12 ms·
I was trying to find Marak's motives for this, but I couldn't find much, does anyone know more? On his Twitter Marak is claiming [1] that GitHub/NPM have suspe
by zegl 5y ago
I was trying to find Marak's motives for this, but I couldn't find much, does anyone know more?
On his Twitter Marak is claiming [1] that GitHub/NPM have suspended his account, which is an interesting move, but I guessing that that's the only tool available to prevent further "sabotage".
[1] https://twitter.com/marak/status/1479200803948830724 https://twitter.com/marak/status/1479200803948830724
- okl 5y agoWell fuck them. It's his code, he should be able to do with it whatever he wants.
- smt88 5y agoIf a major FOSS Linux distro decided to add a virus to their latest release, would you say the same thing? It certainly isn't "his code" anyway. Many people contributed to it with the good-faith belief that he would not use it as a Trojan horse.
- okl 5y agoUsing someone's code (for free) doesn't mean you can dictate terms to them.
- simlevesque 5y agoCould you please tell me how to avoid ever using your code ?
- starwind 5y agoIf I voluntarily share my lunch with someone at work, I can't poison it even though they got free food. Even if someone at work is stealing my lunch, I can't poison it. We have a right to basic safety even in situations we aren't paying for things. That extends to the digital world. You can't put malware in your open-source project without a giant disclaimer "THIS IS MALWARE. USE ONLY FOR RESEARCH PURPOSES" or something like that
- phkahler 5y ago>> . That extends to the digital world. You can't put malware in your open-source project without a giant disclaimer "THIS IS MALWARE. USE ONLY FOR RESEARCH PURPOSES" or something like that sourceforge?
- torstenvl 5y agoMy understanding is that he wasn't voluntarily sharing it. In November he pretty clearly told people to fork his code and move off his repository, and not to rely on his packages anymore. He used a graphic clearly warning of an impending "strike." GitHub Post: https://archive.fo/9fwGz https://archive.fo/9fwGz HN Discussion: https://news.ycombinator.com/item?id=25032105&p=2 https://news.ycombinator.com/item?id=25032105&p=2 That doesn't make it not a dick move. But let's not pretend they still had permission to remote load directly from his repo. If I own a personal storage facility and I decide to demolish it, and I say months in advance for everyone to take their stuff out and store it somewhere else, and then I demolish it and people lose their property... the harmed individuals are not faultless. Would the professional and responsible thing to do be to announce a cut-off date explicitly and make very clear that Bad Things were going to happen if you didn't stop relying on him? Yes, 100%, and I have a low opinion of him for not doing so. However, while what he did was bad, it isn't quite as bad, in my opinion, as people are making it out to be.
- salawat 5y agoYou do not have a right to basic safety when you divest yourself of basic precautions any reasonable actor would have taken. A reasonable actor checks new code pulled down to ensure it actually works. You accept the risk integrating in a stranger's code without mirroring/audit.
- wtallis 5y agoThe legal profession tends to take a more permissive stance when determining the limits of what's "reasonable", as can be seen from how the phrase "moron in a hurry" has become a term of art.
- WJW 5y agoNobody is forcing them to rewrite it or anything. Github canceled his account because knowingly posting malicious software is against the TOS, and it is not difficult to argue that putting infinite loops in the startup code of all your users is malicious. He still has the code on his computer to do whatever he pleases with. The rest of the world is just looking at it askew and calculating the odds something like this is going to happen again and what they should do about it. If you are going to be a dick to your users you should not be surprised that they will refuse to use your software afterwards. In a way, it is kinda sad that this behavior drives him away from the financial security he so seemed to crave. "Yes I just caused your dev team to do hotfixes during the weekend and cost you XYZ dollars in downtime, can I have a senior dev position now plz" is not a very convincing line when interviewing.
- okl 5y agoI agree that it was a dick move from his side. Fork his project, or use an older version. I am not convinced that him breaking his code is something that ought to be punished. GitHub gets the right to close their hand while Marak doesn't.
- watwut 5y agoI see it more as attempt to protect against another similar action. Not so much to punish as in "teach him" or "get revenge".
