8 ms·

Should I get paid for my multiple contributions to faker (I don't think I should)? I've submitted several PR's for generating data all of which were accepted. E

Should I get paid for my multiple contributions to faker (I don't think I should)? I've submitted several PR's for generating data all of which were accepted. Even back then the maintainer was barking about money... Honestly the project would be better off forked. He did not write this library entirely by himself, at this point I just see him as holding other committers contributions as hostage. It's a bad look, why would anyone want to deal with him after this stunt is beyond me.

starkd 5y ago
I couldn't help but think the same thing. Seems like an incredibly immature way to handle it. He could have easily set an end date and state nothing will be maintained beyond that date. It's not a good look.
- IceDane 5y ago
  I don't think he cares at this point. I think this is a person that has been driven to the absolute end of their patience. If he's really barely been getting by, then I can only imagine the sheer frustration he must be feeling. Not only are there swathes of fortune 500 companies which depend on his package but don't contribute a dime, but he also had a company with millions of dollars in funding look at his idea and then weaponize his own project to beat him to market.
  - qaq 5y ago
    what idea?
    - IceDane 5y ago
      https://web.archive.org/web/20210628030444/https://marak.com/blog/2021-04-25-monetizing-open-source-is-problematic https://web.archive.org/web/20210628030444/https://marak.com...
      - qaq 5y ago
        still confused faker.js is in no way an original project, ruby faker is 4 years older than faker.js and I doubt it's the oldest.
        bdcravens 5y ago
        Ruby version was based on the Perl version, and this author acknowledged his was based on those 2 versions (from the previous version's README): faker.js was inspired by and has used data definitions from: https://github.com/stympy/faker/ - Copyright (c) 2007-2010 Benjamin Curtis http://search.cpan.org/~jasonk/Data-Faker-0.07/ - Copyright 2004-2005 by Jason Kohles
        qaq 5y ago
        so what was stolen exactly?
        Macha 5y ago
        The Perl package is GPL. He took definitions from it, ported them to JS, and licensed them as MIT. "Is license violation theft?" is one of those questions like "Is piracy theft?", but it does undermine his insistence that he should be allowed commercialise the result.
        hnfong 5y ago
        It depends on whether you think copying a list of constants from what is essentially an “API” is copyright infringement. It’s a contentious topic, but last I heard people here tend to believe it isn’t (as long as it’s Google copying Oracle’s stuff)
        Liquid_Fire 5y ago
        Those sound like two distinct things to me: - Copying an interface for the purpose of providing a compatible implementation (what Google allegedly did - although of course part of the debate is whether they also copied any of the implementation) - Copying parts of the implementation, not for the purpose of compatibility (what faker.js did - in this case, copying constants)
  - mulmen 5y ago
    It seems completely insane to me to give away work and then expect compensation for it.
    - deleted 5y ago
      [deleted]
    - godDLL 5y ago
      But completely sane to base your project on a package of code you don't control? Or to lock up his Github account for exercising his prerogative onto his own code? His behaviour is unusual, but that, you know, could change easily. It could become the normal just like that. Puff.
      - prepend 5y ago
        > But completely sane to base your project on a package of code you don't control? Yes, certainly. I think this is sane because with OSS you can control it if you need to. Until then use what exists. It’s sane to use Linux in my project even though I don’t control that. I suppose it’s also sane to use Windows even though I don’t control that.
        godDLL 5y ago
        So you just leave Windows update on in production? Brave man.
        prepend 5y ago
