15 ms·
GitHub has now suspended the maintainer: https://nitter.net/marak/status/1479200803948830724 https://nitter.net/marak/status/1479200803948830724
by joshuaissac 5y ago
GitHub has now suspended the maintainer:
https://nitter.net/marak/status/1479200803948830724 https://nitter.net/marak/status/1479200803948830724
- DangerousPie 5y ago> #AaronSwartz right...
- junon 5y agoYeah, this was really annoying to see. Don't use him as a pillar to your malicious action.
- zepolen 5y agoYou're new so I won't hold it against you. Aaron Swartz would have 100% approved of this.
- junon 5y agoI'm not new, and no he wouldn't have.
- ddtaylor 5y agoAaron was known for circumventing systems.
- croes 5y agoWas he also known for harming innocent bystanders just to hit big companies?
- ddtaylor 5y agoActually, yeah, because when he setup his PACER scraping script he used credentials belonging to a library that didn't belong to him. A similar thing happened when he hid the computer on campus in a closest that did the JSTOR scraping.
- selfhoster11 5y agoBoo hoo, he "stole" what, $2 worth of computing resources/electricity by doing this? No human has been harmed here. No property has been substantially harmed either. Anything he "stole" should've been made public for free in the first place.
- throw_m239339 5y agoGithub and NPM belong to the same company, Microsoft.
- lloydatkinson 5y agoThank god.
- superkuh 5y agoI don't understand why. It's his code to break if he wants. But I guess when you use a social media service to host your code these are expected and normal results.
- tln 5y agoIs it his code to inject a backdoor in? As another commenter said[0], this is malicious code and THAT is against the ToS of npm[1]. [0] https://news.ycombinator.com/item?id=29865977 https://news.ycombinator.com/item?id=29865977 [1] https://docs.npmjs.com/policies/open-source-terms#:~:text=Content%20containing%20malicious%20computer%20code https://docs.npmjs.com/policies/open-source-terms#:~:text=Co...
- ahiknsr 5y ago> It's his code to break if he wants > I don't understand why If he can break his code because he is the owner then shouldn't the same reasoning apply for Github suspending the account?. It is their website and their rules. Keep in mind Github owns npm and the author has published a malicious package to npm which has 20 millions of downloads so I'm not surprised.
- x86_64Ubuntu 5y agoFor some reason, people are adopting the ideologically inconsistent position full property rights to the dev, but no property rights to Github.
- deleted 5y ago[deleted]
- ddtaylor 5y agoIMO they are kind of different things. The dispute about the code itself seems to be more of a licensing thing whereas the GitHub itself seems to be a property thing.
- cesarb 5y ago> It's his code to break if he wants. This is a library, not standalone software. Breaking it means breaking the code of every software which uses that library.
- tester756 5y agois this good or bad to be honest?
- erk__ 5y agoI assume that GitHub have lifted the ban given that multiple of the comments show in the post is posted after that tweet was made.
- pmlnr 5y agoOn what basis?!
- mirekrusin 5y agoBad faith?
- pmlnr 5y ago"this software comes with no warranties" ?
- mirekrusin 5y agoAdding this kind of disclaimer notice doesn't mean you can do whatever you want. If you perform action in obviously bad faith, your account will be suspended – it's very simple. Github's terms of service must have somewhere detailed description about it.
- pmlnr 5y ago> Github's terms of service must have somewhere detailed description about it. Please, point me to the part where bugs, intentional or not, are disallowed. Taking over someone's account is not justified; for this, definitely, but I'd say it's never is. Block the account yes; take over, no.
- fernandotakai 5y agohttps://docs.github.com/en/github/site-policy/github-terms-of-service#3-github-may-terminate https://docs.github.com/en/github/site-policy/github-terms-o... >GitHub has the right to suspend or terminate your access to all or any part of the Website at any time, with or without cause, with or without notice, effective immediately. GitHub reserves the right to refuse service to anyone for any reason at any time. github owns your account -- if the github company thinks they should terminate your account, they will.
- IceDane 5y agoThis is not the way. Github doesn't have the right to tell someone what to do with their own code. The only right thing to do in this situation is to fork the repositories and fix the situation on the npm side. Github doesn't get to ban this guy because he took a dump in his own backyard. EDIT: I suppose the literal DoS attack in the code probably puts him squarely in the "malicious behaviour" category which then gives github the right to do this.
- qaq 5y agoAre you sure their TOS does not give them a right to do this regardless of "malicious behavior"
- ThunderSizzle 5y agoIs it really that malicious? Obviously people wouldn't use that source code if they didn't want it.
- tkiolp4 5y agoFrom Github’s TOS > GitHub hosts a wide variety of collaborative projects from all over the world, and that collaboration only works when our users are able to work together in good faith. While using the service, you must follow the terms of this section, which include some restrictions on content you can post, conduct on the service, and other limitations. In short, be excellent to each other.