- okl 5y ago> If a major FOSS Linux distro decided to add a virus to their latest release, would you say the same thing? https://www.eff.org/deeplinks/2012/10/privacy-ubuntu-1210-amazon-ads-and-data-leaks https://www.eff.org/deeplinks/2012/10/privacy-ubuntu-1210-am...
- zamadatix 5y agoGitHub isn't preventing him from doing what he wants with his code it's just not hosting it for him anymore.
- Isthatablackgsd 5y ago> Well fuck them. It's his code, he should be able to do with it whatever he wants. He can do whatever he wants with his codes. It didn't means that private companies have to accept that due to liabilities. He is using an private company platform to publish his code which could make the company liable for him. By removing or suspending his account, the liability will be minimized and shift it to the developer. If the private company keep it in their system and widely available for distribution, other companies that got hit by this malicious code could have a standing to sue the hosting private company for allowing the code to be published. Imagine thousand companies have a lawsuit against the hosting company. So the hosting private company don't want to be liable for this and shutting off the account is their best interest to keep the liability off on them.
- okl 5y agoNot different from Google shutting down someone's account, something that's constantly bemoaned on Hacker News.
- Isthatablackgsd 5y agoDid Microsoft completely banned this developer from their other services? To my understanding, the developer account is suspended from GitHub. He is not banned from other MS products. That is the difference. In Google case, Google completely ban on all of their services to those banned users. If they are banned in Gmail, then likely they are banned from Play Store, Workspace, Google Drive, etc (entire Google ecosystem). In this case, Microsoft didn't banned this developers from their other services, it only the developer's GitHub account is suspended without affecting other services that the developers are using.
- okl 5y agoHow do you know that when you don't know what else he was using his GitHub account for?
- drawfloat 5y agoIt seems to be partially that big corporations are using his library without payment – I can sympathise with that, although if you choose to release it under that license I'm not sure whether you can accuse the companies of doing anything particularly wrong. But also seems to relate it to a pretty insane conspiracy theory that Ghislaine Maxwell was involved in the death of Aaron Swartz, almost entirely based on the debunked theory that an account on Reddit named "MaxwellHill" was hers. Seems like he was just flailing wildly.
- smt88 5y agoHe was arrested a while back for having bomb-making materials in his apartment. Based on that and some other public comments, he seems to be mentally ill.
- onesmartmofo 5y ago
- clock99 5y ago
- nonethewiser 5y ago> It seems to be partially that big corporations are using his library without payment He doesn't charge for it.
- dane-pgp 5y ago> the debunked theory that an account on Reddit named "MaxwellHill" was hers. I assume by "debunked" you are referring to the Vice article, which offered nothing beyond name-calling of the people investigating the theory, and ended with "u/MaxwellHill did not immediately respond to a request for comment sent through Reddit."[0] An example of a relevant fact might be that vice.com was the most popular domain among all the links submitted to Reddit by the user MaxwellHill.[1] It's also worth pointing out that another Reddit mod tried to debunk the theory by claiming that they knew MaxwellHill and that he was a Malaysian man, but this claim started to look suspicious when people found that MaxwellHill had mentioned he/she had "visited" Malaysia before (which is not something one typically says about one's home country).[2] [0] https://www.vice.com/en/article/y3zbaj/incoherent-conspiracy-suggests-ghislaine-maxwell-is-a-powerful-redditor https://www.vice.com/en/article/y3zbaj/incoherent-conspiracy... [1] https://www.reddit.com/r/conspiracy/comments/hoqheb/vice_publishes_article_deriding_maxwellhill/ https://www.reddit.com/r/conspiracy/comments/hoqheb/vice_pub... [2] https://rareddit.com/r/conspiracy/comments/hoopdf/why_is_vice_defending_umaxwellhill/#t1_fxj0ixk https://rareddit.com/r/conspiracy/comments/hoopdf/why_is_vic...
- Sebguer 5y agoHis twitter is very weird - there's a bunch of Ghislaine Maxwell / Aaron Swartz conspiracy theories, which he somehow ties to GamerGate.
