4 ms·

Just a quick note to say I learned more about the backstory of this post from 4 comments on HN than trying to run down the rabbit holes of that Twitter thread.

Just a quick note to say I learned more about the backstory of this post from 4 comments on HN than trying to run down the rabbit holes of that Twitter thread. Thanks for that. Summary from what I can tell: Faker.js is a JavaScript tool for generating realistic test data. Marak is the developer of said tool. He hosts a public version of it on a personal, public GitHub account repository. For some reason he updated the README of this repo to include links to some conspiracy threads on Reddit. Microsoft, owner of GitHub, has suspended his GitHub account. No one seems to know why and whether or how it relates to this action. Various people have opinions and suggestions about this.

Macha 5y ago
> For some reason he updated the README of this repo to include links to some conspiracy threads on Reddit. For more clarity here, he didn't just update the README. He deleted the repo and replaced it with one that only has the modified readme and no content, and pushed an empty package to npm as the latest version (npm has removed the latter).
- sam0x17 5y ago
  I think it's utter bullshit that npm took action the way they did. It's well within his rights to pull the project and update the namespace to whatever he wants. Woe be to those who didn't contribute all these years.
  - Macha 5y ago
    npm is under no obligation to facilitate that. It's well within their rights to use their TOS to refuse service to him in publishing his disruptive package, and simply continue distributing the previous versions under the license terms Marak explicitly licensed them under. You seem to be treating the "THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND" section of the MIT license as a blanket "well it says they can do whatever so it's fine", but not giving the "Administrators at npm reserve the right to delete content hosted on the npm Services that they deem unacceptable" term the same leeway. Either we can expect some sort of implied good faith from both parties despite their legal terms and licenses disavowing such, or we can simply expect the exact text of the licenses. To have one set of expectations on Marak, and another on npm is unreasonable.
    - sam0x17 5y ago
      It just really rubs me the wrong way -- who can argue this isn't just a legitimate reboot of faker? Why does npm get to say that the future of faker isn't a directory with a single .md file? What's to stop this from happening with something higher profile, like npm just decides the new version of webpack is trash, and locks out the maintainers. Sounds like some sussy sourceforge shit to me. It's one thing if there is a virus or a cryptominer in the repo, or if the package maintainer gets hacked and needs control restored. It's another thing to exert editorial control over a popular package and lock out the maintainer. Bad look. Would rather live in the universe where people just re-upload the original under a different maintainer or (gasp) actually pay the guy for all the work he's done over the years, than the world in which certain npm packages become "too big to fail" so we never get to see the actual dynamics of failure, that are supposed to happen, come into play.
    - sam0x17 5y ago
      Is it really open and free if NPM can make editorial decisions that trump the repo owner, whenever they want? I think the implication of this is software packaged on NPM isn't really open source.
      - Macha 5y ago
        Freedom 3 of the Free Software Definition: > The freedom to distribute copies of your modified versions to others (freedom 3). By doing this you can give the whole community a chance to benefit from your changes. Access to the source code is a precondition for this. One of the tests for the Debian Free Software Guidelines: > "The Tentacles of Evil test". Imagine that the author is hired by a large evil corporation and, now in their thrall, attempts to do the worst to the users of the program: to make their lives miserable, to make them stop using the program, to expose them to legal liability, to make the program non-free, to discover their secrets, etc. The same can happen to a corporation bought out by a larger corporation bent on destroying free software in order to maintain its monopoly and extend its evil empire. To be free, the license cannot allow even the author to take away the required freedoms. By these standards, if NPM could not do this (or could only do this by virtue of their TOS), then faker.js and colors.js would not qualify as free software. Most free software definitions are focused on preserving the freedoms of the user first, other wishes of the author like "being paid" or "printing ascii American flags" are secondary
  - 3np 5y ago
    Maybe the issue isn't that NPM and GitHub are taking that decision, but the risk of network-effected monopolies. Same discussion as with generic social media and FB/Meta. A more distributed network benefits everyone. So if this rubs you the wrong way, why not take the opportunity to consider defaulting to alternatives (even just a smaller player), or even self-hosting?
mrtksn 5y ago
Okay, there is more actually. Marak develops this very useful tool and gives it away for free, receives praise but no money. After realising that there is no money in giving stuff for free with no further plan down the road, gets cranky as others are not giving Marak free services and don't accept applause as a payment method, says that someone needs to pay for it or take over the development. Declares that will no longer do free work for corporations[0] but corporations seems to be unimpressed that the free worker will no longer work. Since no one seems to be interested to pay for work offered for free, Marak launches SaaS of the tool as fakercloud.com, which is a popular strategy and sometime can actually work. Unfortunately, according to Marak[1], engineers from Retool copy the SaaS platform and launch it as a part of Retool. Marak realising what has happened offers the CEO of Retool to sell the fakercloud.com to them. The CEO ghosts Marak, maybe because doesn't want give evidence for a lawsuit or maybe doesn't see the point of purchasing a product that the internal engineers already build. As a result, Marak gets angry and deletes everything and posts conspiracy theory memes and links everywhere. As this tool is a popular one and people depend on it, NPM suspends Marak's account and continues to provide lates working version that Marak gave them for free. Honestly, I feel for Marak. What a talented engineer and romantic businessman. [0] https://news.ycombinator.com/item?id=25032105 https://news.ycombinator.com/item?id=25032105 [1] https://web.archive.org/web/20211030075524/https://marak.com/blog/2021-04-25-monetizing-open-source-is-problematic https://web.archive.org/web/20211030075524/https://marak.com...
- pandua 5y ago
  Very romantic: https://abc7ny.com/suspicious-package-queens-astoria-fire/6425363/ https://abc7ny.com/suspicious-package-queens-astoria-fire/64...
  - mrtksn 5y ago
    Just WOW! It's fascinating when you put a face on an online persona. Sooo, is He doing these things from Guantanamo or was the incident considered "no biggie"?
    - kingcharles 5y ago

