7 ms·

That's exactly backwards. He wasn't granted permission to run code on other people's machines, he granted other people the right to run his code on their machin

by alar44 5y ago

That's exactly backwards. He wasn't granted permission to run code on other people's machines, he granted other people the right to run his code on their machines! Wow!

stickfigure 5y ago
There is a social contract in the world of open source. The author violated it. If he exploited trust to steal private crypto keys, we'd have no trouble calling it an attack. The difference is merely a matter of degree.
- alar44 5y ago
  Merely a matter of degree? There is a chasm between stealing data and printing nonsense to stdout. That's like saying getting all your limbs cut off is technically a flesh wound and the only difference between that and a papercut is the degree of the wound.
  - irfanka 5y ago
    Well... yes. That's exactly what "degree" means.
    - krageon 5y ago
      Yes, but you wouldn't use it in this manner in a good-faith conversation.
- ratg13 5y ago
  This still leaves the elephant in the room: who decides when this line has been crossed?
  - toxik 5y ago
    Intent is what matters, was it meant as an attack - and it kind of was but Joe Developer Schmoe really just got caught in the crossfire of some guy who watched Mr. Robot one time too many. To answer your question directly, I think the jury’s still out and it will depend on the repercussions. So far it seems to have been a nuisance at worst.
  - thirtyseven 5y ago
    I think the organizations that spend tons of money to run the central repositories we all use are a good candidate for that.
    - rakoo 5y ago
      I would have said it's the organization that earn tons of money and don't give a cent to developers if they can avoid it who should think about the structure they have created and profited from and now realize open source doesn't exist in abundance like air.
- zepolen 5y ago
  > There is a social contract in the world of open source. No there isn't. What there is however is the actual contract of the repo (MIT License): THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. Listen, open source is about freedom, and the author is perfectly within his rights to freely change HIS OWN REPO as he wishes. Just as anyone is within his rights to freely FORK THE REPO. This is open source.
  - arcticbull 5y ago
    > This is open source. No, it's not. The idea that you can waive the implied warranty of fitness for a particular purpose covers good faith mistakes or omissions. It doesn't cover intentional misrepresentations or excuse blatant fraud and criminality. For instance, if you sneak in a ransomware package, it's not "all good folks" because "there's no warranty, it's my repo and you can munch on my nuggets." The author offered something to the community on certain terms and made certain representations. The author then decided that they had sellers remorse, and instead of acting like a professional adult who realized they made a poor investment (and finding a new maintainer), they threw a tantrum and decided to try and stick it to "the man" by violating the representations they previously made to the community as a whole. This was petty, petulant and in bad faith. Does it rise to the level of criminality? It might, IANAL though. Nobody's going to go after them because it was more immature than truly harmful.
    - zepolen 5y ago
      You should have been on the internet a couple decades ago, you'd have hated it (and we'd all have laughed at you.)
      - deleted 5y ago
        [deleted]
- Kavelach 5y ago
  At first, I upovted zepolen's comment about there being no social contract, only license, but something bugged me about that, and I felt that I wasn't right. After thinking about it for a while, I think that you are right, there is an implicit social contract when using open source software, and a part of this contract would be to expect the maintaining people to provide the best quality software they can create. But the thing about contracts is that they work between multiple parties, and not just the maintainer(s) and some void. And consumers of the library didn't do their due diligence, that is, supporting the code that they rely on.
  - alar44 5y ago
    - stickfigure 5y ago
      I live in a world in which you get banned from Github, NPM, and possibly other communities for violating that "imaginary" social contract.
      - rakoo 5y ago
        All centralized platforms, with the inherent issues that have been analyzed for decades already. Continuing to use them and complaining of those issues doesn't make any sense at this point.
        stickfigure 5y ago
        Who is complaining? I'm glad this guy got booted out of these (relatively) high-trust societies.
  - ethanwillis 5y ago
    Best quality in what regard and to whom? Software in its purest form is for self expression which is exactly what he is doing. He never explicitly intended this software for commercial usage. And in a non-commercial setting his changes aren't even close to being deemed harmful.
- krageon 5y ago
  > There is a social contract No. You use what they wrote because they allowed you to. It is not then their responsibility what you do with it or how things inconvenience you. It is up to the user to vendor the dependencies and make sure everything works the way it should. > The difference is merely a matter of degree. In the same way that using your front door to break someone's nose on purpose and someone skinning their knee on an unfortunately placed step in your garden is different degrees of assault, sure (i.e. it's not and the only way in which it is is pedantic and not useful).
  - Macha 5y ago
    > No. You use what they wrote because they allowed you to. It is not then their responsibility what you do with it or how things inconvenience you. It is up to the user to vendor the dependencies and make sure everything works the way it should. There is also no obligation for you to use or distribute newer versions, even if you are NPM.

