7 ms·

This is scary, and I don’t know why people here aren’t losing their minds. I think someone should make a big deal about this. What would be the first step? On

This is scary, and I don’t know why people here aren’t losing their minds. I think someone should make a big deal about this. What would be the first step? On the other hand, my GitHub was once suspended (and all repos shuttered) for posting gists that looked like spam to some algorithm. It was extremely unsettling, and they need to do a better job communicating. But they may have suspended the account because they thought it was hacked, which is almost reasonable.

young_unixer 5y ago
npm has a history of unprofessionalism and arbitrary decision-making. See the whole left-pad fiasco It wouldn't surprise me if banning the guy's account was the decision of someone at the npm team.
stjohnswarts 5y ago
GitHub is a private enterprise, never forget that… It's not scary, GitHub is a community owned by a corporation, and they have every right to kick this guy to the curb as he is a bad actor. This is the same reason I'm cool with them kicking MAGAs spreading lies to the curb. It's one thing to remove/deprecate an NPM package, it's another thing to deliberately break 10s of thousands of software installations because you want to act like a baby. He no doubt did thousands if not hundreds of thousands of dollars in damage and will continue to do so as developers find their stuff broken all over the internet.
paco3346 5y ago
I assume GitHub initially saw this as someone gaining unauthorized access to his account. How often does a maintainer add something like this? Without knowing it was actually him I can totally see why they'd think it wasn't a proper update.
- xbar 5y ago
  I don't assume that at all. I assume that GitHub now lives in Microsoft-liability-fear mode. Expect them to police commits in popular projects.
bogwog 5y ago
Why is that scary? If you do bad things, you're going to get banned. This guy abused Github to distribute malicious code to thousands of projects. If losing your Github means losing your projects, that's on you for being lazy/irresponsible with them. Git is already decentralized, and anything important should be cloned on something you own.
- thr0wawayf00 5y ago
  > This guy abused Github to distribute malicious code to thousands of projects. He could've done far, far worse in terms of the technical impact of these changes. It's obvious that he was trying to make a statement, not exfiltrate data to sell on the dark web. It's scary because, as a FOSS maintainer, your code is your responsibility to do with what you will until it's no longer in the market's interest. You don't have the right to expect any sort of compensation for it, but if your project somehow becomes successful and you upset the natural order, all of the work you were told belongs to you that you should be grateful is so successful without being compensated for is now no longer under your control. There was never a business relationship to sever in the first place. The market doesn't want to come up with a way to compensate FOSS developers with high-profile projects like these, yet the general expectation is those individuals should just continue working on these libraries for companies to profit off of them. I wouldn't have handled this situation the way this person did, but we're reaching this point where legitimate protest and speech is being met with erasure and confiscation of your work, and that should scare everybody. > This guy abused Github to distribute malicious code to thousands of projects. That's one way to look at it. An alternative view is that a bunch of companies took some free code and shoved it into their apps and then got mad that the free code is causing them problems. Instead of examining the inherent contradictions of the FOSS community, commercial interests would rather just erase the protestor.
  - not2b 5y ago
    This wasn't a "protester". It was deliberate sabotage, done with full knowledge that it would cause major damage. GitHub is with its rights to kick this guy off. It would even be within its rights to take over that account and fix the introduced bug (by reverting the change or otherwise). That wouldn't prevent the original developer from maintaining their own broken version, but npm and GitHub could eliminate it if they want.
colonwqbang 5y ago
Have you ever downloaded software from the Internet that claimed to do one thing but then did something completely different? How did that make you feel? If you had a hosting service, would you really let people distribute that kind of software on it, if you could help it?
bluefox 5y ago
You are saying "scary", but I think "alarming" is more appropriate. It's an alarm that should be buzzing through sleepy programmer skulls. It should alert them to the fact that it's no longer the small company that respected programmers, where you felt your account was yours, and your repositories were yours. The rules have changed with that acquisition, and Microsoft exploited the good reputation of that small company and the inertia of its users. Step by step, the site became more "social", and started suffering from the usual issues. Step by step, we see the same bigco policies that treat users as worker ants. When an ant starts making up a mind of its own, queen ant sends some soldier ants to cannibalize it. Now, I realize here on HN the tired old rants of Moxie are considered gold. But if you want to skip being treated like an ant, run your own server, maybe support upcoming federation protocols to kill this centralization and bring down the nest, or at least migrate to some place that respects its users in the meantime.
- slavik81 5y ago
  GitHub has always been about "social coding". This is a quote on their homepage on May 2008 (three months after GitHub was founded): > What’s amazing about Github is how it really brings the social aspect into play. Chris and Tom are showing us all visually how git development is supposed to work. I know I personally had some bing moments once I started pulling in commits from external git repos. https://web.archive.org/web/20080514210148/http://github.com/ https://web.archive.org/web/20080514210148/http://github.com...
  - bluefox 5y ago
    Yeah, I was a GitHub user in 2008. Though it obviously had a social aspect, it wasn't considered a "social network" type of site. Its ongoing transformation into one is a result of the acquisition by Microsoft.
    - wott 5y ago
      I have always considered it a social network, 'the social network for young programmers' as I called it, which turned free software into social networking (portfolio for first employment(s), etc.), and that's why I always refused to create an account over there as I don't want to push those things even further, and got gradually more appalled as I watched projects following the trend and moving there one after the other, making themselves more and more dependent of the tools conveniently provided by that silo, and cutting other ways to interact with them. Long before Microsoft entered the picture.
evouga 5y ago
For a long time I've owned a premium GitHub account and would roll my eyes at colleagues who insisted on using GitLab, as I felt that GitHub had a clearly superior user experience. I have to say, though, that every time in recent memory that GitHub has popped up in the news, it's for something that's made me sigh. The only thing still keeping me one of their customers is the painfulness of transferring over all of my existing repositories. You are, of course, entirely right: GitHub shouldn't be banning users for pushing code to their own repository (with the exception of if the commit contains copyrighted or illegal material, which clearly is not the case here), nor under any circumstances should they be commandeering their user's code and continuing to distribute it without the user's consent.
- asddubs 5y ago
  gitea seems pretty nice, but you have to host it yourself
  - selfhoster11 5y ago
    Codeberg.org is a non-profit organisation that hosts Gitea for free. Even if you do want to set up your own instance, it's very easy to do so. It's one of the least resource-intensive server applications I've seen - roughly 200-300 MB of RAM used on most days, minimal background CPU usage, statically linked Go binary or a Docker container according to preference. A Raspberry Pi with a few hundred megs of spare RAM or a sub $5 VPS will be sufficient.
- CRConrad 5y ago
  > The only thing still keeping me one of their customers is the painfulness of transferring over all of my existing repositories. What's so painful about "git clone"? Oh, you mean you've locked yourself into GH by using some of their proprietary extensions, that isn't present in vanilla git? But how is this even possible? Whenever someone dares claim that Microsoft never abandoned its old "EEE" strategy ("Extend" being the middle of the three Es), legions of HNers always rush to defend them and praise their conversion to Good Guys!

