7 ms·

I keep thinking about this event and it seems like a fractal of bizarre phenomena. The act of stripping git history and attribution while forking is itself mal

by d3nj4l 5y ago

I keep thinking about this event and it seems like a fractal of bizarre phenomena. The act of stripping git history and attribution while forking is itself malicious, but then aggressively creating pull requests across major projects to use the new version and rack up your download count (???), then picking petty fights with the creator of the original over attribution (????), and the fanbase (?????) of the forker dogpiling the original creator (??????) is... what? I struggle to attribute these to normal, healthy motivations. Something is very, very wrong with the JS Open Source community if naked clout chasing like this is not only tolerated but also rewarded with fans!

ctvo 5y ago
The absolutely crazy thing is the person who caused this doesn't even think they did anything wrong: https://github.com/babel/babel/pull/13783#issuecomment-927240298 https://github.com/babel/babel/pull/13783#issuecomment-92724... And there are people supporting their position. I think because JS is such a large tent, there are folks not familiar with licenses and general norms in this space. I don't think it's something that being reasonable and pointing things out wouldn't fix. As an aside I'm now extremely uncomfortable if I find any of ai's work as a transitive dependency for my company's own work because of their attitude towards adhering to licenses.
- tomxor 5y ago
  > I think because JS is such a large tent, there are folks not familiar with licenses and general norms in this space. It's worth pointing out that this is all about a bunch of packages that decorate strings with ANSI colour escape sequences... I'm not saying it's worthless, or that there is nothing wrong in principle - but it's a lot of noise over something easily replicable from scratch - something simple enough that you may even choose to not bother with a library, (i've always just used ANSI codes directly in JS command line tools, sometimes defined in a few constants and interpolated for readability). So perhaps the reason why one author is so pissed at misattribution, and the other allegedly doesn't seem to care much about it, is explained by a large difference in perceived value of the code. To make my point more potent, imagine it was the same debacle over one of the many infamous one line NPM packages like "is-odd" which currently has half a million downloads per day and ultimately consists of the code "return (n % 2) === 1;"... excluding all of the fluff, and even with some unnecessary parenthesis.
  - fenomas 5y ago
    I don't think this is a fair framing. This isn't left-pad - it's a library that abstracts something people find annoying, and finding the right abstraction can be difficult even if the final code doesn't seem complicated. Add in a few years of bug fixes and whatnot, and it seems pretty rude to dismiss the result as "easily replicable from scratch".
    - cnst 5y ago
      I think it's worth pointing out that these pull requests replace a totally unrelated package with either one of these two packages that claim to be copying each other. The way it was framed was that someone forked a packaged and started replacing all users; not what happened. Also: I don't even use JS, so, I have no idea who these people or libraries are.
      - fenomas 5y ago
        I was replying to GP's suggestion that the argument is over relatively trivial code, not to anything about the core dispute.
    - tomxor 5y ago