Macha 5y ago

> For some reason he updated the README of this repo to include links to some conspiracy threads on Reddit. For more clarity here, he didn't just update the README. He deleted the repo and replaced it with one that only has the modified readme and no content, and pushed an empty package to npm as the latest version (npm has removed the latter).

sam0x17 5y ago
I think it's utter bullshit that npm took action the way they did. It's well within his rights to pull the project and update the namespace to whatever he wants. Woe be to those who didn't contribute all these years.
- Macha 5y ago
  npm is under no obligation to facilitate that. It's well within their rights to use their TOS to refuse service to him in publishing his disruptive package, and simply continue distributing the previous versions under the license terms Marak explicitly licensed them under. You seem to be treating the "THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND" section of the MIT license as a blanket "well it says they can do whatever so it's fine", but not giving the "Administrators at npm reserve the right to delete content hosted on the npm Services that they deem unacceptable" term the same leeway. Either we can expect some sort of implied good faith from both parties despite their legal terms and licenses disavowing such, or we can simply expect the exact text of the licenses. To have one set of expectations on Marak, and another on npm is unreasonable.
  - sam0x17 5y ago
    It just really rubs me the wrong way -- who can argue this isn't just a legitimate reboot of faker? Why does npm get to say that the future of faker isn't a directory with a single .md file? What's to stop this from happening with something higher profile, like npm just decides the new version of webpack is trash, and locks out the maintainers. Sounds like some sussy sourceforge shit to me. It's one thing if there is a virus or a cryptominer in the repo, or if the package maintainer gets hacked and needs control restored. It's another thing to exert editorial control over a popular package and lock out the maintainer. Bad look. Would rather live in the universe where people just re-upload the original under a different maintainer or (gasp) actually pay the guy for all the work he's done over the years, than the world in which certain npm packages become "too big to fail" so we never get to see the actual dynamics of failure, that are supposed to happen, come into play.
  - sam0x17 5y ago
    Is it really open and free if NPM can make editorial decisions that trump the repo owner, whenever they want? I think the implication of this is software packaged on NPM isn't really open source.
    - Macha 5y ago
      Freedom 3 of the Free Software Definition: > The freedom to distribute copies of your modified versions to others (freedom 3). By doing this you can give the whole community a chance to benefit from your changes. Access to the source code is a precondition for this. One of the tests for the Debian Free Software Guidelines: > "The Tentacles of Evil test". Imagine that the author is hired by a large evil corporation and, now in their thrall, attempts to do the worst to the users of the program: to make their lives miserable, to make them stop using the program, to expose them to legal liability, to make the program non-free, to discover their secrets, etc. The same can happen to a corporation bought out by a larger corporation bent on destroying free software in order to maintain its monopoly and extend its evil empire. To be free, the license cannot allow even the author to take away the required freedoms. By these standards, if NPM could not do this (or could only do this by virtue of their TOS), then faker.js and colors.js would not qualify as free software. Most free software definitions are focused on preserving the freedoms of the user first, other wishes of the author like "being paid" or "printing ascii American flags" are secondary
- 3np 5y ago
  Maybe the issue isn't that NPM and GitHub are taking that decision, but the risk of network-effected monopolies. Same discussion as with generic social media and FB/Meta. A more distributed network benefits everyone. So if this rubs you the wrong way, why not take the opportunity to consider defaulting to alternatives (even just a smaller player), or even self-hosting?

mrtksn 5y ago

Okay, there is more actually. Marak develops this very useful tool and gives it away for free, receives praise but no money. After realising that there is no money in giving stuff for free with no further plan down the road, gets cranky as others are not giving Marak free services and don't accept applause as a payment method, says that someone needs to pay for it or take over the development. Declares that will no longer do free work for corporations[0] but corporations seems to be unimpressed that the free worker will no longer work. Since no one seems to be interested to pay for work offered for free, Marak launches SaaS of the tool as fakercloud.com, which is a popular strategy and sometime can actually work. Unfortunately, according to Marak[1], engineers from Retool copy the SaaS platform and launch it as a part of Retool. Marak realising what has happened offers the CEO of Retool to sell the fakercloud.com to them. The CEO ghosts Marak, maybe because doesn't want give evidence for a lawsuit or maybe doesn't see the point of purchasing a product that the internal engineers already build. As a result, Marak gets angry and deletes everything and posts conspiracy theory memes and links everywhere. As this tool is a popular one and people depend on it, NPM suspends Marak's account and continues to provide lates working version that Marak gave them for free. Honestly, I feel for Marak. What a talented engineer and romantic businessman. [0] https://news.ycombinator.com/item?id=25032105 https://news.ycombinator.com/item?id=25032105 [1] https://web.archive.org/web/20211030075524/https://marak.com/blog/2021-04-25-monetizing-open-source-is-problematic https://web.archive.org/web/20211030075524/https://marak.com...

pandua 5y ago
Very romantic: https://abc7ny.com/suspicious-package-queens-astoria-fire/6425363/ https://abc7ny.com/suspicious-package-queens-astoria-fire/64...
- mrtksn 5y ago
  Just WOW! It's fascinating when you put a face on an online persona. Sooo, is He doing these things from Guantanamo or was the incident considered "no biggie"?
  - kingcharles 5y ago