        Depending on something doesn’t mean crazy. I depend on lots of OSS projects (and windows), but I have a management system where I control what gets updated and when.
        godDLL 5y ago
        You control what gets updated and when. There we are.
  - bdcravens 5y ago
    Of course he acknowledged his reality: "they can legally copy your Intellectual Property" But let's be honest - if they hadn't copied his, they could have easily used the Ruby or Perl version. All he did was port a previous library.
  - A4ET8a8uTh0 5y ago
    His twitter page complaining that his github got locked-up suggests he cares. I am not unsympathetic, but only because, I am starting to see this more as an effort to undermine open source as a movement/cause.
    - glenneroo 5y ago
      Then again he seems quite proud of getting banned from Github in 2013 for "creating a script that forced people to watch a library that [he] created": https://youtu.be/varf6oWaFtU?t=202 https://youtu.be/varf6oWaFtU?t=202
- andrew_ 5y ago
  marak has a documented history of mental illness and downright odd behavior. Talented dev and troubled individual. There's a pretty concise video covering what went down with some history here: https://www.youtube.com/watch?v=R6S-b_k-ZKY https://www.youtube.com/watch?v=R6S-b_k-ZKY
  - rackjack 5y ago
    That video doesn't discuss marak's "history of mental illness". Do you have some information on this?
    - dimgl 5y ago
      Here's some information: https://www.reuters.com/article/us-usa-new-york-bomb/new-york-man-arrested-after-apartment-fire-explosive-materials-found-idUSKBN2672WQ https://www.reuters.com/article/us-usa-new-york-bomb/new-yor...
      - flemhans 5y ago
        That escalated quickly.
  - obviousanswer9 5y ago
    - obviousanswer9 5y ago
bdcravens 5y ago
Not to mention the fact that this is just a port of faker from Ruby and Perl (from last version's README, "faker.js was inspired by and has used data definitions from ...")
- bmn__ 5y ago
  "inspired" my ass. It's a fork, not keeping the licence terms. https://news.ycombinator.com/item?id=27254092 https://news.ycombinator.com/item?id=27254092
  - fault1 5y ago
    seems like he has a history of this (HN 2010): https://news.ycombinator.com/item?id=1448309 https://news.ycombinator.com/item?id=1448309
    - glenneroo 5y ago
      and he seems quite proud of getting banned from Github in 2013: https://youtu.be/varf6oWaFtU?t=202 https://youtu.be/varf6oWaFtU?t=202
      - cercatrova 5y ago
        Well, he just got banned again from GitHub today.
    - andai 5y ago
      You may also enjoy "Jim deletes the tenth grade": https://web.archive.org/web/20081020082418/http://www.jimbastard.com/Jim_deletes_the_tenth_grade.html https://web.archive.org/web/20081020082418/http://www.jimbas...
hn_throwaway_99 5y ago
> It's a bad look, why would anyone want to deal with him after this stunt is beyond me. The maintainer appears to be unwell: https://abc7ny.com/suspicious-package-queens-astoria-fire/6425363/ https://abc7ny.com/suspicious-package-queens-astoria-fire/64...
- noah_buddy 5y ago
  The maintainer seems a few steps beyond unwell. Seems like he was planning a terrorist act of some sort. Even if one is mentally unwell, I would not first describe them that way should they choose to premeditate harm against others. If you're building bombs, you're almost certainly at that point. At the very least, the maintainer is unstable if not actively malicious and seeking to cause harm however he can.
  - deleted 5y ago
    [deleted]
  - pverghese 5y ago
    Let's not start claiming people are planning terrorist acts without any proof. Those claims are extremely hard to get rid of, especially on the internet.
    - josephcsible 5y ago
      Here's the proof: https://abc7ny.com/suspicious-package-queens-astoria-fire/6425363/ https://abc7ny.com/suspicious-package-queens-astoria-fire/64... Another article: https://www.njhomelandsecurity.gov/at-a-glance/9-21-20 https://www.njhomelandsecurity.gov/at-a-glance/9-21-20
      - barsonme 5y ago
        All that proves is he’s got an interest in explosives. Believe it or not, explosives are a legitimate hobby for some folks. Unless there is other evidence, you’re just blindly speculating as to his intent.
