5 ms·

In what world is it not malicious? He owned the packages and I guess that gives him the right to do what he likes with it, but I have a hard time believing he d

In what world is it not malicious? He owned the packages and I guess that gives him the right to do what he likes with it, but I have a hard time believing he didn't do it deliberately fully aware that a whole bunch of people would update and it would cause disruption. It's not an exploit, but it's certainly malicious, and I don't think it's unreasonable to call it an attack.

no_wizard 5y ago
Sure did, however, does that mean its malicious? The definition of malicious, according to Merriam Webster[0], is the following >having or showing a desire to cause harm to someone : given to, marked by, or arising from malice Was the intention here to cause someone harm? What the intention here malice? Which conversely has this definition[1] >desire to cause pain, injury, or distress to another Was this their primary motivation? What evidence do we have that is in fact an action driven by malice? In fact, I don't see any, especially after doing roughly 20 minutes of research, I have arrived at the following: Reading the public history surrounding the maintainer of these projects, the issue trackers of the repositories, and the maintainers own blog, you may come from a different conclusion entirely. If I was to speculate - and mind you, I am speculating, as I don't know the maintainer personally nor do I claim to understand them completely - there is a clear sense of mental strain they are feeling from the burdens here. Being burnt out, feeling taken advantage of, can lead to very real and deep feels of depression and/or other mental challenges (this I speak first hand to), for starters. I think the maintainer - again, speculating here, however evidence does seem to suggest this - is acting from a place of disillusionment, and possibly is resentful of their status in the word, relative to those benefiting from their contributions to open source software. Are they right to feel this way? Maybe, maybe not. However, is this malice? That's the question. Is this actually malicious? All evidence points to no, its not an act of malice. Its an act of someone who is disillusioned, strained, and struggling. I think the most reasonable interpretation given all the evidence is that they are trying to raise some kind of awareness - albeit in ways that I don't think is well communicated, due to the issues I previously highlighted - most likely. I could be wrong, I'm just following the publicly available evidence and, its a lot more murky than this is an malicious act by a malicious maintainer acting in malice. And again, this brings up the broader issue around open source maintainability, longevity, the role of consumer and maintainer, and how to build better symbiotic relationships around that, yet we aren't talking about what lead to this event, which I would argue is more important than what happened. My ask is for nuance in this conversation, where there is seemingly little. [0]: https://www.merriam-webster.com/dictionary/malicious https://www.merriam-webster.com/dictionary/malicious [1]: https://www.merriam-webster.com/dictionary/malice https://www.merriam-webster.com/dictionary/malice
- slibhb 5y ago
  Pushing broken code on purpose is malicious.
  - deleted 5y ago
    [deleted]
- Shaanie 5y ago
  You write a lot of words to explain how the maintainer could justify his malice. At the end of the day it's still done out of malice, though. Unless he's gone absolutely bonkers, he's doing this to intentionally cause damage. The reason for it does not matter, as the definition you posted helpfully points out.
  - no_wizard 5y ago
    Is it though? Was it malice when maintainers started adding those posinstall scripts asking for funding? which lead directly to the creation of `npm fund`, for instance. Was that also malice? Given all the evidence we have - I think its murky. That's my point, at the end of the day. Arguably, I could say that making millions of dollars off an open source library and not contributing back is malice - yet that argument is rarely given the same open and shut approval. Mind you, this is bigger, IMO, than `faker.js`, this raises questions around open source software as a whole, that are relevant in this case and beyond There's nuance in this conversation that is missing so far.
    - FunHearing3443 5y ago
      I keep seeing this comment that companies are making their millions 'off of open source libraries' and it's a catchy phrase but let's be real the big companies that are using faker JS are making an insignificant amount extra by using that library, there are alternatives to mock data, etc. A key feature of MIT style licenses is that you can do whatever the hell you want with it for free, use a more restrictive license if you don't want people making a bunch of money off your code. I feel bad for this maintainer but a good takeaway is probably to not do a bunch of work for free unless you see a path to income down the road from it.
foobiekr 5y ago
People who were pulling this unvetted and live are lucky he did not sell it to a malware group.
- UnFleshedOne 5y ago
  Malice or selling out is not even required. Malware groups are perfectly capable of getting access to maintainer credentials themselves if needed.
  - foobiekr 5y ago
    Yes, I agree.

