4 ms·
> This guy abused Github to distribute malicious code to thousands of projects. He could've done far, far worse in terms of the technical impact of these chang
by thr0wawayf00 5y ago
> This guy abused Github to distribute malicious code to thousands of projects.
He could've done far, far worse in terms of the technical impact of these changes. It's obvious that he was trying to make a statement, not exfiltrate data to sell on the dark web.
It's scary because, as a FOSS maintainer, your code is your responsibility to do with what you will until it's no longer in the market's interest. You don't have the right to expect any sort of compensation for it, but if your project somehow becomes successful and you upset the natural order, all of the work you were told belongs to you that you should be grateful is so successful without being compensated for is now no longer under your control. There was never a business relationship to sever in the first place.
The market doesn't want to come up with a way to compensate FOSS developers with high-profile projects like these, yet the general expectation is those individuals should just continue working on these libraries for companies to profit off of them.
I wouldn't have handled this situation the way this person did, but we're reaching this point where legitimate protest and speech is being met with erasure and confiscation of your work, and that should scare everybody.
> This guy abused Github to distribute malicious code to thousands of projects.
That's one way to look at it. An alternative view is that a bunch of companies took some free code and shoved it into their apps and then got mad that the free code is causing them problems. Instead of examining the inherent contradictions of the FOSS community, commercial interests would rather just erase the protestor.
- not2b 5y agoThis wasn't a "protester". It was deliberate sabotage, done with full knowledge that it would cause major damage. GitHub is with its rights to kick this guy off. It would even be within its rights to take over that account and fix the introduced bug (by reverting the change or otherwise). That wouldn't prevent the original developer from maintaining their own broken version, but npm and GitHub could eliminate it if they want.
- thr0wawayf00 5y ago> It was deliberate sabotage, done with full knowledge that it would cause major damage. That's how protesting often works. Deliberately interfering in normal affairs is a very common protest tactic. Just look at the interstate shutdowns after the George Floyd killing, or going back to Rosa Parks and the Montgomery bus boycott, worker strikes, etc. etc. That's exactly how protest works. Forcing application code to print statements like "LIBERTY LIBERTY LIBERTY" is very, very different than trying to infiltrate commercial systems and exfiltrate sensitive data.
- zamadatix 5y agoProtesting in that manner isn't without consequence even if the thing being protested for is right or something else is worse to do. "It was in protest" is a reasoning not an absolution.
- pritambaral 5y agoAnd who decides the consequences? Who executes the sentence? What makes GitHub the judge, jury, and executioner?
- zamadatix 5y agoThe entity doing the hosting gets to decide what it wants to host. In this case that is GitHub. For the other consequences it depends on the action, where it took place, and what it resulted in to find who assigns and administers the consequences.
- thr0wawayf00 5y agoI'm not arguing that there should be no consequences for what this person did. I am questioning the ability for an application like Github to essentially "cancel" someone like this whenever they feel like it.
- zamadatix 5y agoSomeone else no longer providing his code hosting being equivalent to being "canceled" aside what is the alternative to the hoster being able to chose what is hosted/spread for others?
- viro 5y agoMinus my Hoobs setup was literally knocked offline over that stupid ass stunt. Care to describe to me how that isn't a violation of the CFAA? The fact that you think that crashing RANDOM servers that you DONT know what they do is an ok form of protest is INSANE