joshspankit 5y ago
> Should I get paid for my multiple contributions to faker (I don't think I should)? The biggest thing that excites me about the possibilities for the future of smart contracts is that creators of all kinds could automatically benefit from any work they do. This scenario, for example: Any company that used faker.js to make a profit would have X% of that revenue feed back to the smart contracts. The creator would probably get the most, followed by the maintainer, then anyone who had a PR approved, then maybe people who submitted good bug reports. All automatically, and all directly in to everyone’s wallet. Not only would this be an easy way for creators to get paid, it would also incentivize the maintenance of those creations. And if you didn’t want to get paid, you could simply have funds directed to charity or opt out of your share entirely.
- staticassertion 5y ago
  The second someone puts out a 'faker.js' that does this companies will drop it, just as they ban AGPL software.
  - joshspankit 5y ago
    As I mention in a different reply: > I totally agree that it does not work in the current version of the real world.
- max49 5y ago
  >The biggest thing that excites me about the possibilities for the future of smart contracts is that creators of all kinds could automatically benefit from any work they do. >Any company that used faker.js to make a profit would have X% of that revenue feed back to the smart contracts. Doesn't work in the real world. If you rely on them to tell you what their profit are for a project, they'll just give you a value of 0$ and continue to not pay you the same way they did before. The blockchain/smart-contracts adds no value compared to changing the licence on your code because either way you have to beg/sue them to get paid. Even with a client who is well intentioned and wants to pay you, they will never want to link their profit to a smart contract and expose their financial data. Measuring profit btw is very complicated and there is a lot of human interpretation to it, you can have a company worth bilions of dollars with top employees making millions per years even if it technically has never made a profit. And also, the risk of a bug in the smart contract emptying their account would be enough to stop any serious companies.
kodemager 5y ago
I think it’s a bad stunt that outlines an issue with mega corps using oss and blindly updating their packages. Or anyone blindly updating their packages really. But I don’t see how GitHub has the right to suspend him and rewind his work. I mean, that has to be a copyright infringement if there ever was one.
- Too 5y ago
  A stall owner who deliberately injects poison into their apples should rightfully be thrown out of the Bazaar. Regardless if the apples are given for free or not.
  - kodemager 5y ago
    But the ownership of the apples doesn’t automatically change hands just because their owner decides to poison them.
    - krona 5y ago
      Forfeiture is the loss of any property without compensation as a result of defaulting on contractual obligations, or as a penalty for illegal conduct.
      - emteycz 5y ago
        Where is the court judgement for that?
- amyjess 5y ago
  GitHub is private property, and they have the right to eject anyone from their property for any reason or even no reason at all. And the code is open-source under the MIT license, so GitHub can do with it as they see fit.
  - kodemager 5y ago
    The MIT license doesn’t give you the right to claim ownership over someone else’s code. You can copy it and claim ownership over that, but it doesn’t allow you to remove the author from their work and then keep the work as your own. The author has a right to delete it if they want to.
DarkWiiPlayer 5y ago
> at this point I just see him as holding other committers contributions as hostage No he's not, and you're just trying to be outraged. Just fork the code if you don't trust him. Oh, but you don't want to take his place as the maintainer? Maybe deep down you know that there's still a difference between being in charge and submitting the occasional pull request? Your actions contradict your words here.
