3 ms·

>>I think you’re being far too kind in your interpretation. If one wishes to stop maintaining, all you must do is nothing. This sounds like a gross misrepresen

by fivea 5y ago

>>I think you’re being far too kind in your interpretation. If one wishes to stop maintaining, all you must do is nothing. This sounds like a gross misrepresentation of what happened. It has been reported that the author of the colors and faker packages announced last year that he was no longer willing to do free work for Fortune500 companies. He also proceeded to state quite publicly that either companies paid him for his work, or they should fork the project and maintain it themselves instead of taking advantage of everyone else's work. After a year has passed, the author proceeded to release a couple of major versions that had a more artistic feel. https://web.archive.org/web/20210704022108/https://github.com/Marak/faker.js/issues/1046 https://web.archive.org/web/20210704022108/https://github.co... Source: https://www.theverge.com/2022/1/9/22874949/developer-corrupts-open-source-libraries-projects-affected https://www.theverge.com/2022/1/9/22874949/developer-corrupt... These packages are his circus, and his clowns run the act he chooses. If anything, this update showcases the completely abhorrent security culture in place in these mega-companies, which literally ingest into their product line anything that they can find on GitHub without a shred of due diligence.

acdha 5y ago
> After a year has passed, the author proceeded to release a couple of major versions that had a more artistic feel. Artistic would be a new color scheme or maybe a “support open source maintainers” message. The accurate description you didn't give is sabotage because he introduced an infinite loop: https://github.com/Marak/colors.js/commit/074a0f8ed0c31c35d13d28632bd8a049ff136fb6#diff-92bbac9a308cd5fcf9db165841f2d90ce981baddcb2b1e26cfff170929af3bd1R18 https://github.com/Marak/colors.js/commit/074a0f8ed0c31c35d1...
- jamesfinlayson 5y ago
  Not to mention plenty of people (me at a big company included) used both of these packages as indirectly (as dependencies of dependencies) and had no idea about this until this week.
- fivea 5y ago
  > Artistic would be a new color scheme or maybe a “support open source maintainers” message. The author already did that, and complained about fortune500 companies mooching their work without giving anything in return. The author stated that people should fork the repo if they intended to keep using it. The author made said statements a year ago. Is a year enough time to take action? Now the author decided to do a major version release with a protest version of his own work, and that makes him a villain?
  - acdha 5y ago
    > Now the author decided to do a major version release with a protest version of his own work, and that makes him a villain? He did more than that, as noted in the comment you replied to.
    - fivea 5y ago
      > He did more than that, as noted in the comment you replied to. He really didn't. It matters nothing if you feel a commit breaks your code because you not only ignored the author but also failed to perform any sort of due diligence regarding what dependencies you ingest. I mean, it was a major version bump. People blindly upgrade stuff without any regard about what goes in, and somehow that makes the guy who volunteered his work on a side project a villain? There are a lot of red flags in this story, but the author of the colors flag ain't one of it.
      - acdha 5y ago
        I see you've switched from “he didn't break anything” to “it's the users' fault for not catching what he broke faster”. Hint: going from 1.4.0 to 1.4.1 is not a major version bump — https://snyk.io/vuln/npm:colors https://snyk.io/vuln/npm:colors

by fivea 5y ago

acdha 5y ago

> After a year has passed, the author proceeded to release a couple of major versions that had a more artistic feel. Artistic would be a new color scheme or maybe a “support open source maintainers” message. The accurate description you didn't give is sabotage because he introduced an infinite loop: https://github.com/Marak/colors.js/commit/074a0f8ed0c31c35d13d28632bd8a049ff136fb6#diff-92bbac9a308cd5fcf9db165841f2d90ce981baddcb2b1e26cfff170929af3bd1R18 https://github.com/Marak/colors.js/commit/074a0f8ed0c31c35d1...

jamesfinlayson 5y ago
Not to mention plenty of people (me at a big company included) used both of these packages as indirectly (as dependencies of dependencies) and had no idea about this until this week.
fivea 5y ago
> Artistic would be a new color scheme or maybe a “support open source maintainers” message. The author already did that, and complained about fortune500 companies mooching their work without giving anything in return. The author stated that people should fork the repo if they intended to keep using it. The author made said statements a year ago. Is a year enough time to take action? Now the author decided to do a major version release with a protest version of his own work, and that makes him a villain?
- acdha 5y ago
  > Now the author decided to do a major version release with a protest version of his own work, and that makes him a villain? He did more than that, as noted in the comment you replied to.
  - fivea 5y ago
    > He did more than that, as noted in the comment you replied to. He really didn't. It matters nothing if you feel a commit breaks your code because you not only ignored the author but also failed to perform any sort of due diligence regarding what dependencies you ingest. I mean, it was a major version bump. People blindly upgrade stuff without any regard about what goes in, and somehow that makes the guy who volunteered his work on a side project a villain? There are a lot of red flags in this story, but the author of the colors flag ain't one of it.
    - acdha 5y ago
      I see you've switched from “he didn't break anything” to “it's the users' fault for not catching what he broke faster”. Hint: going from 1.4.0 to 1.4.1 is not a major version bump — https://snyk.io/vuln/npm:colors https://snyk.io/vuln/npm:colors