8 ms·

The absolutely crazy thing is the person who caused this doesn't even think they did anything wrong: https://github.com/babel/babel/pull/13783#issuecomment-9272

by ctvo 5y ago

The absolutely crazy thing is the person who caused this doesn't even think they did anything wrong: https://github.com/babel/babel/pull/13783#issuecomment-927240298 https://github.com/babel/babel/pull/13783#issuecomment-92724... And there are people supporting their position. I think because JS is such a large tent, there are folks not familiar with licenses and general norms in this space. I don't think it's something that being reasonable and pointing things out wouldn't fix. As an aside I'm now extremely uncomfortable if I find any of ai's work as a transitive dependency for my company's own work because of their attitude towards adhering to licenses.

tomxor 5y ago
> I think because JS is such a large tent, there are folks not familiar with licenses and general norms in this space. It's worth pointing out that this is all about a bunch of packages that decorate strings with ANSI colour escape sequences... I'm not saying it's worthless, or that there is nothing wrong in principle - but it's a lot of noise over something easily replicable from scratch - something simple enough that you may even choose to not bother with a library, (i've always just used ANSI codes directly in JS command line tools, sometimes defined in a few constants and interpolated for readability). So perhaps the reason why one author is so pissed at misattribution, and the other allegedly doesn't seem to care much about it, is explained by a large difference in perceived value of the code. To make my point more potent, imagine it was the same debacle over one of the many infamous one line NPM packages like "is-odd" which currently has half a million downloads per day and ultimately consists of the code "return (n % 2) === 1;"... excluding all of the fluff, and even with some unnecessary parenthesis.
- fenomas 5y ago
  I don't think this is a fair framing. This isn't left-pad - it's a library that abstracts something people find annoying, and finding the right abstraction can be difficult even if the final code doesn't seem complicated. Add in a few years of bug fixes and whatnot, and it seems pretty rude to dismiss the result as "easily replicable from scratch".
  - cnst 5y ago
    I think it's worth pointing out that these pull requests replace a totally unrelated package with either one of these two packages that claim to be copying each other. The way it was framed was that someone forked a packaged and started replacing all users; not what happened. Also: I don't even use JS, so, I have no idea who these people or libraries are.
    - fenomas 5y ago
      I was replying to GP's suggestion that the argument is over relatively trivial code, not to anything about the core dispute.
  - tomxor 5y ago
    I think I made it clear enough that I was suggesting these packages are somewhere above the one-liners. While I agree finding the right abstraction is useful and takes time, I find it hard to apply that to a package that provides a function that wraps strings... I think it's fair to say that it's somewhat useful, but easy to replicate from scratch, and that's ok it deserves to exist - it does however considerably affect how different people perceive it's value. But perhaps for contrast we should compare to the other end of the spectrum... Intel uses Minix3 in intelME which is part of every modern intel CPU [0]. Minix3 has a 3 clause BSD license which requires reproducing the copyright notice for basic attribution [1]. Which they failed to reproduce. Now in Tanenbaum's public letter, he politely suggested it would have been courteous if they had merely informed him of what it was being used for [2]... no mention of lack of attribution, no hysteria, no invoking of the mob on twitter, he didn't make even 1/10th the fuss this NPM package developer made. Lets cut to the chase: The difference between these two people is that one cares about attribution way more than contributing to FOSS. They care about it to such a degree that makes me uncomfortable to touch their code, in-case of any perceived injustice against them or missed opportunity for self-promotion. [0] https://en.wikipedia.org/wiki/Intel_Management_Engine#Hardware https://en.wikipedia.org/wiki/Intel_Management_Engine#Hardwa... [1] https://github.com/minix3/minix/blob/master/LICENSE https://github.com/minix3/minix/blob/master/LICENSE [2] https://www.cs.vu.nl/~ast/intel/ https://www.cs.vu.nl/~ast/intel/
- ta988 5y ago