- DonHopkins 5y ago>Github doesn't get to ban this guy because he took a dump in his own backyard. Yes they most certainly do. Also, his landlord gets to ban this guy because he was building bombs in his apartment. https://abc7ny.com/suspicious-package-queens-astoria-fire/6425363/ https://abc7ny.com/suspicious-package-queens-astoria-fire/64... https://www.qgazette.com/articles/more-charges-possible-for-astoria-bomb-suspect/ https://www.qgazette.com/articles/more-charges-possible-for-... https://nypost.com/2020/09/16/resident-of-nyc-home-with-suspected-bomb-making-materials-charged/ https://nypost.com/2020/09/16/resident-of-nyc-home-with-susp... https://www.reuters.com/article/us-usa-new-york-bomb/new-york-man-arrested-after-apartment-fire-explosive-materials-found-idUSKBN2672WQ https://www.reuters.com/article/us-usa-new-york-bomb/new-yor...
- RVuRnvbM2e 5y agoIf that is true it's an outrageous overreaction by GH. Are they now gatekeeping the kinds of code changes you can make to your own repo?
- not2b 5y agoIt isn't your own if you host it with them, and they aren't obliged to help you commit sabotage.
- betwixthewires 5y agoIt's not yours? Really. They own it now because they host it for you? So some ToS could override the software license for your project? In that case I don't see why anyone would use github, ever.
- josephcsible 5y agoBe specific about what you mean by "it". The code you wrote is yours, but their copy of the repository is not yours. And GitHub's TOS does require that you give them certain rights to use the code you put in their repositories, regardless of whether your chosen license would have given them those rights anyway.
- kzrdude 5y agoBut what about the "github identity"? When github is used for authentication on other sites, it may come to a point where you have a reasonable right to continue to use your github identity, even if other github functionality is turned off. I for one think that it makes sense - if I have an identity on github, it can only be turned off gradually, not immediately. I would say, maybe suspend github services for the account and put a timer - 30 days - on suspending the github identity too.
- jeremyjh 5y agoWhy do you think you can use Microsoft's infrastructure to damage Microsoft's customers without consequences from Microsoft?
- sillysaurusx 5y agoThis is scary, and I don’t know why people here aren’t losing their minds. I think someone should make a big deal about this. What would be the first step? On the other hand, my GitHub was once suspended (and all repos shuttered) for posting gists that looked like spam to some algorithm. It was extremely unsettling, and they need to do a better job communicating. But they may have suspended the account because they thought it was hacked, which is almost reasonable.
- young_unixer 5y agonpm has a history of unprofessionalism and arbitrary decision-making. See the whole left-pad fiasco It wouldn't surprise me if banning the guy's account was the decision of someone at the npm team.
- stjohnswarts 5y agoGitHub is a private enterprise, never forget that… It's not scary, GitHub is a community owned by a corporation, and they have every right to kick this guy to the curb as he is a bad actor. This is the same reason I'm cool with them kicking MAGAs spreading lies to the curb. It's one thing to remove/deprecate an NPM package, it's another thing to deliberately break 10s of thousands of software installations because you want to act like a baby. He no doubt did thousands if not hundreds of thousands of dollars in damage and will continue to do so as developers find their stuff broken all over the internet.
- paco3346 5y agoI assume GitHub initially saw this as someone gaining unauthorized access to his account. How often does a maintainer add something like this? Without knowing it was actually him I can totally see why they'd think it wasn't a proper update.
- xbar 5y agoI don't assume that at all. I assume that GitHub now lives in Microsoft-liability-fear mode. Expect them to police commits in popular projects.
- 5y ago
- josephcsible 5y agoPeople who are upset that GitHub suspended him: would you still be upset if the contents of the new package were "require('child_process').exec('rm -rf /*');"? If not, then how malicious does code have to be before a suspension is okay in your opinion?
- nomdep 5y agoOn your own repos? Never for code, nobody force you to run the code.
- bluefox 5y agoI take it you've never read a virus magazine like, say, 40Hex or 29A? What is "malicious code" anyway? Maybe Microsoft Windows is malicious. It does contain code to format your disk.
- greyface- 5y agoNot to mention the aggressive privacy-violating telemetry and advertising.
- chii 5y agoIntent matters. Windows contains the rm -rf code, but you, as a user, would have to knowingly trigger it and confirm. It's not like windows tricks you into formatting your drive. Directing the argument into windows is just whataboutism.
- bluefox 5y ago[flagged]
- yoavm 5y agoKnowingly?! Clearly every developer of an app breaking because of these packages had no idea their app is going to break, and clearly it was exactly the intention. They _were_ tricked. Can you not see a difference between this and between releasing a new package with a README saying "this module will print 'liberty liberty liberty' to your console in an infinite loop!"?
- a-dub 5y agoafter an initial kneejerk reaction, i've realized that this is a really complicated issue to think about. the future is exhausting sometimes.
- deleted 5y ago[deleted]
- croes 5y agoWas it a paid or "free" account?