8 ms·

Marak's GitHub account suspended after he erased his faker project

99 points by phoronixrly 5y ago

js4ever 5y ago
In case you want to backup all your Github repos quickly: apt install git parallel jq -y; TOKEN=xxxxxxxxxxxxxxxxxxxxx; ORG=yyyyyyyyyyyyyy; page=1; while links=($(curl -H "Authorization: token ${TOKEN}" -s "https://api.github.com/orgs/${ORG}/repos?per_page=100&page=${page} https://api.github.com/orgs/${ORG}/repos?per_page=100&page=$..." | jq -rc '.[] | {ssh_url} | .ssh_url')); [[ "$links" ]] do GIT_TERMINAL_PROMPT=0 parallel git clone --depth=1 {} ::: "${links[@]}" ((++page)) done your ssh public key should be added on github for it to work
- arilotter 5y ago
  --depth one will lose allll your history, and only keep `master` branch, though
  - azmarks 5y ago
    He did say quickly
    - SahAssar 5y ago
      Quickly does not imply lossy
josephcsible 5y ago
It's hard to feel bad for you when you try to do an end-run around FOSS licenses being irrevocable and intentionally cause another leftpad incident.
leros 5y ago
Interesting. So he got upset with his project and pushed a new version to NPM which was an empty repo, breaking lots of people's builds. Fair enough I suppose. It's his project. Then NPM reverted the last version to unbreak things probably suspecting his account had been hacked. Fair enough. Now what happens when the author declares it was him? Is it his right to push a broken version? Is it his right to delete the npm package entirely? I'm sure there are some npm terms of service around this, but it's an interesting scenario.
- Macha 5y ago
  > Now what happens when the author declares it was him? Is it his right to push a broken version? Is it his right to delete the npm package entirely? I'm sure there are some npm terms of service around this, but it's an interesting scenario. NPM's terms of service indicate they can refuse service for any reason, and the package's own license of GPL indicates that NPM legally can distribute it without the author's consent otherwise. Even if the package was not license as such, NPM's terms of use indicate you grant them an irrevocable license to distribute what you upload. Unlike some social media platforms, they don't reserve the right to sublicense it, but they do require you agree they aren't the ones liable if someone they distribute it to breaches the license.
- aleksandrh 5y ago
  > breaking lots of people's builds Why would it break people's builds? I can only see this happening if they upgraded faker.js. Besides, best practice says to check each package's repo before upgrading because of 1) malware, and 2) potentially breaking changes. Also, many forks exist, and you can point to GitHub versions of a package.
mellosouls 5y ago
Given the rather flakey behaviour (however provoked he feels) by the owner of a quite high-profile project, its not unreasonable to presume caution on the part of github. The account appears to be there, so either the suspension was temporary, or its visibility is not related to his access to it? https://github.com/marak https://github.com/marak
goblin89 5y ago
Regarding the Faker.js incident, I’m torn between two positions, however unpopular they might be: 1. If I publish a library somewhere, I expect to have control over its future versions, even if I want to effectively break it. If you have not pinned its version in a lockfile or vendored it, it’s your problem if the new version breaks the API. If you have forked it, you can republish it license permitting, but my thing is my thing. If NPM and GitHub allow themselves to take that control away from me, that sounds like news. 2. My attitude to OSS is “help yourself, then help others”: find income (consult, make a business, join a business, etc.), then contribute when you’re comfortable. If you contribute to the extent that it causes you financial ruin, please don’t contribute. On the other hand, the alleged copying of author’s SaaS is unequivocally bad if true. One could sue in response, but presumably it might be difficult depending on local laws, and especially if the thief is in another country.
- josephcsible 5y ago
  Marak force-pushed to his GitHub repo to remove all prior version history. If all he did was publish a new broken version, then my opinion would be very different.
  - goblin89 5y ago
    I believe I should be able to do this with my GitHub repo. (Obviously, anyone is free to fork and I don’t expect to be able to do anything about that.)
    - andrewflnr 5y ago
      Absolutely. In my view the ability to destroy something is nearly the definition of ownership.
      - goblin89 5y ago
        It’s even more worrying once you consider that both NPM and GitHub are owned by the same company.
tacker2000 5y ago
So now we are getting into the same situation as with Twitter for example, where the people running platform are going to start to be the ultimate arbiters of “rules” and “truths”. Should github get involved in this like they did? If they thought his account got hacked, maybe yes. But he did it on purpose, so what happens now? Are they gonna reinstate the empty repo? With all our code so dependent on external sources nowadays, this kind of situation could happen more and more.
damienwebdev 5y ago
My org has forked this to https://github.com/graycoreio/faker.js https://github.com/graycoreio/faker.js from a fairly recent verified commit from Marak, even if its only temporary for some semblance of stability.
cphoover 5y ago
not a solution to the problem... but npm explore should be available to all npm users. Not just enterprise users... I want to know exactly what is being installed when I run `npm install`.
elia_is_me 5y ago
What I learned is that GitHub is no longer a reasonable place to hold your personal source codes, no matter it's private or public. github is still a good place as a platform to show yourself, but it's never home like place where you hide. YOUR ACCOUNT IS NOT YOUR ACCOUNT BUT SOME PROPERTY OF GITHUB (or Microsoft). Since the cloud services (not only GitHub) are increasingly unreliable these days, maybe we should think more before choose to use them.
Otek 5y ago
I wonder if this is because of faker project or he did something else to violate GitHub rules. Because if it’s only related to FakerJS then that’s really fucked up.
