4 ms·

Well fuck them. It's his code, he should be able to do with it whatever he wants.

by okl 5y ago

smt88 5y ago
If a major FOSS Linux distro decided to add a virus to their latest release, would you say the same thing? It certainly isn't "his code" anyway. Many people contributed to it with the good-faith belief that he would not use it as a Trojan horse.
- okl 5y ago
  Using someone's code (for free) doesn't mean you can dictate terms to them.
  - simlevesque 5y ago
    Could you please tell me how to avoid ever using your code ?
  - starwind 5y ago
    If I voluntarily share my lunch with someone at work, I can't poison it even though they got free food. Even if someone at work is stealing my lunch, I can't poison it. We have a right to basic safety even in situations we aren't paying for things. That extends to the digital world. You can't put malware in your open-source project without a giant disclaimer "THIS IS MALWARE. USE ONLY FOR RESEARCH PURPOSES" or something like that
    - phkahler 5y ago
      >> . That extends to the digital world. You can't put malware in your open-source project without a giant disclaimer "THIS IS MALWARE. USE ONLY FOR RESEARCH PURPOSES" or something like that sourceforge?
    - torstenvl 5y ago
      My understanding is that he wasn't voluntarily sharing it. In November he pretty clearly told people to fork his code and move off his repository, and not to rely on his packages anymore. He used a graphic clearly warning of an impending "strike." GitHub Post: https://archive.fo/9fwGz https://archive.fo/9fwGz HN Discussion: https://news.ycombinator.com/item?id=25032105&p=2 https://news.ycombinator.com/item?id=25032105&p=2 That doesn't make it not a dick move. But let's not pretend they still had permission to remote load directly from his repo. If I own a personal storage facility and I decide to demolish it, and I say months in advance for everyone to take their stuff out and store it somewhere else, and then I demolish it and people lose their property... the harmed individuals are not faultless. Would the professional and responsible thing to do be to announce a cut-off date explicitly and make very clear that Bad Things were going to happen if you didn't stop relying on him? Yes, 100%, and I have a low opinion of him for not doing so. However, while what he did was bad, it isn't quite as bad, in my opinion, as people are making it out to be.
    - salawat 5y ago
      You do not have a right to basic safety when you divest yourself of basic precautions any reasonable actor would have taken. A reasonable actor checks new code pulled down to ensure it actually works. You accept the risk integrating in a stranger's code without mirroring/audit.
      - wtallis 5y ago
        The legal profession tends to take a more permissive stance when determining the limits of what's "reasonable", as can be seen from how the phrase "moron in a hurry" has become a term of art.
  - WJW 5y ago
    Nobody is forcing them to rewrite it or anything. Github canceled his account because knowingly posting malicious software is against the TOS, and it is not difficult to argue that putting infinite loops in the startup code of all your users is malicious. He still has the code on his computer to do whatever he pleases with. The rest of the world is just looking at it askew and calculating the odds something like this is going to happen again and what they should do about it. If you are going to be a dick to your users you should not be surprised that they will refuse to use your software afterwards. In a way, it is kinda sad that this behavior drives him away from the financial security he so seemed to crave. "Yes I just caused your dev team to do hotfixes during the weekend and cost you XYZ dollars in downtime, can I have a senior dev position now plz" is not a very convincing line when interviewing.