      I think I made it clear enough that I was suggesting these packages are somewhere above the one-liners. While I agree finding the right abstraction is useful and takes time, I find it hard to apply that to a package that provides a function that wraps strings... I think it's fair to say that it's somewhat useful, but easy to replicate from scratch, and that's ok it deserves to exist - it does however considerably affect how different people perceive it's value. But perhaps for contrast we should compare to the other end of the spectrum... Intel uses Minix3 in intelME which is part of every modern intel CPU [0]. Minix3 has a 3 clause BSD license which requires reproducing the copyright notice for basic attribution [1]. Which they failed to reproduce. Now in Tanenbaum's public letter, he politely suggested it would have been courteous if they had merely informed him of what it was being used for [2]... no mention of lack of attribution, no hysteria, no invoking of the mob on twitter, he didn't make even 1/10th the fuss this NPM package developer made. Lets cut to the chase: The difference between these two people is that one cares about attribution way more than contributing to FOSS. They care about it to such a degree that makes me uncomfortable to touch their code, in-case of any perceived injustice against them or missed opportunity for self-promotion. [0] https://en.wikipedia.org/wiki/Intel_Management_Engine#Hardware https://en.wikipedia.org/wiki/Intel_Management_Engine#Hardwa... [1] https://github.com/minix3/minix/blob/master/LICENSE https://github.com/minix3/minix/blob/master/LICENSE [2] https://www.cs.vu.nl/~ast/intel/ https://www.cs.vu.nl/~ast/intel/
- mzarate06 5y ago
  > The absolutely crazy thing is the person who caused this doesn't think they did anything wrong. And now he's saying this of the person he took the work from [1]: 1. "I believe he is a good person, but love colorette too much and prefer impulsive actions ... Impulsive behavior can be very dangerous." 2. "Comments like this [https://news.ycombinator.com/item?id=28662796 https://news.ycombinator.com/item?id=28662796] shows that his behavior in that case was very questionable. Seems like he is systematically put himself in conflicts." True or not, I find his claims of the victim having impulsive or questionable behavior, and systematically creating conflicts, ironic. On a more positive note - it looks like both parties are starting to discuss a resolution [1]; maybe even co-maintainership of the original work in question [2]. I personally think that would take a lot of guts, from both parties, given everything that's transpired. I also think johnnyshields in the linked GitHub thread [1] deserves acknowledgement for some noticeably simple, but effective, attempts at facilitating resolution. [1] https://github.com/ai/nanocolors/pull/14#issuecomment-927346264 https://github.com/ai/nanocolors/pull/14#issuecomment-927346... [2] https://twitter.com/jorgebucaran/status/1442055448899641348 https://twitter.com/jorgebucaran/status/1442055448899641348
egeozcan 5y ago
I do like releasing everything I develop as FOSS, but we all agree that something like this can happen when we do, even though most of us (me included) find it at least distasteful. Unfortunately this is what happens when any space gets super-competitive, then some people stop caring about spirits and anything else that's impossible to police in a meaningful way. JS is one of the, if not the, most popular programming language in use and it's incredibly accessible. It'd be (and I say this in the most polite and constructive way I could think of) silly to expect that stuff like this won't happen and that there won't be any group of people even cheering this kind of behavior. We all seemingly live in bubbles, at some point we have to realize that we have the whole world in front of us in this crazy place called internet. Well, wasn't that the idea behind the "Eternal September"[0]? It'll not get better unless the whole world gets better. [0]: https://en.wikipedia.org/wiki/Eternal_September https://en.wikipedia.org/wiki/Eternal_September
kitsune_ 5y ago
GitHub / NPM / Twitter together with the conference scene seem to be leading to some form of insta-gramification of open source and programming in general it seems. Edit: Maybe HN is to blame as well.
- ta988 5y ago
  You are right I keep hearing in interviews, videos and blogs people talking about how many stars, please star me etc There is something of a insane competition going on at various levels, people judging languages by their rank on various sources. Saying a specific language is "winning the race". We all know since the 70s that no language is winning ever. Calm down, code in what you like and people around you can use and understand. Create a new language, have fun... Things in life are not always a competition, you can relax.