- punk_ihaq 5y ago
  Yeah it's pretty ridiculous if they locked him out for changing the README + issue comments of his own repo. Curious if he actually violated anything in GitHub's TOS.
  - cr3ative 5y ago
    "Erased" is the key term here, they rug-pulled a popular NPM package. That's within their rights, but it's going to break things and looks very suspicious, so I'm not entirely surprised their account has been locked down.
    - viro 5y ago
      > they rug-pulled a popular NPM package. That's within their rights That sounds like malicious activity. That's normally against most terms of service
      - sneak 5y ago
        Just because it's malicious doesn't mean it's against the rules (or should be). He didn't do anything wrong. You should have local mirrors of stuff you rely on.
        viro 5y ago
        It's literally a crime. malware is illegal.
        sneak 5y ago
        No, it's not. Publishing malware is protected expression in the USA, like all source code (thanks, djb!). Forcing it onto the computers of others is illegal, but as you know that's not what happened here. Pulled, not pushed.
aliswe 5y ago
is the full story anywhere? people mentioning some conspiracy theory on twitter?
- Macha 5y ago
  So, Ghislaine Maxwell, (edit: suspected to be) reddit power mod maxwellhill is currently being tried as an accomplice to Epstein's underage sex trafficking. The usual conspiracy crowd however are trying to connect it to their old favourite, pizzagate, where they assume basically every left wing figure of note is involved in a satanic child sex cult operating out of a fake pizza shop in DC. They're also implying Aaron Schwartz was murdered to cover it up, rather than driven to suicide by overzealous prosecution of academic journal piracy. When Marak deleted faker.js, he replaced everything with links to reddit conspiracy threads containing the same allegations.
  - BugsJustFindMe 5y ago
    Swartz not Schwartz
    - Macha 5y ago
      Thanks, the edit window on my post is expired so unfortunately I can't fix it now
  - deleted 5y ago
    [deleted]
  - moistly 5y ago
    Speaking of conspiracy… Data-mining 1980s/early 90s alt.sex and its subgroups would provide interesting insights. In the Wild West days of Usenet, internationally criminal explicit content was being passed along the university backbones. Epstein & Maxwell would have had excellent access to their respective university’s unfiltered Usenet feed. I think it would be relatively easy to identify communication networks in which they and their peers were involved.
  - Rebelgecko 5y ago
pull_my_finger 5y ago
Maybe they (gh) suspected someone tampering his account? I'm against the "tantrum" (assuming it was about money) he threw, but it's kind of crazy how NPM can just totally nullify his "activism".
NabiDev 5y ago
GitHub become shit these days. Moving to Codeberge.
grimjeer 5y ago
Just a quick note to say I learned more about the backstory of this post from 4 comments on HN than trying to run down the rabbit holes of that Twitter thread. Thanks for that. Summary from what I can tell: Faker.js is a JavaScript tool for generating realistic test data. Marak is the developer of said tool. He hosts a public version of it on a personal, public GitHub account repository. For some reason he updated the README of this repo to include links to some conspiracy threads on Reddit. Microsoft, owner of GitHub, has suspended his GitHub account. No one seems to know why and whether or how it relates to this action. Various people have opinions and suggestions about this.
- Macha 5y ago
  > For some reason he updated the README of this repo to include links to some conspiracy threads on Reddit. For more clarity here, he didn't just update the README. He deleted the repo and replaced it with one that only has the modified readme and no content, and pushed an empty package to npm as the latest version (npm has removed the latter).
  - sam0x17 5y ago
    I think it's utter bullshit that npm took action the way they did. It's well within his rights to pull the project and update the namespace to whatever he wants. Woe be to those who didn't contribute all these years.
    - Macha 5y ago
      npm is under no obligation to facilitate that. It's well within their rights to use their TOS to refuse service to him in publishing his disruptive package, and simply continue distributing the previous versions under the license terms Marak explicitly licensed them under. You seem to be treating the "THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND" section of the MIT license as a blanket "well it says they can do whatever so it's fine", but not giving the "Administrators at npm reserve the right to delete content hosted on the npm Services that they deem unacceptable" term the same leeway. Either we can expect some sort of implied good faith from both parties despite their legal terms and licenses disavowing such, or we can simply expect the exact text of the licenses. To have one set of expectations on Marak, and another on npm is unreasonable.
cr3ative 5y ago
Without getting in to the conspiracy theories or watching someone's YouTube, it appears the (oft controversial) author rug-pulled a popular npmjs package. This is probably Github doing damage control / fixing up build pipelines for everyone while they figure out next steps.
- foragerr 5y ago
  But npm already did the damage control and restored an older version, fixing all broken CI pipelines. What does any of this have everything to do with GitHub?
  - JimDabell 5y ago
    You know NPM isn’t the only way to install JavaScript packages, right? You can add a GitHub repository directly. Yanking the NPM package doesn’t protect people who are pulling from GitHub directly.
  - cr3ative 5y ago
    It's a suspicious action, so probably locking the account down until they can get in touch and confirm that's what the user wanted to do, and wasn't hacked etc. Could even be automated between npm and github, a compromise warning or similar. All conjecture though.
  - A_non_e-moose 5y ago
    Aren't npm and GH all owned by Microsoft anyway?
    - miltonlaxer 5y ago
      Yes GH and NPM are part of the same company Microsoft

