4 ms·
While I disagree with his move. 1.It is totally in his prerogative to mess up the package he manages, but not to install into it malware. I am on the fence if
by sam_goody 5y ago
While I disagree with his move.
1.It is totally in his prerogative to mess up the package he manages, but not to install into it malware. I am on the fence if this would count as malware. (Because of the open loop, but my leaning is that this is not malware.)
2. Github is, IMO, breaking any trust that I might have had by assuming control of the package, removing the last commit and keeping it online.
If they feel they have a reason to close it, they should. And, they then should fork it and put it up under their own name. Which would generate lots of bad press, but is at least within their rights.
3. I don't quite follow the logic of Github closing his account. Yes, I know that when you use $megacorp they WILL eventually close your account and make you sad. Google did it to me once and shut my gmail account. Tough luck for not being a millionaire.
4. You should always lock your NPM dependencies on a version, and update it when you can see what the results are.
5. Yes, the large corps really should be paying for all the work that is being done to help them, despite their hostile attitudes (being typed on a Mac. Guess who wrote the docs? Not Apple.)
6. Github has some perfectly good competitors, both SaaS (gitlab.com, sourcehut.org) and self-hosted (gitlab, gogs/gitea, etc)
Using them empowers you, and removes a wincy bit of leverage from $megacorp. Enough people follow suit, and the world will be a better place. And besides, Copilot won't steal or reveal your code.
7. There are more effective ways of making his point, but he worked out of emotion, not logic.
Eg. Perhaps he would have been able to change the license and demand compensation from all non-profits? That would provide both cash and publicity.
As a rule, it is always better to act out of logic than emotion, but us humans seem to have an issue with this. ;)
8. Is anyone stepping in to help the author get treatment?
- gnubison 5y ago> Eg. Perhaps he would have been able to change the license and demand compensation from all non-profits? That would provide both cash and publicity. Then everyone would use the old code under the old license and he’d have even less of a chance to get funding.
- dcow 5y agoI pretty much agree with you especially on the point that there are far more effective and nuanced ways to for the maintainer to have made their point, like relicensing (imagine what would happen if the license suddenly became AGPL and everyone at big corps automatically updated without checking the new license—it would be a raucous for both legal and engineering, author could offer a non-gpl version for money and probably rake in more than a 6 figure salary… but I digress). What I find most interesting though are the ethics. The way I interpret (1.) on this comment in the context of this thread (other people have said similar things) is that the community considers the author here to be acting ethically, just annoyingly. When someone submits dubious patches to the linux kernel and wastes everyones time, it’s unethical (kernel maintainers are the victim). When researchers submit dubious CCPA requests to people on and waste peoples time, it’s unethical (webmasters are the victim). However, when a package maintainer throws a temper tantrum and fucks up everyones’ stuff and wastes a bunch of time, they’re in their right to do so and it’s pretty much just annoying but totally okay because the maintainer is the victim of something (either corporate greed or mental health issues, or both). Our society very much puts a premium on protecting victims.
- gnubison 5y ago> Our society very much puts a premium on protecting victims. … is this a bad thing?
- dcow 5y agoNot in isolation but it’s important to understand. It can and is abused by people who know how the meta game is played. The biggest thing for me is that it pretty frequently results in an internally inconsistent worldview, and that is a bad thing.
- rezonant 5y ago> it would be a raucous for both legal and engineering, author could offer a non-gpl version for money and probably rake in more than a 6 figure salary… but I digress) For these particular packages? Very unlikely.
- dcow 5y agoThe GLP affects the entire work. If some fancy pants proprietary shop got caught publishing a release that incorporated an AGPL `faker` then a GPL request would render all the source code. This would be a legal nightmare for some places. Have you heard what happens when an acquirer finds a GPL bomb during due diligence?
- rezonant 5y agoI'm very familiar with the GPL, I just meant folks would rather find non-GPL alternatives. For a library that wraps a few ANSI terminal codes to enable color and provides a bunch of fake data for testing, I think finding alternatives (or just writing them yourself) wouldn't be hard.
- Siira 5y agoI guess the OP means that it would be too late to replace the AGPL code if the company has already published a version including it. My unexpert opinion agrees with the OP.
- leshenka 5y agoI wholeheartedly agree with everything except 5) Faker has (had?) MIT license that basically has no restrictions. $megacorps have all rights to use it any way they want. Why not change the license then? Why not amend the LICENSE file with "free to use unless you're big tech" clause? Correct me if I'm wrong. "big tech should be paying for all the work that is being done to help them" -- They do offer their services and usually you don't need to pay for them _directly_, rather with personal data and opensource libs. Whether or not is it fair trade -- each one decides for their own.
- deleted 5y ago[deleted]
- LdSGSgvupDV 5y agoAgreed. That's why I have self-hosted gitea/gitlab.