- Madeindjs 5y ago
  I thought that author of Faker don't ask a new maintainer, he just ask for money. So I think this point is valid. A maintainer role could be to just accept some occasional pull request if he don't want to make it a bigger project.
- bastardoperator 5y ago
  There is no more code. Even if someone wanted to fork or maintain a fork, they can't. Try to understand what's actually going on before making silly comments.
marcus_holmes 5y ago
How many other maintainers are getting increasingly annoyed at the users of their code? Entitled users demanding changes to fit their use cases, megacorps using the code for free, other megacorps forking the code and launching it as a commercial service, we've been hearing for years about the problems of being an OSS maintainer. Focusing on the troubles of this one person is a mistake. Of course the more "unbalanced" individuals will crack first. But we should expect more and more to go the same way (not necessarily by sabotaging their code though). This model of software development is unsustainable.
- prepend 5y ago
  > This model of software development is unsustainable. I don’t think this is right. It seems very sustainable as evidenced by 30+ years of sustained OSS development. It seems very sustainable as we live in a time of the best OSS software ever produced with more high quality software than ever produced by ideological volunteers. I’ve seen statements similar to yours and they just seem so at odds with reality.
  - marcus_holmes 5y ago
    I don't think the OSS work around GNU, etc, can be directly compared to the "new" model around npm/gems/pip/etc, which has really only been going for a bit over 10 years. I can't put my finger on why they're different, but they definitely feel different. The big question is what happens when a maintainer wants to retire and a successor can't be found? Or (as in this case), when a maintainer gets so annoyed by their users that they refuse to continue co-operating with their user base. We don't really have an answer for either of these questions yet, and we won't bump into them until maintainers get old or angry. But we have been predicting that this problem will happen. Now we're bumping into this problem, it's our new reality. What's the solution?
    - prepend 5y ago
      The package ecosystem is growing and there’s more good packages each year. 10 years isn’t 30, but it’s still a long time to show success. That’s there’s only been a few problems like this despite millions of users is a sign of strength. I hedge by pinning yo specific versions and keeping my own package manager (RStudio) to keep mirrors if the packages I scan. That the packages are open source means they are easier to scan or fork. If a maintainer stops then the project can be forked. If nobody wants to fork then that probably means no one cares enough. And that’s ok. Mostly it forces us to be flexible. I don’t think software is a thing but a process or cycle.
maze-le 5y ago
> why would anyone want to deal with him after this stunt is beyond me _faker_ is already gone from our project. The parts of faker that we were using were almost trivial to implement ourselves... probably should have done that from the start.
azangru 5y ago
It has been forked: https://github.com/withshepherd/faker.js https://github.com/withshepherd/faker.js
ydlr 5y ago
> Honestly the project would be better off forked. I agree. It was an irresponsible prank. But Microsoft didn't fork the projects. They hijacked his digital identity on two of their platforms, instead. I find that much disconcerting than what this one maintainer did.
- newaccount74 5y ago
  How did they hijack his identity? They just reverted to an older version instead of the the malicious update, and suspended his account. For them it must look like a malicious hacker took over the devs account, and reverting the malicious actors changes is exactly what I'd expect of a responsible custodian. If you want to trick people into downloading malicious software, don't do it on someone else's platform.