99 points by phoronixrly 5y ago

In case you want to backup all your Github repos quickly: apt install git parallel jq -y; TOKEN=xxxxxxxxxxxxxxxxxxxxx; ORG=yyyyyyyyyyyyyy; page=1; while links=($(curl -H "Authorization: token ${TOKEN}" -s "https://api.github.com/orgs/${ORG}/repos?per_page=100&page=${page} https://api.github.com/orgs/${ORG}/repos?per_page=100&page=$..." | jq -rc '.[] | {ssh_url} | .ssh_url')); [[ "$links" ]] do GIT_TERMINAL_PROMPT=0 parallel git clone --depth=1 {} ::: "${links[@]}" ((++page)) done your ssh public key should be added on github for it to work

arilotter 5y ago
--depth one will lose allll your history, and only keep `master` branch, though
- azmarks 5y ago
  He did say quickly
  - SahAssar 5y ago
    Quickly does not imply lossy

josephcsible 5y ago

It's hard to feel bad for you when you try to do an end-run around FOSS licenses being irrevocable and intentionally cause another leftpad incident.

leros 5y ago

Interesting. So he got upset with his project and pushed a new version to NPM which was an empty repo, breaking lots of people's builds. Fair enough I suppose. It's his project. Then NPM reverted the last version to unbreak things probably suspecting his account had been hacked. Fair enough. Now what happens when the author declares it was him? Is it his right to push a broken version? Is it his right to delete the npm package entirely? I'm sure there are some npm terms of service around this, but it's an interesting scenario.