young_unixer 5y ago

npm has a history of unprofessionalism and arbitrary decision-making. See the whole left-pad fiasco It wouldn't surprise me if banning the guy's account was the decision of someone at the npm team.

stjohnswarts 5y ago

GitHub is a private enterprise, never forget that… It's not scary, GitHub is a community owned by a corporation, and they have every right to kick this guy to the curb as he is a bad actor. This is the same reason I'm cool with them kicking MAGAs spreading lies to the curb. It's one thing to remove/deprecate an NPM package, it's another thing to deliberately break 10s of thousands of software installations because you want to act like a baby. He no doubt did thousands if not hundreds of thousands of dollars in damage and will continue to do so as developers find their stuff broken all over the internet.

paco3346 5y ago

I assume GitHub initially saw this as someone gaining unauthorized access to his account. How often does a maintainer add something like this? Without knowing it was actually him I can totally see why they'd think it wasn't a proper update.

xbar 5y ago
I don't assume that at all. I assume that GitHub now lives in Microsoft-liability-fear mode. Expect them to police commits in popular projects.

bogwog 5y ago

Why is that scary? If you do bad things, you're going to get banned. This guy abused Github to distribute malicious code to thousands of projects. If losing your Github means losing your projects, that's on you for being lazy/irresponsible with them. Git is already decentralized, and anything important should be cloned on something you own.