starkd 5y ago

I couldn't help but think the same thing. Seems like an incredibly immature way to handle it. He could have easily set an end date and state nothing will be maintained beyond that date. It's not a good look.

IceDane 5y ago
I don't think he cares at this point. I think this is a person that has been driven to the absolute end of their patience. If he's really barely been getting by, then I can only imagine the sheer frustration he must be feeling. Not only are there swathes of fortune 500 companies which depend on his package but don't contribute a dime, but he also had a company with millions of dollars in funding look at his idea and then weaponize his own project to beat him to market.
- qaq 5y ago
  what idea?
  - IceDane 5y ago
    https://web.archive.org/web/20210628030444/https://marak.com/blog/2021-04-25-monetizing-open-source-is-problematic https://web.archive.org/web/20210628030444/https://marak.com...
    - qaq 5y ago
      still confused faker.js is in no way an original project, ruby faker is 4 years older than faker.js and I doubt it's the oldest.
      - bdcravens 5y ago
        Ruby version was based on the Perl version, and this author acknowledged his was based on those 2 versions (from the previous version's README): faker.js was inspired by and has used data definitions from: https://github.com/stympy/faker/ - Copyright (c) 2007-2010 Benjamin Curtis http://search.cpan.org/~jasonk/Data-Faker-0.07/ - Copyright 2004-2005 by Jason Kohles
        qaq 5y ago
        so what was stolen exactly?
        Macha 5y ago
        The Perl package is GPL. He took definitions from it, ported them to JS, and licensed them as MIT. "Is license violation theft?" is one of those questions like "Is piracy theft?", but it does undermine his insistence that he should be allowed commercialise the result.
        hnfong 5y ago
        It depends on whether you think copying a list of constants from what is essentially an “API” is copyright infringement. It’s a contentious topic, but last I heard people here tend to believe it isn’t (as long as it’s Google copying Oracle’s stuff)
        Liquid_Fire 5y ago
        Those sound like two distinct things to me: - Copying an interface for the purpose of providing a compatible implementation (what Google allegedly did - although of course part of the debate is whether they also copied any of the implementation) - Copying parts of the implementation, not for the purpose of compatibility (what faker.js did - in this case, copying constants)
- mulmen 5y ago
  It seems completely insane to me to give away work and then expect compensation for it.
  - deleted 5y ago
    [deleted]
  - godDLL 5y ago
    But completely sane to base your project on a package of code you don't control? Or to lock up his Github account for exercising his prerogative onto his own code? His behaviour is unusual, but that, you know, could change easily. It could become the normal just like that. Puff.
    - prepend 5y ago
      > But completely sane to base your project on a package of code you don't control? Yes, certainly. I think this is sane because with OSS you can control it if you need to. Until then use what exists. It’s sane to use Linux in my project even though I don’t control that. I suppose it’s also sane to use Windows even though I don’t control that.
      - godDLL 5y ago
        So you just leave Windows update on in production? Brave man.
        prepend 5y ago
        Depending on something doesn’t mean crazy. I depend on lots of OSS projects (and windows), but I have a management system where I control what gets updated and when.
        godDLL 5y ago
        You control what gets updated and when. There we are.
- bdcravens 5y ago
  Of course he acknowledged his reality: "they can legally copy your Intellectual Property" But let's be honest - if they hadn't copied his, they could have easily used the Ruby or Perl version. All he did was port a previous library.
- A4ET8a8uTh0 5y ago
  His twitter page complaining that his github got locked-up suggests he cares. I am not unsympathetic, but only because, I am starting to see this more as an effort to undermine open source as a movement/cause.
  - glenneroo 5y ago
    Then again he seems quite proud of getting banned from Github in 2013 for "creating a script that forced people to watch a library that [he] created": https://youtu.be/varf6oWaFtU?t=202 https://youtu.be/varf6oWaFtU?t=202
andrew_ 5y ago
marak has a documented history of mental illness and downright odd behavior. Talented dev and troubled individual. There's a pretty concise video covering what went down with some history here: https://www.youtube.com/watch?v=R6S-b_k-ZKY https://www.youtube.com/watch?v=R6S-b_k-ZKY
- rackjack 5y ago
  That video doesn't discuss marak's "history of mental illness". Do you have some information on this?
  - dimgl 5y ago
    Here's some information: https://www.reuters.com/article/us-usa-new-york-bomb/new-york-man-arrested-after-apartment-fire-explosive-materials-found-idUSKBN2672WQ https://www.reuters.com/article/us-usa-new-york-bomb/new-yor...
    - flemhans 5y ago
      That escalated quickly.
- obviousanswer9 5y ago
  - obviousanswer9 5y ago

bdcravens 5y ago

Not to mention the fact that this is just a port of faker from Ruby and Perl (from last version's README, "faker.js was inspired by and has used data definitions from ...")

bmn__ 5y ago
"inspired" my ass. It's a fork, not keeping the licence terms. https://news.ycombinator.com/item?id=27254092 https://news.ycombinator.com/item?id=27254092
- fault1 5y ago
  seems like he has a history of this (HN 2010): https://news.ycombinator.com/item?id=1448309 https://news.ycombinator.com/item?id=1448309
  - glenneroo 5y ago
    and he seems quite proud of getting banned from Github in 2013: https://youtu.be/varf6oWaFtU?t=202 https://youtu.be/varf6oWaFtU?t=202
    - cercatrova 5y ago
      Well, he just got banned again from GitHub today.
  - andai 5y ago
    You may also enjoy "Jim deletes the tenth grade": https://web.archive.org/web/20081020082418/http://www.jimbastard.com/Jim_deletes_the_tenth_grade.html https://web.archive.org/web/20081020082418/http://www.jimbas...