Macha 5y ago
> Now what happens when the author declares it was him? Is it his right to push a broken version? Is it his right to delete the npm package entirely? I'm sure there are some npm terms of service around this, but it's an interesting scenario. NPM's terms of service indicate they can refuse service for any reason, and the package's own license of GPL indicates that NPM legally can distribute it without the author's consent otherwise. Even if the package was not license as such, NPM's terms of use indicate you grant them an irrevocable license to distribute what you upload. Unlike some social media platforms, they don't reserve the right to sublicense it, but they do require you agree they aren't the ones liable if someone they distribute it to breaches the license.
aleksandrh 5y ago
> breaking lots of people's builds Why would it break people's builds? I can only see this happening if they upgraded faker.js. Besides, best practice says to check each package's repo before upgrading because of 1) malware, and 2) potentially breaking changes. Also, many forks exist, and you can point to GitHub versions of a package.

mellosouls 5y ago

Given the rather flakey behaviour (however provoked he feels) by the owner of a quite high-profile project, its not unreasonable to presume caution on the part of github. The account appears to be there, so either the suspension was temporary, or its visibility is not related to his access to it? https://github.com/marak https://github.com/marak

goblin89 5y ago

Regarding the Faker.js incident, I’m torn between two positions, however unpopular they might be: 1. If I publish a library somewhere, I expect to have control over its future versions, even if I want to effectively break it. If you have not pinned its version in a lockfile or vendored it, it’s your problem if the new version breaks the API. If you have forked it, you can republish it license permitting, but my thing is my thing. If NPM and GitHub allow themselves to take that control away from me, that sounds like news. 2. My attitude to OSS is “help yourself, then help others”: find income (consult, make a business, join a business, etc.), then contribute when you’re comfortable. If you contribute to the extent that it causes you financial ruin, please don’t contribute. On the other hand, the alleged copying of author’s SaaS is unequivocally bad if true. One could sue in response, but presumably it might be difficult depending on local laws, and especially if the thief is in another country.

josephcsible 5y ago
Marak force-pushed to his GitHub repo to remove all prior version history. If all he did was publish a new broken version, then my opinion would be very different.
- goblin89 5y ago
  I believe I should be able to do this with my GitHub repo. (Obviously, anyone is free to fork and I don’t expect to be able to do anything about that.)
  - andrewflnr 5y ago
    Absolutely. In my view the ability to destroy something is nearly the definition of ownership.
    - goblin89 5y ago
      It’s even more worrying once you consider that both NPM and GitHub are owned by the same company.

tacker2000 5y ago

So now we are getting into the same situation as with Twitter for example, where the people running platform are going to start to be the ultimate arbiters of “rules” and “truths”. Should github get involved in this like they did? If they thought his account got hacked, maybe yes. But he did it on purpose, so what happens now? Are they gonna reinstate the empty repo? With all our code so dependent on external sources nowadays, this kind of situation could happen more and more.

damienwebdev 5y ago

My org has forked this to https://github.com/graycoreio/faker.js https://github.com/graycoreio/faker.js from a fairly recent verified commit from Marak, even if its only temporary for some semblance of stability.

cphoover 5y ago

not a solution to the problem... but npm explore should be available to all npm users. Not just enterprise users... I want to know exactly what is being installed when I run `npm install`.

elia_is_me 5y ago

What I learned is that GitHub is no longer a reasonable place to hold your personal source codes, no matter it's private or public. github is still a good place as a platform to show yourself, but it's never home like place where you hide. YOUR ACCOUNT IS NOT YOUR ACCOUNT BUT SOME PROPERTY OF GITHUB (or Microsoft). Since the cloud services (not only GitHub) are increasingly unreliable these days, maybe we should think more before choose to use them.

Otek 5y ago

I wonder if this is because of faker project or he did something else to violate GitHub rules. Because if it’s only related to FakerJS then that’s really fucked up.

punk_ihaq 5y ago
Yeah it's pretty ridiculous if they locked him out for changing the README + issue comments of his own repo. Curious if he actually violated anything in GitHub's TOS.
- cr3ative 5y ago
  "Erased" is the key term here, they rug-pulled a popular NPM package. That's within their rights, but it's going to break things and looks very suspicious, so I'm not entirely surprised their account has been locked down.
  - viro 5y ago
    > they rug-pulled a popular NPM package. That's within their rights That sounds like malicious activity. That's normally against most terms of service
    - sneak 5y ago
      Just because it's malicious doesn't mean it's against the rules (or should be). He didn't do anything wrong. You should have local mirrors of stuff you rely on.
      - viro 5y ago
        It's literally a crime. malware is illegal.
        sneak 5y ago
        No, it's not. Publishing malware is protected expression in the USA, like all source code (thanks, djb!). Forcing it onto the computers of others is illegal, but as you know that's not what happened here. Pulled, not pushed.

aliswe 5y ago

is the full story anywhere? people mentioning some conspiracy theory on twitter?