    - okl 5y ago
      I agree that it was a dick move from his side. Fork his project, or use an older version. I am not convinced that him breaking his code is something that ought to be punished. GitHub gets the right to close their hand while Marak doesn't.
      - watwut 5y ago
        I see it more as attempt to protect against another similar action. Not so much to punish as in "teach him" or "get revenge".
- okl 5y ago
  > If a major FOSS Linux distro decided to add a virus to their latest release, would you say the same thing? https://www.eff.org/deeplinks/2012/10/privacy-ubuntu-1210-amazon-ads-and-data-leaks https://www.eff.org/deeplinks/2012/10/privacy-ubuntu-1210-am...
zamadatix 5y ago
GitHub isn't preventing him from doing what he wants with his code it's just not hosting it for him anymore.
- okl 5y ago
  Instead of the government, we let corporations repress deviants.
  - zamadatix 5y ago
    Deviant or not and corporation or not aren't at play. It'd be the same story if you had a video sharing site and didn't want to host my videos because I broke the "no comedy" rules by uploading a skit.
    - okl 5y ago
      Exactly.
      - zamadatix 5y ago
        Exactly what? The government wasn't involved here so GitHub was allowed to decide what they wanted to host and the author was allowed to do what they want with the code?
Isthatablackgsd 5y ago
> Well fuck them. It's his code, he should be able to do with it whatever he wants. He can do whatever he wants with his codes. It didn't means that private companies have to accept that due to liabilities. He is using an private company platform to publish his code which could make the company liable for him. By removing or suspending his account, the liability will be minimized and shift it to the developer. If the private company keep it in their system and widely available for distribution, other companies that got hit by this malicious code could have a standing to sue the hosting private company for allowing the code to be published. Imagine thousand companies have a lawsuit against the hosting company. So the hosting private company don't want to be liable for this and shutting off the account is their best interest to keep the liability off on them.
- okl 5y ago
  Not different from Google shutting down someone's account, something that's constantly bemoaned on Hacker News.
  - Isthatablackgsd 5y ago
    Did Microsoft completely banned this developer from their other services? To my understanding, the developer account is suspended from GitHub. He is not banned from other MS products. That is the difference. In Google case, Google completely ban on all of their services to those banned users. If they are banned in Gmail, then likely they are banned from Play Store, Workspace, Google Drive, etc (entire Google ecosystem). In this case, Microsoft didn't banned this developers from their other services, it only the developer's GitHub account is suspended without affecting other services that the developers are using.
    - okl 5y ago
      How do you know that when you don't know what else he was using his GitHub account for?