hn_throwaway_99 5y ago

> It's a bad look, why would anyone want to deal with him after this stunt is beyond me. The maintainer appears to be unwell: https://abc7ny.com/suspicious-package-queens-astoria-fire/6425363/ https://abc7ny.com/suspicious-package-queens-astoria-fire/64...

noah_buddy 5y ago
The maintainer seems a few steps beyond unwell. Seems like he was planning a terrorist act of some sort. Even if one is mentally unwell, I would not first describe them that way should they choose to premeditate harm against others. If you're building bombs, you're almost certainly at that point. At the very least, the maintainer is unstable if not actively malicious and seeking to cause harm however he can.
- deleted 5y ago
  [deleted]
- pverghese 5y ago
  Let's not start claiming people are planning terrorist acts without any proof. Those claims are extremely hard to get rid of, especially on the internet.
  - josephcsible 5y ago
    Here's the proof: https://abc7ny.com/suspicious-package-queens-astoria-fire/6425363/ https://abc7ny.com/suspicious-package-queens-astoria-fire/64... Another article: https://www.njhomelandsecurity.gov/at-a-glance/9-21-20 https://www.njhomelandsecurity.gov/at-a-glance/9-21-20
    - barsonme 5y ago
      All that proves is he’s got an interest in explosives. Believe it or not, explosives are a legitimate hobby for some folks. Unless there is other evidence, you’re just blindly speculating as to his intent.

joshspankit 5y ago

> Should I get paid for my multiple contributions to faker (I don't think I should)? The biggest thing that excites me about the possibilities for the future of smart contracts is that creators of all kinds could automatically benefit from any work they do. This scenario, for example: Any company that used faker.js to make a profit would have X% of that revenue feed back to the smart contracts. The creator would probably get the most, followed by the maintainer, then anyone who had a PR approved, then maybe people who submitted good bug reports. All automatically, and all directly in to everyone’s wallet. Not only would this be an easy way for creators to get paid, it would also incentivize the maintenance of those creations. And if you didn’t want to get paid, you could simply have funds directed to charity or opt out of your share entirely.

staticassertion 5y ago
The second someone puts out a 'faker.js' that does this companies will drop it, just as they ban AGPL software.
- joshspankit 5y ago
  As I mention in a different reply: > I totally agree that it does not work in the current version of the real world.
max49 5y ago
>The biggest thing that excites me about the possibilities for the future of smart contracts is that creators of all kinds could automatically benefit from any work they do. >Any company that used faker.js to make a profit would have X% of that revenue feed back to the smart contracts. Doesn't work in the real world. If you rely on them to tell you what their profit are for a project, they'll just give you a value of 0$ and continue to not pay you the same way they did before. The blockchain/smart-contracts adds no value compared to changing the licence on your code because either way you have to beg/sue them to get paid. Even with a client who is well intentioned and wants to pay you, they will never want to link their profit to a smart contract and expose their financial data. Measuring profit btw is very complicated and there is a lot of human interpretation to it, you can have a company worth bilions of dollars with top employees making millions per years even if it technically has never made a profit. And also, the risk of a bug in the smart contract emptying their account would be enough to stop any serious companies.

kodemager 5y ago

I think it’s a bad stunt that outlines an issue with mega corps using oss and blindly updating their packages. Or anyone blindly updating their packages really. But I don’t see how GitHub has the right to suspend him and rewind his work. I mean, that has to be a copyright infringement if there ever was one.

Too 5y ago
A stall owner who deliberately injects poison into their apples should rightfully be thrown out of the Bazaar. Regardless if the apples are given for free or not.
- kodemager 5y ago
  But the ownership of the apples doesn’t automatically change hands just because their owner decides to poison them.
  - krona 5y ago
    Forfeiture is the loss of any property without compensation as a result of defaulting on contractual obligations, or as a penalty for illegal conduct.
    - emteycz 5y ago
      Where is the court judgement for that?
amyjess 5y ago
GitHub is private property, and they have the right to eject anyone from their property for any reason or even no reason at all. And the code is open-source under the MIT license, so GitHub can do with it as they see fit.
- kodemager 5y ago
  The MIT license doesn’t give you the right to claim ownership over someone else’s code. You can copy it and claim ownership over that, but it doesn’t allow you to remove the author from their work and then keep the work as your own. The author has a right to delete it if they want to.