Macha 5y ago
So, Ghislaine Maxwell, (edit: suspected to be) reddit power mod maxwellhill is currently being tried as an accomplice to Epstein's underage sex trafficking. The usual conspiracy crowd however are trying to connect it to their old favourite, pizzagate, where they assume basically every left wing figure of note is involved in a satanic child sex cult operating out of a fake pizza shop in DC. They're also implying Aaron Schwartz was murdered to cover it up, rather than driven to suicide by overzealous prosecution of academic journal piracy. When Marak deleted faker.js, he replaced everything with links to reddit conspiracy threads containing the same allegations.
- BugsJustFindMe 5y ago
  Swartz not Schwartz
  - Macha 5y ago
    Thanks, the edit window on my post is expired so unfortunately I can't fix it now
- deleted 5y ago
  [deleted]
- moistly 5y ago
  Speaking of conspiracy… Data-mining 1980s/early 90s alt.sex and its subgroups would provide interesting insights. In the Wild West days of Usenet, internationally criminal explicit content was being passed along the university backbones. Epstein & Maxwell would have had excellent access to their respective university’s unfiltered Usenet feed. I think it would be relatively easy to identify communication networks in which they and their peers were involved.
- Rebelgecko 5y ago

pull_my_finger 5y ago

Maybe they (gh) suspected someone tampering his account? I'm against the "tantrum" (assuming it was about money) he threw, but it's kind of crazy how NPM can just totally nullify his "activism".

NabiDev 5y ago

GitHub become shit these days. Moving to Codeberge.

grimjeer 5y ago

Just a quick note to say I learned more about the backstory of this post from 4 comments on HN than trying to run down the rabbit holes of that Twitter thread. Thanks for that. Summary from what I can tell: Faker.js is a JavaScript tool for generating realistic test data. Marak is the developer of said tool. He hosts a public version of it on a personal, public GitHub account repository. For some reason he updated the README of this repo to include links to some conspiracy threads on Reddit. Microsoft, owner of GitHub, has suspended his GitHub account. No one seems to know why and whether or how it relates to this action. Various people have opinions and suggestions about this.

Macha 5y ago
> For some reason he updated the README of this repo to include links to some conspiracy threads on Reddit. For more clarity here, he didn't just update the README. He deleted the repo and replaced it with one that only has the modified readme and no content, and pushed an empty package to npm as the latest version (npm has removed the latter).
- sam0x17 5y ago
  I think it's utter bullshit that npm took action the way they did. It's well within his rights to pull the project and update the namespace to whatever he wants. Woe be to those who didn't contribute all these years.
  - Macha 5y ago
    npm is under no obligation to facilitate that. It's well within their rights to use their TOS to refuse service to him in publishing his disruptive package, and simply continue distributing the previous versions under the license terms Marak explicitly licensed them under. You seem to be treating the "THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND" section of the MIT license as a blanket "well it says they can do whatever so it's fine", but not giving the "Administrators at npm reserve the right to delete content hosted on the npm Services that they deem unacceptable" term the same leeway. Either we can expect some sort of implied good faith from both parties despite their legal terms and licenses disavowing such, or we can simply expect the exact text of the licenses. To have one set of expectations on Marak, and another on npm is unreasonable.

cr3ative 5y ago

Without getting in to the conspiracy theories or watching someone's YouTube, it appears the (oft controversial) author rug-pulled a popular npmjs package. This is probably Github doing damage control / fixing up build pipelines for everyone while they figure out next steps.

foragerr 5y ago
But npm already did the damage control and restored an older version, fixing all broken CI pipelines. What does any of this have everything to do with GitHub?
- JimDabell 5y ago
  You know NPM isn’t the only way to install JavaScript packages, right? You can add a GitHub repository directly. Yanking the NPM package doesn’t protect people who are pulling from GitHub directly.
- cr3ative 5y ago
  It's a suspicious action, so probably locking the account down until they can get in touch and confirm that's what the user wanted to do, and wasn't hacked etc. Could even be automated between npm and github, a compromise warning or similar. All conjecture though.
- A_non_e-moose 5y ago
  Aren't npm and GH all owned by Microsoft anyway?
  - miltonlaxer 5y ago
    Yes GH and NPM are part of the same company Microsoft