Bobylonian 5y ago
Arguments of other side explains a lot: https://twitter.com/PostCSS/status/1441734989490446336 https://twitter.com/PostCSS/status/1441734989490446336 https://twitter.com/sitnikcode/status/1441878805337935877 https://twitter.com/sitnikcode/status/1441878805337935877
- jsploit 5y ago
  That does not at all explain their overly aggressive approach and (initial) lack of attribution.
  - Bobylonian 5y ago
    It explains their course of action, as Jorge was not flexible in his "my way or highway" approach. And I would also either ditch or fork earlier version, if maintainer of API is sabotaging my project. IMO, making fork, instead of integrating or writing their own(without the need to acknowledge original author due to significant changes to a code) shows struggle of dealing with this situation. I think that it is too harsh to declare it as intent that is directed specifically towards Jorge, but they took that route where they were vulnerable to attack. In the place of users of Jorges API(because I'm not related in any way to anyone here - I'm just reading this piece an making my comment), if I knew that Jorge would be taking this to public and rally a mob to torch other side, I would be making my own code, but then I don't exactl'y understand using so many unowned modules on personal project, as it is vulnerable to do so in first place(it saves some time initially, but if they are improving code so much, that it is running faster, then that is not an issue to write their own) - and one of the vulnerabilities is exactly this situation. I am sympathising here with Jorge, but only on that side where his efforts in making that API might be significant to him. I don't see anything else good from this situation, as he is not going to get back his main user and others might avoid using his other works because of this conflict. Well, he might have a temporary victory in getting his name in fork, but that will just lead to ditching any code of his in future. The important part is distinguishing author side and his ability to communicate with users and once again I can sympathise with him as author, but not as user, as his communication and solving issues are taken from defensive-aggressive side. You can like or dislike my opinion, but that does not change that fact.
hjek 5y ago
> The act of stripping git history and attribution while forking is itself malicious, Well, okay, the forking could have been more politely, but author is a bit fast to pull the pirate card. It's a free/libre fork of a free/libre project after all. > nanocolors implementation and API are the same as Colorette. You essentially pirated my work.[0] [0]: https://twitter.com/jorgebucaran/status/1441728642711572486 https://twitter.com/jorgebucaran/status/1441728642711572486
- neoromantique 5y ago
  free/libre does not equate to unlicensed. Fork has violated the license of original by stripping the attribution and history.
- pritambaral 5y ago
  free/libre != Do what you want Copying and redistributing software without a license IS the definition of software piracy. The current version appears to be MIT licensed. It is safe to assume that the fork was made under the same license. Given this assumption, and given that the MIT license requires copyright information to be preserved, stripping attribution is a license violation. The claim of piracy is valid.
seoulmetro 5y ago
Somewhere around the 2012'ish era, programming attached itself to the "modern" world of politics, political correctness, etc. This was all facilitated through the hard-use of Twitter, an already politically polluted field. Honestly the best thing you can do is just not use Twitter or Github for social reasons. It's almost a sport at this rate. People trying their best to create drama and false gods. It's almost as bad as LinkedIn.
kennm 5y ago
That's Andrey Sitnik's MO. He's done it before (size-limit vs bundlesize, nanoid). Copy. Tweak. Logo. Repeat. He then goes around opening pull requests painting himself as author.
raxxorrax 5y ago
That development went social is really awesome. Like having the flu or something.