- jamal-kumar 5y agoI was about to point out the fact that all this guy's motivations seem to be mental illness YOLO and that it seems he recently lost his job. Kind of like the movie "falling down" but even more petty somehow
- justaplebe 5y ago
- vorpalhex 5y agoMy mental model for "people who believe in conspiracy theories" has changed since I lost a few friends deep into them. I think it's a refuge for distressed people. Some belief that unconnected terrible events are somehow all controlled and "part of the plan". I still don't get it and likely never will, but it at least aligns with anecdotal cases I've experienced of seemingly normal people going a bit off.
- justaplebe 5y ago
- vorpalhex 5y ago> Downvotes in lieu of logical argument in 3...2... If you want a logical rebuttal, you have to make a logical argument, and not > At least 70-80% of 'conspiracy theories' are true. Yes, even many of the 'crazy' ones.
- rhcom2 5y agoI never understood 9/11 truthers until someone explained it that it was more comforting to at least believe someone was pulling the strings in the background because at least there was a plan, even if it was sinister, compared to accepting a militarily inferior enemy half way across the world can upend everything about your life seemingly randomly.
- rsstack 5y agoHe is mentally unstable. His motives are probably irrational. This is not the first time he reaches the news for strange criminal activities. (Yes, it's his code. No, it isn't legal to maliciously add an infinite-loop to a library that you know is used by other companies. The license adds some liability protection, but it's not so simple.)
- deleted 5y ago[deleted]
- ziggus 5y ago"...it isn't legal to maliciously add an infinite-loop to a library that you know is used by other companies" Um, what?
- netr0ute 5y agoIt can't be illegal if the software is provided as-is without any warranty as most OSS licenses do.
- rsstack 5y agoI'll leave it as an exercise for the reader to understand the difference between "I am not liable if I have a bug that ruins your production environment" and "I am not liable if I maliciously introduce a fatal bug knowingly into your production environment".
- fulafel 5y agoMost of those (malice, who introduced it to your environment, fatal bug) seem contestable, even if we grant for the purpose of argument that the as-is disclaimer does not cover all cases.
- rsstack 5y agoDid you see the commit before it was deleted? I'd love to see a lawyer claiming anything else.
- dEnigma 5y agoSeems likely connected to this old post of his about no longer wanting to provide free service to corporations: http://web.archive.org/web/20210704022108/https://github.com/Marak/faker.js/issues/1046 http://web.archive.org/web/20210704022108/https://github.com... Also he seems to have somewhat of a Guerilla mindset, based on this: https://nypost.com/2020/09/16/resident-of-nyc-home-with-suspected-bomb-making-materials-charged/ https://nypost.com/2020/09/16/resident-of-nyc-home-with-susp...
- reaperducer 5y agoAlso he seems to have somewhat of a Guerilla mindset, based on this: https://nypost.com/2020/09/16/resident-of-nyc-home-with-susp https://nypost.com/2020/09/16/resident-of-nyc-home-with-susp... I see "charged," not "convicted" in that article. Real world: Innocent until proven guilty. Internet: Always guilty, because justice doesn't scale.
- ushakov 5y agopeople don't build bombs for fun
- onesmartmofo 5y ago
- falcolas 5y agoSure they do. Some call them rockets, others fireworks. Oh, and anvil shooting…
- WJW 5y agoDo you really need 40 kg of potassium nitrate for your hobbyist fireworks though? That amount can blow up a house. Also if you absolutely can't live without the immature thrill of mixing explosives with your bare hands, at least don't do it in a residential neighborhood.
- 5y ago
- deleted 5y ago[deleted]
- phkahler 5y ago>> On his Twitter Marak is claiming [1] that GitHub/NPM have suspended his account Interesting. Shouldn't they also block access to the repositories? Oh right, that would hurt their other users. This makes it clear who thinks they own code and who works for them for free.
- bhedgeoser 5y ago
- watwut 5y agohttps://www.google.com/amp/s/www.theverge.com/platform/amp/2022/1/9/22874949/developer-corrupts-open-source-libraries-projects-affected https://www.google.com/amp/s/www.theverge.com/platform/amp/2... Seems like he had series of odd statements around the same time: liberty, Aaron Schwarts and some such. Overall it sounded to me more like breakdown then anything else.
- chaostheory 5y agoI'm pretty certain there is mental illness involved when he's making bombs https://abc7ny.com/suspicious-package-queens-astoria-fire/6425363 https://abc7ny.com/suspicious-package-queens-astoria-fire/64...