3 ms·

> they found me on other software forums, posted threats to me and explained how the library that I had added, and someone else had removed, was crucial to thei

> they found me on other software forums, posted threats to me and explained how the library that I had added, and someone else had removed, was crucial to their business and they'd lost such-and-such dollars in revenue with that library 404-ing without notice and that they were coming to find me and extract the money from me by force Wow, that really takes "open source maintainer abuse" to a whole other level.

wongarsu 7y ago
If cdnjs was an enterprise offering it would be reasonable to expect either a notification of removal and a generous transition period, or just cdnjs disinfecting the package behind the scenes (and then boasting about it). But expecting the same from a free service is unreasonable. Stalking people and asking for damages because they didn't meet an unreasonable expectation is beyond unreasonable.
- diggan 7y ago
  > it would be reasonable to expect either a notification of removal and a generous transition period For security issues like XSS in live and deployed libraries? I mean, I don't agree that the library should ever be removed, but if you are of the opinion that vulnerable libraries should be pulled, they should be pulled quickly no?
  - wongarsu 7y ago
    What's worse: uninterrupted service with a time window where you are vulnerable to a known XSS attack, or your service suddenly going offline, customers calling your support but all you can tell them is that you will be back in a few days, but at least they are not vulnerable to XSS in the meantime? Of course for a small startup a few days notice before removal is enough, but for a large company a few days may be barely better than no heads up at all. Not everyone can move with the same agility. If you don't pull it at all you risk people staying on the library forever because they don't want to touch a working system.
- jlokier 7y ago
  Note that in this case, the person being stalked & threatened isn't even the same person as who removed the library. Essentially, they were physically threatened over an open source change done by someone else.

wongarsu 7y ago

If cdnjs was an enterprise offering it would be reasonable to expect either a notification of removal and a generous transition period, or just cdnjs disinfecting the package behind the scenes (and then boasting about it). But expecting the same from a free service is unreasonable. Stalking people and asking for damages because they didn't meet an unreasonable expectation is beyond unreasonable.

diggan 7y ago
> it would be reasonable to expect either a notification of removal and a generous transition period For security issues like XSS in live and deployed libraries? I mean, I don't agree that the library should ever be removed, but if you are of the opinion that vulnerable libraries should be pulled, they should be pulled quickly no?
- wongarsu 7y ago
  What's worse: uninterrupted service with a time window where you are vulnerable to a known XSS attack, or your service suddenly going offline, customers calling your support but all you can tell them is that you will be back in a few days, but at least they are not vulnerable to XSS in the meantime? Of course for a small startup a few days notice before removal is enough, but for a large company a few days may be barely better than no heads up at all. Not everyone can move with the same agility. If you don't pull it at all you risk people staying on the library forever because they don't want to touch a working system.
jlokier 7y ago
Note that in this case, the person being stalked & threatened isn't even the same person as who removed the library. Essentially, they were physically threatened over an open source change done by someone else.