no_wizard 5y ago

Sure did, however, does that mean its malicious? The definition of malicious, according to Merriam Webster[0], is the following >having or showing a desire to cause harm to someone : given to, marked by, or arising from malice Was the intention here to cause someone harm? What the intention here malice? Which conversely has this definition[1] >desire to cause pain, injury, or distress to another Was this their primary motivation? What evidence do we have that is in fact an action driven by malice? In fact, I don't see any, especially after doing roughly 20 minutes of research, I have arrived at the following: Reading the public history surrounding the maintainer of these projects, the issue trackers of the repositories, and the maintainers own blog, you may come from a different conclusion entirely. If I was to speculate - and mind you, I am speculating, as I don't know the maintainer personally nor do I claim to understand them completely - there is a clear sense of mental strain they are feeling from the burdens here. Being burnt out, feeling taken advantage of, can lead to very real and deep feels of depression and/or other mental challenges (this I speak first hand to), for starters. I think the maintainer - again, speculating here, however evidence does seem to suggest this - is acting from a place of disillusionment, and possibly is resentful of their status in the word, relative to those benefiting from their contributions to open source software. Are they right to feel this way? Maybe, maybe not. However, is this malice? That's the question. Is this actually malicious? All evidence points to no, its not an act of malice. Its an act of someone who is disillusioned, strained, and struggling. I think the most reasonable interpretation given all the evidence is that they are trying to raise some kind of awareness - albeit in ways that I don't think is well communicated, due to the issues I previously highlighted - most likely. I could be wrong, I'm just following the publicly available evidence and, its a lot more murky than this is an malicious act by a malicious maintainer acting in malice. And again, this brings up the broader issue around open source maintainability, longevity, the role of consumer and maintainer, and how to build better symbiotic relationships around that, yet we aren't talking about what lead to this event, which I would argue is more important than what happened. My ask is for nuance in this conversation, where there is seemingly little. [0]: https://www.merriam-webster.com/dictionary/malicious https://www.merriam-webster.com/dictionary/malicious [1]: https://www.merriam-webster.com/dictionary/malice https://www.merriam-webster.com/dictionary/malice

slibhb 5y ago
Pushing broken code on purpose is malicious.
- deleted 5y ago
  [deleted]
Shaanie 5y ago
You write a lot of words to explain how the maintainer could justify his malice. At the end of the day it's still done out of malice, though. Unless he's gone absolutely bonkers, he's doing this to intentionally cause damage. The reason for it does not matter, as the definition you posted helpfully points out.
- no_wizard 5y ago
  Is it though? Was it malice when maintainers started adding those posinstall scripts asking for funding? which lead directly to the creation of `npm fund`, for instance. Was that also malice? Given all the evidence we have - I think its murky. That's my point, at the end of the day. Arguably, I could say that making millions of dollars off an open source library and not contributing back is malice - yet that argument is rarely given the same open and shut approval. Mind you, this is bigger, IMO, than `faker.js`, this raises questions around open source software as a whole, that are relevant in this case and beyond There's nuance in this conversation that is missing so far.
  - FunHearing3443 5y ago
    I keep seeing this comment that companies are making their millions 'off of open source libraries' and it's a catchy phrase but let's be real the big companies that are using faker JS are making an insignificant amount extra by using that library, there are alternatives to mock data, etc. A key feature of MIT style licenses is that you can do whatever the hell you want with it for free, use a more restrictive license if you don't want people making a bunch of money off your code. I feel bad for this maintainer but a good takeaway is probably to not do a bunch of work for free unless you see a path to income down the road from it.

foobiekr 5y ago

People who were pulling this unvetted and live are lucky he did not sell it to a malware group.

UnFleshedOne 5y ago
Malice or selling out is not even required. Malware groups are perfectly capable of getting access to maintainer credentials themselves if needed.
- foobiekr 5y ago
  Yes, I agree.