DarkWiiPlayer 5y ago

> at this point I just see him as holding other committers contributions as hostage No he's not, and you're just trying to be outraged. Just fork the code if you don't trust him. Oh, but you don't want to take his place as the maintainer? Maybe deep down you know that there's still a difference between being in charge and submitting the occasional pull request? Your actions contradict your words here.

Madeindjs 5y ago
I thought that author of Faker don't ask a new maintainer, he just ask for money. So I think this point is valid. A maintainer role could be to just accept some occasional pull request if he don't want to make it a bigger project.
bastardoperator 5y ago
There is no more code. Even if someone wanted to fork or maintain a fork, they can't. Try to understand what's actually going on before making silly comments.

marcus_holmes 5y ago

How many other maintainers are getting increasingly annoyed at the users of their code? Entitled users demanding changes to fit their use cases, megacorps using the code for free, other megacorps forking the code and launching it as a commercial service, we've been hearing for years about the problems of being an OSS maintainer. Focusing on the troubles of this one person is a mistake. Of course the more "unbalanced" individuals will crack first. But we should expect more and more to go the same way (not necessarily by sabotaging their code though). This model of software development is unsustainable.

prepend 5y ago
> This model of software development is unsustainable. I don’t think this is right. It seems very sustainable as evidenced by 30+ years of sustained OSS development. It seems very sustainable as we live in a time of the best OSS software ever produced with more high quality software than ever produced by ideological volunteers. I’ve seen statements similar to yours and they just seem so at odds with reality.
- marcus_holmes 5y ago
  I don't think the OSS work around GNU, etc, can be directly compared to the "new" model around npm/gems/pip/etc, which has really only been going for a bit over 10 years. I can't put my finger on why they're different, but they definitely feel different. The big question is what happens when a maintainer wants to retire and a successor can't be found? Or (as in this case), when a maintainer gets so annoyed by their users that they refuse to continue co-operating with their user base. We don't really have an answer for either of these questions yet, and we won't bump into them until maintainers get old or angry. But we have been predicting that this problem will happen. Now we're bumping into this problem, it's our new reality. What's the solution?
  - prepend 5y ago
    The package ecosystem is growing and there’s more good packages each year. 10 years isn’t 30, but it’s still a long time to show success. That’s there’s only been a few problems like this despite millions of users is a sign of strength. I hedge by pinning yo specific versions and keeping my own package manager (RStudio) to keep mirrors if the packages I scan. That the packages are open source means they are easier to scan or fork. If a maintainer stops then the project can be forked. If nobody wants to fork then that probably means no one cares enough. And that’s ok. Mostly it forces us to be flexible. I don’t think software is a thing but a process or cycle.

maze-le 5y ago

> why would anyone want to deal with him after this stunt is beyond me _faker_ is already gone from our project. The parts of faker that we were using were almost trivial to implement ourselves... probably should have done that from the start.

azangru 5y ago

It has been forked: https://github.com/withshepherd/faker.js https://github.com/withshepherd/faker.js

ydlr 5y ago

> Honestly the project would be better off forked. I agree. It was an irresponsible prank. But Microsoft didn't fork the projects. They hijacked his digital identity on two of their platforms, instead. I find that much disconcerting than what this one maintainer did.

newaccount74 5y ago
How did they hijack his identity? They just reverted to an older version instead of the the malicious update, and suspended his account. For them it must look like a malicious hacker took over the devs account, and reverting the malicious actors changes is exactly what I'd expect of a responsible custodian. If you want to trick people into downloading malicious software, don't do it on someone else's platform.