by d3nj4l 5y ago

ctvo 5y ago

The absolutely crazy thing is the person who caused this doesn't even think they did anything wrong: https://github.com/babel/babel/pull/13783#issuecomment-927240298 https://github.com/babel/babel/pull/13783#issuecomment-92724... And there are people supporting their position. I think because JS is such a large tent, there are folks not familiar with licenses and general norms in this space. I don't think it's something that being reasonable and pointing things out wouldn't fix. As an aside I'm now extremely uncomfortable if I find any of ai's work as a transitive dependency for my company's own work because of their attitude towards adhering to licenses.

tomxor 5y ago
> I think because JS is such a large tent, there are folks not familiar with licenses and general norms in this space. It's worth pointing out that this is all about a bunch of packages that decorate strings with ANSI colour escape sequences... I'm not saying it's worthless, or that there is nothing wrong in principle - but it's a lot of noise over something easily replicable from scratch - something simple enough that you may even choose to not bother with a library, (i've always just used ANSI codes directly in JS command line tools, sometimes defined in a few constants and interpolated for readability). So perhaps the reason why one author is so pissed at misattribution, and the other allegedly doesn't seem to care much about it, is explained by a large difference in perceived value of the code. To make my point more potent, imagine it was the same debacle over one of the many infamous one line NPM packages like "is-odd" which currently has half a million downloads per day and ultimately consists of the code "return (n % 2) === 1;"... excluding all of the fluff, and even with some unnecessary parenthesis.
- fenomas 5y ago
  I don't think this is a fair framing. This isn't left-pad - it's a library that abstracts something people find annoying, and finding the right abstraction can be difficult even if the final code doesn't seem complicated. Add in a few years of bug fixes and whatnot, and it seems pretty rude to dismiss the result as "easily replicable from scratch".
  - cnst 5y ago
    I think it's worth pointing out that these pull requests replace a totally unrelated package with either one of these two packages that claim to be copying each other. The way it was framed was that someone forked a packaged and started replacing all users; not what happened. Also: I don't even use JS, so, I have no idea who these people or libraries are.
    - fenomas 5y ago
      I was replying to GP's suggestion that the argument is over relatively trivial code, not to anything about the core dispute.
  - tomxor 5y ago
    I think I made it clear enough that I was suggesting these packages are somewhere above the one-liners. While I agree finding the right abstraction is useful and takes time, I find it hard to apply that to a package that provides a function that wraps strings... I think it's fair to say that it's somewhat useful, but easy to replicate from scratch, and that's ok it deserves to exist - it does however considerably affect how different people perceive it's value. But perhaps for contrast we should compare to the other end of the spectrum... Intel uses Minix3 in intelME which is part of every modern intel CPU [0]. Minix3 has a 3 clause BSD license which requires reproducing the copyright notice for basic attribution [1]. Which they failed to reproduce. Now in Tanenbaum's public letter, he politely suggested it would have been courteous if they had merely informed him of what it was being used for [2]... no mention of lack of attribution, no hysteria, no invoking of the mob on twitter, he didn't make even 1/10th the fuss this NPM package developer made. Lets cut to the chase: The difference between these two people is that one cares about attribution way more than contributing to FOSS. They care about it to such a degree that makes me uncomfortable to touch their code, in-case of any perceived injustice against them or missed opportunity for self-promotion. [0] https://en.wikipedia.org/wiki/Intel_Management_Engine#Hardware https://en.wikipedia.org/wiki/Intel_Management_Engine#Hardwa... [1] https://github.com/minix3/minix/blob/master/LICENSE https://github.com/minix3/minix/blob/master/LICENSE [2] https://www.cs.vu.nl/~ast/intel/ https://www.cs.vu.nl/~ast/intel/
mzarate06 5y ago
> The absolutely crazy thing is the person who caused this doesn't think they did anything wrong. And now he's saying this of the person he took the work from [1]: 1. "I believe he is a good person, but love colorette too much and prefer impulsive actions ... Impulsive behavior can be very dangerous." 2. "Comments like this [https://news.ycombinator.com/item?id=28662796 https://news.ycombinator.com/item?id=28662796] shows that his behavior in that case was very questionable. Seems like he is systematically put himself in conflicts." True or not, I find his claims of the victim having impulsive or questionable behavior, and systematically creating conflicts, ironic. On a more positive note - it looks like both parties are starting to discuss a resolution [1]; maybe even co-maintainership of the original work in question [2]. I personally think that would take a lot of guts, from both parties, given everything that's transpired. I also think johnnyshields in the linked GitHub thread [1] deserves acknowledgement for some noticeably simple, but effective, attempts at facilitating resolution. [1] https://github.com/ai/nanocolors/pull/14#issuecomment-927346264 https://github.com/ai/nanocolors/pull/14#issuecomment-927346... [2] https://twitter.com/jorgebucaran/status/1442055448899641348 https://twitter.com/jorgebucaran/status/1442055448899641348

egeozcan 5y ago

I do like releasing everything I develop as FOSS, but we all agree that something like this can happen when we do, even though most of us (me included) find it at least distasteful. Unfortunately this is what happens when any space gets super-competitive, then some people stop caring about spirits and anything else that's impossible to police in a meaningful way. JS is one of the, if not the, most popular programming language in use and it's incredibly accessible. It'd be (and I say this in the most polite and constructive way I could think of) silly to expect that stuff like this won't happen and that there won't be any group of people even cheering this kind of behavior. We all seemingly live in bubbles, at some point we have to realize that we have the whole world in front of us in this crazy place called internet. Well, wasn't that the idea behind the "Eternal September"[0]? It'll not get better unless the whole world gets better. [0]: https://en.wikipedia.org/wiki/Eternal_September https://en.wikipedia.org/wiki/Eternal_September

kitsune_ 5y ago

GitHub / NPM / Twitter together with the conference scene seem to be leading to some form of insta-gramification of open source and programming in general it seems. Edit: Maybe HN is to blame as well.