Well fuck them. It's his code, he should be able to do with it whatever he wants.

by okl 5y ago

Well fuck them. It's his code, he should be able to do with it whatever he wants.

If a major FOSS Linux distro decided to add a virus to their latest release, would you say the same thing? It certainly isn't "his code" anyway. Many people contributed to it with the good-faith belief that he would not use it as a Trojan horse.

okl 5y ago
Using someone's code (for free) doesn't mean you can dictate terms to them.
- simlevesque 5y ago
  Could you please tell me how to avoid ever using your code ?
- starwind 5y ago
  If I voluntarily share my lunch with someone at work, I can't poison it even though they got free food. Even if someone at work is stealing my lunch, I can't poison it. We have a right to basic safety even in situations we aren't paying for things. That extends to the digital world. You can't put malware in your open-source project without a giant disclaimer "THIS IS MALWARE. USE ONLY FOR RESEARCH PURPOSES" or something like that
  - phkahler 5y ago
    >> . That extends to the digital world. You can't put malware in your open-source project without a giant disclaimer "THIS IS MALWARE. USE ONLY FOR RESEARCH PURPOSES" or something like that sourceforge?
  - torstenvl 5y ago
    My understanding is that he wasn't voluntarily sharing it. In November he pretty clearly told people to fork his code and move off his repository, and not to rely on his packages anymore. He used a graphic clearly warning of an impending "strike." GitHub Post: https://archive.fo/9fwGz https://archive.fo/9fwGz HN Discussion: https://news.ycombinator.com/item?id=25032105&p=2 https://news.ycombinator.com/item?id=25032105&p=2 That doesn't make it not a dick move. But let's not pretend they still had permission to remote load directly from his repo. If I own a personal storage facility and I decide to demolish it, and I say months in advance for everyone to take their stuff out and store it somewhere else, and then I demolish it and people lose their property... the harmed individuals are not faultless. Would the professional and responsible thing to do be to announce a cut-off date explicitly and make very clear that Bad Things were going to happen if you didn't stop relying on him? Yes, 100%, and I have a low opinion of him for not doing so. However, while what he did was bad, it isn't quite as bad, in my opinion, as people are making it out to be.
  - salawat 5y ago
    You do not have a right to basic safety when you divest yourself of basic precautions any reasonable actor would have taken. A reasonable actor checks new code pulled down to ensure it actually works. You accept the risk integrating in a stranger's code without mirroring/audit.
    - wtallis 5y ago
      The legal profession tends to take a more permissive stance when determining the limits of what's "reasonable", as can be seen from how the phrase "moron in a hurry" has become a term of art.
- WJW 5y ago
  Nobody is forcing them to rewrite it or anything. Github canceled his account because knowingly posting malicious software is against the TOS, and it is not difficult to argue that putting infinite loops in the startup code of all your users is malicious. He still has the code on his computer to do whatever he pleases with. The rest of the world is just looking at it askew and calculating the odds something like this is going to happen again and what they should do about it. If you are going to be a dick to your users you should not be surprised that they will refuse to use your software afterwards. In a way, it is kinda sad that this behavior drives him away from the financial security he so seemed to crave. "Yes I just caused your dev team to do hotfixes during the weekend and cost you XYZ dollars in downtime, can I have a senior dev position now plz" is not a very convincing line when interviewing.
  - okl 5y ago
    I agree that it was a dick move from his side. Fork his project, or use an older version. I am not convinced that him breaking his code is something that ought to be punished. GitHub gets the right to close their hand while Marak doesn't.
    - watwut 5y ago
      I see it more as attempt to protect against another similar action. Not so much to punish as in "teach him" or "get revenge".
okl 5y ago
> If a major FOSS Linux distro decided to add a virus to their latest release, would you say the same thing? https://www.eff.org/deeplinks/2012/10/privacy-ubuntu-1210-amazon-ads-and-data-leaks https://www.eff.org/deeplinks/2012/10/privacy-ubuntu-1210-am...

zamadatix 5y ago

GitHub isn't preventing him from doing what he wants with his code it's just not hosting it for him anymore.

okl 5y ago
Instead of the government, we let corporations repress deviants.
- zamadatix 5y ago
  Deviant or not and corporation or not aren't at play. It'd be the same story if you had a video sharing site and didn't want to host my videos because I broke the "no comedy" rules by uploading a skit.
  - okl 5y ago
    Exactly.
    - zamadatix 5y ago
      Exactly what? The government wasn't involved here so GitHub was allowed to decide what they wanted to host and the author was allowed to do what they want with the code?

Isthatablackgsd 5y ago

> Well fuck them. It's his code, he should be able to do with it whatever he wants. He can do whatever he wants with his codes. It didn't means that private companies have to accept that due to liabilities. He is using an private company platform to publish his code which could make the company liable for him. By removing or suspending his account, the liability will be minimized and shift it to the developer. If the private company keep it in their system and widely available for distribution, other companies that got hit by this malicious code could have a standing to sue the hosting private company for allowing the code to be published. Imagine thousand companies have a lawsuit against the hosting company. So the hosting private company don't want to be liable for this and shutting off the account is their best interest to keep the liability off on them.

okl 5y ago
Not different from Google shutting down someone's account, something that's constantly bemoaned on Hacker News.
- Isthatablackgsd 5y ago
  Did Microsoft completely banned this developer from their other services? To my understanding, the developer account is suspended from GitHub. He is not banned from other MS products. That is the difference. In Google case, Google completely ban on all of their services to those banned users. If they are banned in Gmail, then likely they are banned from Play Store, Workspace, Google Drive, etc (entire Google ecosystem). In this case, Microsoft didn't banned this developers from their other services, it only the developer's GitHub account is suspended without affecting other services that the developers are using.
  - okl 5y ago
    How do you know that when you don't know what else he was using his GitHub account for?