    Violent protests are not the way to fix things... pulling support from them is...
    - onepointsixC 7y ago

codegeek 7y ago

"Earlier today, a former Chef employee removed several Ruby Gems, impacting production systems for a number of our customers." So the developer already had left the company but one of his own Open Source code hosted on his personal github was used in production by Chef Customers ? Really ? That is just Wow. I don't have any strong opinions on whether he did the right thing but this absolutely surprises me. Running a small company, I am very strict against any of us using any personal accounts for anything that impacts our company work especially production. This has to be a no no by default I would assume.

WrtCdEvrydy 7y ago
Remember leftpad?
- CaptainJustin 7y ago
  For those interested see: How one developer just broke Node, Babel and thousands of projects in 11 lines of JavaScript https://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos/ https://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos/
- codegeek 7y ago
  Yes and even though they are similar but I would still argue that npm hellhole is quite different than a direct github library being used by a company in production.

sethvargo 7y ago

Hi there. I’m around to answer any questions!

pertsix 7y ago
If I was you, I would not answer any questions, and I would consult a lawyer. edit: Looks like they were public gems, but in general it's always good advice to consult a lawyer before disrupting commercial or public systems.
- pjc50 7y ago
  He's not under arrest, Miranda.
  - deleted 7y ago
    [deleted]
- AdmiralAsshat 7y ago
  That would be an insane precedent to send if breaking or removing a FOSS project becomes a crime simply because your project happens to be used in some mission-critical system. Good way of making sure no one ever contributes to FOSS again.
  - bobthepanda 7y ago
    While it’s not a crime, at the very least they might be liable for damages. To establish criminality or liability intent is often looked at, and this is a pretty clear-cut intent to injure the other party.
corndoge 7y ago
Do you think this action had any net impact on ICE operations?
- adamnemecek 7y ago

saagarjha 7y ago

Not completely related, but the tone of the two tweets linked in the article doesn’t make sense to me. The first is a reasonable request for a comment about an issue that Shanley cares about, but it’s immediately followed by a comment a minute later screaming at Chef to take a certain action while hurling epithets at them in all-caps. How can you possibly assume good faith from the first comment after reading the second? Why didn’t she just go straight to attacking them if that was clearly her intention?

thrower123 7y ago
Expecting good faith from shanley given her track record is like yet another frog offering a ride across the river to the scorpion, despite the frog corpses nearly damming the flow downstream. This is just not a person who deserves to be taken seriously.
dogma1138 7y ago
She has a book to sell :)

RickJWagner 7y ago

The developer's tweet from 2 hours ago: "Tech collaboration with ICE is over. ANTIFA IN TECH: YOU ARE ACTIVATED NOW. GET READY TO GO FOR THE LONG HAUL. STAY RESTED, STAY SAFE, AND GET READY TO TAKE IT ALL DOWN." Yeah, he won't be trusted again.

ykevinator 7y ago

Hero. Too many vanity talkers today, not enough doers.

handlegoeshere 7y ago

Seth, as a person that has learned a lot from you over the years and benefited from your work while at Chef, Hashicorp, and Google Cloud, this act has only increased my respect for you. Thank you for taking a stand against oppression and injustice.