ta988 5y ago
You are right I keep hearing in interviews, videos and blogs people talking about how many stars, please star me etc There is something of a insane competition going on at various levels, people judging languages by their rank on various sources. Saying a specific language is "winning the race". We all know since the 70s that no language is winning ever. Calm down, code in what you like and people around you can use and understand. Create a new language, have fun... Things in life are not always a competition, you can relax.

Bobylonian 5y ago

Arguments of other side explains a lot: https://twitter.com/PostCSS/status/1441734989490446336 https://twitter.com/PostCSS/status/1441734989490446336 https://twitter.com/sitnikcode/status/1441878805337935877 https://twitter.com/sitnikcode/status/1441878805337935877

jsploit 5y ago
That does not at all explain their overly aggressive approach and (initial) lack of attribution.
- Bobylonian 5y ago
  It explains their course of action, as Jorge was not flexible in his "my way or highway" approach. And I would also either ditch or fork earlier version, if maintainer of API is sabotaging my project. IMO, making fork, instead of integrating or writing their own(without the need to acknowledge original author due to significant changes to a code) shows struggle of dealing with this situation. I think that it is too harsh to declare it as intent that is directed specifically towards Jorge, but they took that route where they were vulnerable to attack. In the place of users of Jorges API(because I'm not related in any way to anyone here - I'm just reading this piece an making my comment), if I knew that Jorge would be taking this to public and rally a mob to torch other side, I would be making my own code, but then I don't exactl'y understand using so many unowned modules on personal project, as it is vulnerable to do so in first place(it saves some time initially, but if they are improving code so much, that it is running faster, then that is not an issue to write their own) - and one of the vulnerabilities is exactly this situation. I am sympathising here with Jorge, but only on that side where his efforts in making that API might be significant to him. I don't see anything else good from this situation, as he is not going to get back his main user and others might avoid using his other works because of this conflict. Well, he might have a temporary victory in getting his name in fork, but that will just lead to ditching any code of his in future. The important part is distinguishing author side and his ability to communicate with users and once again I can sympathise with him as author, but not as user, as his communication and solving issues are taken from defensive-aggressive side. You can like or dislike my opinion, but that does not change that fact.

hjek 5y ago

> The act of stripping git history and attribution while forking is itself malicious, Well, okay, the forking could have been more politely, but author is a bit fast to pull the pirate card. It's a free/libre fork of a free/libre project after all. > nanocolors implementation and API are the same as Colorette. You essentially pirated my work.[0] [0]: https://twitter.com/jorgebucaran/status/1441728642711572486 https://twitter.com/jorgebucaran/status/1441728642711572486

neoromantique 5y ago
free/libre does not equate to unlicensed. Fork has violated the license of original by stripping the attribution and history.
pritambaral 5y ago
free/libre != Do what you want Copying and redistributing software without a license IS the definition of software piracy. The current version appears to be MIT licensed. It is safe to assume that the fork was made under the same license. Given this assumption, and given that the MIT license requires copyright information to be preserved, stripping attribution is a license violation. The claim of piracy is valid.

seoulmetro 5y ago

Somewhere around the 2012'ish era, programming attached itself to the "modern" world of politics, political correctness, etc. This was all facilitated through the hard-use of Twitter, an already politically polluted field. Honestly the best thing you can do is just not use Twitter or Github for social reasons. It's almost a sport at this rate. People trying their best to create drama and false gods. It's almost as bad as LinkedIn.

kennm 5y ago

That's Andrey Sitnik's MO. He's done it before (size-limit vs bundlesize, nanoid). Copy. Tweak. Logo. Repeat. He then goes around opening pull requests painting himself as author.

raxxorrax 5y ago

That development went social is really awesome. Like having the flu or something.