3 ms·

If I voluntarily share my lunch with someone at work, I can't poison it even though they got free food. Even if someone at work is stealing my lunch, I can't po

If I voluntarily share my lunch with someone at work, I can't poison it even though they got free food. Even if someone at work is stealing my lunch, I can't poison it. We have a right to basic safety even in situations we aren't paying for things. That extends to the digital world. You can't put malware in your open-source project without a giant disclaimer "THIS IS MALWARE. USE ONLY FOR RESEARCH PURPOSES" or something like that

phkahler 5y ago
>> . That extends to the digital world. You can't put malware in your open-source project without a giant disclaimer "THIS IS MALWARE. USE ONLY FOR RESEARCH PURPOSES" or something like that sourceforge?
torstenvl 5y ago
My understanding is that he wasn't voluntarily sharing it. In November he pretty clearly told people to fork his code and move off his repository, and not to rely on his packages anymore. He used a graphic clearly warning of an impending "strike." GitHub Post: https://archive.fo/9fwGz https://archive.fo/9fwGz HN Discussion: https://news.ycombinator.com/item?id=25032105&p=2 https://news.ycombinator.com/item?id=25032105&p=2 That doesn't make it not a dick move. But let's not pretend they still had permission to remote load directly from his repo. If I own a personal storage facility and I decide to demolish it, and I say months in advance for everyone to take their stuff out and store it somewhere else, and then I demolish it and people lose their property... the harmed individuals are not faultless. Would the professional and responsible thing to do be to announce a cut-off date explicitly and make very clear that Bad Things were going to happen if you didn't stop relying on him? Yes, 100%, and I have a low opinion of him for not doing so. However, while what he did was bad, it isn't quite as bad, in my opinion, as people are making it out to be.
salawat 5y ago
You do not have a right to basic safety when you divest yourself of basic precautions any reasonable actor would have taken. A reasonable actor checks new code pulled down to ensure it actually works. You accept the risk integrating in a stranger's code without mirroring/audit.
- wtallis 5y ago
  The legal profession tends to take a more permissive stance when determining the limits of what's "reasonable", as can be seen from how the phrase "moron in a hurry" has become a term of art.

phkahler 5y ago

>> . That extends to the digital world. You can't put malware in your open-source project without a giant disclaimer "THIS IS MALWARE. USE ONLY FOR RESEARCH PURPOSES" or something like that sourceforge?

torstenvl 5y ago

My understanding is that he wasn't voluntarily sharing it. In November he pretty clearly told people to fork his code and move off his repository, and not to rely on his packages anymore. He used a graphic clearly warning of an impending "strike." GitHub Post: https://archive.fo/9fwGz https://archive.fo/9fwGz HN Discussion: https://news.ycombinator.com/item?id=25032105&p=2 https://news.ycombinator.com/item?id=25032105&p=2 That doesn't make it not a dick move. But let's not pretend they still had permission to remote load directly from his repo. If I own a personal storage facility and I decide to demolish it, and I say months in advance for everyone to take their stuff out and store it somewhere else, and then I demolish it and people lose their property... the harmed individuals are not faultless. Would the professional and responsible thing to do be to announce a cut-off date explicitly and make very clear that Bad Things were going to happen if you didn't stop relying on him? Yes, 100%, and I have a low opinion of him for not doing so. However, while what he did was bad, it isn't quite as bad, in my opinion, as people are making it out to be.

salawat 5y ago

You do not have a right to basic safety when you divest yourself of basic precautions any reasonable actor would have taken. A reasonable actor checks new code pulled down to ensure it actually works. You accept the risk integrating in a stranger's code without mirroring/audit.

wtallis 5y ago
The legal profession tends to take a more permissive stance when determining the limits of what's "reasonable", as can be seen from how the phrase "moron in a hurry" has become a term of art.