thr0wawayf00 5y ago
> This guy abused Github to distribute malicious code to thousands of projects. He could've done far, far worse in terms of the technical impact of these changes. It's obvious that he was trying to make a statement, not exfiltrate data to sell on the dark web. It's scary because, as a FOSS maintainer, your code is your responsibility to do with what you will until it's no longer in the market's interest. You don't have the right to expect any sort of compensation for it, but if your project somehow becomes successful and you upset the natural order, all of the work you were told belongs to you that you should be grateful is so successful without being compensated for is now no longer under your control. There was never a business relationship to sever in the first place. The market doesn't want to come up with a way to compensate FOSS developers with high-profile projects like these, yet the general expectation is those individuals should just continue working on these libraries for companies to profit off of them. I wouldn't have handled this situation the way this person did, but we're reaching this point where legitimate protest and speech is being met with erasure and confiscation of your work, and that should scare everybody. > This guy abused Github to distribute malicious code to thousands of projects. That's one way to look at it. An alternative view is that a bunch of companies took some free code and shoved it into their apps and then got mad that the free code is causing them problems. Instead of examining the inherent contradictions of the FOSS community, commercial interests would rather just erase the protestor.
- not2b 5y ago
  This wasn't a "protester". It was deliberate sabotage, done with full knowledge that it would cause major damage. GitHub is with its rights to kick this guy off. It would even be within its rights to take over that account and fix the introduced bug (by reverting the change or otherwise). That wouldn't prevent the original developer from maintaining their own broken version, but npm and GitHub could eliminate it if they want.

colonwqbang 5y ago

Have you ever downloaded software from the Internet that claimed to do one thing but then did something completely different? How did that make you feel? If you had a hosting service, would you really let people distribute that kind of software on it, if you could help it?

bluefox 5y ago

You are saying "scary", but I think "alarming" is more appropriate. It's an alarm that should be buzzing through sleepy programmer skulls. It should alert them to the fact that it's no longer the small company that respected programmers, where you felt your account was yours, and your repositories were yours. The rules have changed with that acquisition, and Microsoft exploited the good reputation of that small company and the inertia of its users. Step by step, the site became more "social", and started suffering from the usual issues. Step by step, we see the same bigco policies that treat users as worker ants. When an ant starts making up a mind of its own, queen ant sends some soldier ants to cannibalize it. Now, I realize here on HN the tired old rants of Moxie are considered gold. But if you want to skip being treated like an ant, run your own server, maybe support upcoming federation protocols to kill this centralization and bring down the nest, or at least migrate to some place that respects its users in the meantime.

slavik81 5y ago
GitHub has always been about "social coding". This is a quote on their homepage on May 2008 (three months after GitHub was founded): > What’s amazing about Github is how it really brings the social aspect into play. Chris and Tom are showing us all visually how git development is supposed to work. I know I personally had some bing moments once I started pulling in commits from external git repos. https://web.archive.org/web/20080514210148/http://github.com/ https://web.archive.org/web/20080514210148/http://github.com...
- bluefox 5y ago
  Yeah, I was a GitHub user in 2008. Though it obviously had a social aspect, it wasn't considered a "social network" type of site. Its ongoing transformation into one is a result of the acquisition by Microsoft.
  - wott 5y ago
    I have always considered it a social network, 'the social network for young programmers' as I called it, which turned free software into social networking (portfolio for first employment(s), etc.), and that's why I always refused to create an account over there as I don't want to push those things even further, and got gradually more appalled as I watched projects following the trend and moving there one after the other, making themselves more and more dependent of the tools conveniently provided by that silo, and cutting other ways to interact with them. Long before Microsoft entered the picture.

evouga 5y ago

For a long time I've owned a premium GitHub account and would roll my eyes at colleagues who insisted on using GitLab, as I felt that GitHub had a clearly superior user experience. I have to say, though, that every time in recent memory that GitHub has popped up in the news, it's for something that's made me sigh. The only thing still keeping me one of their customers is the painfulness of transferring over all of my existing repositories. You are, of course, entirely right: GitHub shouldn't be banning users for pushing code to their own repository (with the exception of if the commit contains copyrighted or illegal material, which clearly is not the case here), nor under any circumstances should they be commandeering their user's code and continuing to distribute it without the user's consent.

asddubs 5y ago
gitea seems pretty nice, but you have to host it yourself
- selfhoster11 5y ago
  Codeberg.org is a non-profit organisation that hosts Gitea for free. Even if you do want to set up your own instance, it's very easy to do so. It's one of the least resource-intensive server applications I've seen - roughly 200-300 MB of RAM used on most days, minimal background CPU usage, statically linked Go binary or a Docker container according to preference. A Raspberry Pi with a few hundred megs of spare RAM or a sub $5 VPS will be sufficient.
CRConrad 5y ago
> The only thing still keeping me one of their customers is the painfulness of transferring over all of my existing repositories. What's so painful about "git clone"? Oh, you mean you've locked yourself into GH by using some of their proprietary extensions, that isn't present in vanilla git? But how is this even possible? Whenever someone dares claim that Microsoft never abandoned its old "EEE" strategy ("Extend" being the middle of the three Es), legions of HNers always rush to defend them and praise their conversion to Good Guys!