  I thought it was a joke your is-odd comment. But no it is at version 3.0.1 and has 2.1 million downloads a month[0]... And it has a dependency to is-number. With the performance of today's tree shaking systems I wonder why there is not a simple math lib. [0] https://www.npmjs.com/package/is-odd https://www.npmjs.com/package/is-odd
  - tomxor 5y ago
    It's pretty crazy. For whatever reason there is a substantial culture around NPM usage of preferring to depend on lots of trivial packages, over writing simple inline equivalents. And it's recursive, which can mean depending on what seems to be a modest but useful package at the top of that hierarchy ends up pulling down 10k packages. I think this makes it easier to acquire an inflated sense of importance when an authors package reaches popularity - most of the small packages have some value and aren't as ridiculously worthless as "is-odd"; yet they also don't embody anything particularly unique or difficult to replicate. > I wonder why there is not a simple math lib. There are some non-standard but comprehensive math libraries such as MathJS. Although I don't think "is-odd" could be attributed to an absence of standard math libraries.
    - dudeinjapan 5y ago
      In fairness to the OP he did optimize the hell out of his colorette lib, it's about 1/10th the size of the widely adopted chalk lib and performs way better. Back in the day I remember he was (rightly) complaining that the chalk author submitted PRs to get chalk used in as many libs as possible, while colorette (or whatever it was called--it has a different name before) was the technically superior solution to the problem.
      - smoldesu 5y ago
        Then he should have made a PR, or at the very least retained the commit history to recognize the original programmer's work. That's non-negotiable, because commit history can be essential to understanding breakage in mature libraries. The fact that anyone would feel comfortable erasing it leads me to believe there's an ulterior motive.
- diroussel 5y ago
  There can be a lot of value in value in a code base such as this. Just copy an existing open source lib, add a small speed up, push for fast adoption across common OS build tools, now you can sell committer rights for a high price to anyone wanting to launch a supply chain attack. Could be very profitable. This is of course unlikely to be ai’s motivation. I just wanted to present a count point to the argument that such modules have low value.
  - tomxor 5y ago
    Very true, this is a reason i'm trying to distance myself from the NPM ecosystem actually... It's a cultural problem as much as a technical one, and it is ripe for exploitation... In combination with some of the NPM CVEs revealed in the past, it's pretty scary the reach and potential a single NPM package has for destruction and exploitation... and that is before even considering packages that get included in front and back end code for the web.
- dehrmann 5y ago
  Am I right that this is the important part of the library? https://github.com/jorgebucaran/colorette/blob/d1ff3a7/index.js#L5-L34 https://github.com/jorgebucaran/colorette/blob/d1ff3a7/index... I agree that the author clearly spent a lot of time polishing it, hence the pride and feeling of betrayal.
mzarate06 5y ago
> The absolutely crazy thing is the person who caused this doesn't think they did anything wrong. And now he's saying this of the person he took the work from [1]: 1. "I believe he is a good person, but love colorette too much and prefer impulsive actions ... Impulsive behavior can be very dangerous." 2. "Comments like this [https://news.ycombinator.com/item?id=28662796 https://news.ycombinator.com/item?id=28662796] shows that his behavior in that case was very questionable. Seems like he is systematically put himself in conflicts." True or not, I find his claims of the victim having impulsive or questionable behavior, and systematically creating conflicts, ironic. On a more positive note - it looks like both parties are starting to discuss a resolution [1]; maybe even co-maintainership of the original work in question [2]. I personally think that would take a lot of guts, from both parties, given everything that's transpired. I also think johnnyshields in the linked GitHub thread [1] deserves acknowledgement for some noticeably simple, but effective, attempts at facilitating resolution. [1] https://github.com/ai/nanocolors/pull/14#issuecomment-927346264 https://github.com/ai/nanocolors/pull/14#issuecomment-927346... [2] https://twitter.com/jorgebucaran/status/1442055448899641348 https://twitter.com/jorgebucaran/status/1442055448899641348

by ctvo 5y ago

tomxor 5y ago

> I think because JS is such a large tent, there are folks not familiar with licenses and general norms in this space. It's worth pointing out that this is all about a bunch of packages that decorate strings with ANSI colour escape sequences... I'm not saying it's worthless, or that there is nothing wrong in principle - but it's a lot of noise over something easily replicable from scratch - something simple enough that you may even choose to not bother with a library, (i've always just used ANSI codes directly in JS command line tools, sometimes defined in a few constants and interpolated for readability). So perhaps the reason why one author is so pissed at misattribution, and the other allegedly doesn't seem to care much about it, is explained by a large difference in perceived value of the code. To make my point more potent, imagine it was the same debacle over one of the many infamous one line NPM packages like "is-odd" which currently has half a million downloads per day and ultimately consists of the code "return (n % 2) === 1;"... excluding all of the fluff, and even with some unnecessary parenthesis.

fenomas 5y ago
I don't think this is a fair framing. This isn't left-pad - it's a library that abstracts something people find annoying, and finding the right abstraction can be difficult even if the final code doesn't seem complicated. Add in a few years of bug fixes and whatnot, and it seems pretty rude to dismiss the result as "easily replicable from scratch".
- cnst 5y ago
  I think it's worth pointing out that these pull requests replace a totally unrelated package with either one of these two packages that claim to be copying each other. The way it was framed was that someone forked a packaged and started replacing all users; not what happened. Also: I don't even use JS, so, I have no idea who these people or libraries are.
  - fenomas 5y ago
    I was replying to GP's suggestion that the argument is over relatively trivial code, not to anything about the core dispute.
- tomxor 5y ago
  I think I made it clear enough that I was suggesting these packages are somewhere above the one-liners. While I agree finding the right abstraction is useful and takes time, I find it hard to apply that to a package that provides a function that wraps strings... I think it's fair to say that it's somewhat useful, but easy to replicate from scratch, and that's ok it deserves to exist - it does however considerably affect how different people perceive it's value. But perhaps for contrast we should compare to the other end of the spectrum... Intel uses Minix3 in intelME which is part of every modern intel CPU [0]. Minix3 has a 3 clause BSD license which requires reproducing the copyright notice for basic attribution [1]. Which they failed to reproduce. Now in Tanenbaum's public letter, he politely suggested it would have been courteous if they had merely informed him of what it was being used for [2]... no mention of lack of attribution, no hysteria, no invoking of the mob on twitter, he didn't make even 1/10th the fuss this NPM package developer made. Lets cut to the chase: The difference between these two people is that one cares about attribution way more than contributing to FOSS. They care about it to such a degree that makes me uncomfortable to touch their code, in-case of any perceived injustice against them or missed opportunity for self-promotion. [0] https://en.wikipedia.org/wiki/Intel_Management_Engine#Hardware https://en.wikipedia.org/wiki/Intel_Management_Engine#Hardwa... [1] https://github.com/minix3/minix/blob/master/LICENSE https://github.com/minix3/minix/blob/master/LICENSE [2] https://www.cs.vu.nl/~ast/intel/ https://www.cs.vu.nl/~ast/intel/
ta988 5y ago
I thought it was a joke your is-odd comment. But no it is at version 3.0.1 and has 2.1 million downloads a month[0]... And it has a dependency to is-number. With the performance of today's tree shaking systems I wonder why there is not a simple math lib. [0] https://www.npmjs.com/package/is-odd https://www.npmjs.com/package/is-odd
- tomxor 5y ago
  It's pretty crazy. For whatever reason there is a substantial culture around NPM usage of preferring to depend on lots of trivial packages, over writing simple inline equivalents. And it's recursive, which can mean depending on what seems to be a modest but useful package at the top of that hierarchy ends up pulling down 10k packages. I think this makes it easier to acquire an inflated sense of importance when an authors package reaches popularity - most of the small packages have some value and aren't as ridiculously worthless as "is-odd"; yet they also don't embody anything particularly unique or difficult to replicate. > I wonder why there is not a simple math lib. There are some non-standard but comprehensive math libraries such as MathJS. Although I don't think "is-odd" could be attributed to an absence of standard math libraries.
  - dudeinjapan 5y ago
    In fairness to the OP he did optimize the hell out of his colorette lib, it's about 1/10th the size of the widely adopted chalk lib and performs way better. Back in the day I remember he was (rightly) complaining that the chalk author submitted PRs to get chalk used in as many libs as possible, while colorette (or whatever it was called--it has a different name before) was the technically superior solution to the problem.
    - smoldesu 5y ago
      Then he should have made a PR, or at the very least retained the commit history to recognize the original programmer's work. That's non-negotiable, because commit history can be essential to understanding breakage in mature libraries. The fact that anyone would feel comfortable erasing it leads me to believe there's an ulterior motive.
diroussel 5y ago
There can be a lot of value in value in a code base such as this. Just copy an existing open source lib, add a small speed up, push for fast adoption across common OS build tools, now you can sell committer rights for a high price to anyone wanting to launch a supply chain attack. Could be very profitable. This is of course unlikely to be ai’s motivation. I just wanted to present a count point to the argument that such modules have low value.
- tomxor 5y ago
  Very true, this is a reason i'm trying to distance myself from the NPM ecosystem actually... It's a cultural problem as much as a technical one, and it is ripe for exploitation... In combination with some of the NPM CVEs revealed in the past, it's pretty scary the reach and potential a single NPM package has for destruction and exploitation... and that is before even considering packages that get included in front and back end code for the web.
dehrmann 5y ago
Am I right that this is the important part of the library? https://github.com/jorgebucaran/colorette/blob/d1ff3a7/index.js#L5-L34 https://github.com/jorgebucaran/colorette/blob/d1ff3a7/index... I agree that the author clearly spent a lot of time polishing it, hence the pride and feeling of betrayal.

mzarate06 5y ago

> The absolutely crazy thing is the person who caused this doesn't think they did anything wrong. And now he's saying this of the person he took the work from [1]: 1. "I believe he is a good person, but love colorette too much and prefer impulsive actions ... Impulsive behavior can be very dangerous." 2. "Comments like this [https://news.ycombinator.com/item?id=28662796 https://news.ycombinator.com/item?id=28662796] shows that his behavior in that case was very questionable. Seems like he is systematically put himself in conflicts." True or not, I find his claims of the victim having impulsive or questionable behavior, and systematically creating conflicts, ironic. On a more positive note - it looks like both parties are starting to discuss a resolution [1]; maybe even co-maintainership of the original work in question [2]. I personally think that would take a lot of guts, from both parties, given everything that's transpired. I also think johnnyshields in the linked GitHub thread [1] deserves acknowledgement for some noticeably simple, but effective, attempts at facilitating resolution. [1] https://github.com/ai/nanocolors/pull/14#issuecomment-927346264 https://github.com/ai/nanocolors/pull/14#issuecomment-927346... [2] https://twitter.com/jorgebucaran/status/1442055448899641348 https://twitter.com/jorgebucaran/status/1442055448899641348