by alar44 5y ago

That's exactly backwards. He wasn't granted permission to run code on other people's machines, he granted other people the right to run his code on their machines! Wow!

stickfigure 5y ago

There is a social contract in the world of open source. The author violated it. If he exploited trust to steal private crypto keys, we'd have no trouble calling it an attack. The difference is merely a matter of degree.

alar44 5y ago
Merely a matter of degree? There is a chasm between stealing data and printing nonsense to stdout. That's like saying getting all your limbs cut off is technically a flesh wound and the only difference between that and a papercut is the degree of the wound.
- irfanka 5y ago
  Well... yes. That's exactly what "degree" means.
  - krageon 5y ago
    Yes, but you wouldn't use it in this manner in a good-faith conversation.
ratg13 5y ago
This still leaves the elephant in the room: who decides when this line has been crossed?
- toxik 5y ago
  Intent is what matters, was it meant as an attack - and it kind of was but Joe Developer Schmoe really just got caught in the crossfire of some guy who watched Mr. Robot one time too many. To answer your question directly, I think the jury’s still out and it will depend on the repercussions. So far it seems to have been a nuisance at worst.
- thirtyseven 5y ago
  I think the organizations that spend tons of money to run the central repositories we all use are a good candidate for that.
  - rakoo 5y ago
    I would have said it's the organization that earn tons of money and don't give a cent to developers if they can avoid it who should think about the structure they have created and profited from and now realize open source doesn't exist in abundance like air.
zepolen 5y ago
> There is a social contract in the world of open source. No there isn't. What there is however is the actual contract of the repo (MIT License): THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. Listen, open source is about freedom, and the author is perfectly within his rights to freely change HIS OWN REPO as he wishes. Just as anyone is within his rights to freely FORK THE REPO. This is open source.
- arcticbull 5y ago
  > This is open source. No, it's not. The idea that you can waive the implied warranty of fitness for a particular purpose covers good faith mistakes or omissions. It doesn't cover intentional misrepresentations or excuse blatant fraud and criminality. For instance, if you sneak in a ransomware package, it's not "all good folks" because "there's no warranty, it's my repo and you can munch on my nuggets." The author offered something to the community on certain terms and made certain representations. The author then decided that they had sellers remorse, and instead of acting like a professional adult who realized they made a poor investment (and finding a new maintainer), they threw a tantrum and decided to try and stick it to "the man" by violating the representations they previously made to the community as a whole. This was petty, petulant and in bad faith. Does it rise to the level of criminality? It might, IANAL though. Nobody's going to go after them because it was more immature than truly harmful.
  - zepolen 5y ago
    You should have been on the internet a couple decades ago, you'd have hated it (and we'd all have laughed at you.)
    - deleted 5y ago
      [deleted]
Kavelach 5y ago
At first, I upovted zepolen's comment about there being no social contract, only license, but something bugged me about that, and I felt that I wasn't right. After thinking about it for a while, I think that you are right, there is an implicit social contract when using open source software, and a part of this contract would be to expect the maintaining people to provide the best quality software they can create. But the thing about contracts is that they work between multiple parties, and not just the maintainer(s) and some void. And consumers of the library didn't do their due diligence, that is, supporting the code that they rely on.
- alar44 5y ago
  - stickfigure 5y ago
    I live in a world in which you get banned from Github, NPM, and possibly other communities for violating that "imaginary" social contract.
    - rakoo 5y ago
      All centralized platforms, with the inherent issues that have been analyzed for decades already. Continuing to use them and complaining of those issues doesn't make any sense at this point.
      - stickfigure 5y ago
        Who is complaining? I'm glad this guy got booted out of these (relatively) high-trust societies.
- ethanwillis 5y ago
  Best quality in what regard and to whom? Software in its purest form is for self expression which is exactly what he is doing. He never explicitly intended this software for commercial usage. And in a non-commercial setting his changes aren't even close to being deemed harmful.
krageon 5y ago
> There is a social contract No. You use what they wrote because they allowed you to. It is not then their responsibility what you do with it or how things inconvenience you. It is up to the user to vendor the dependencies and make sure everything works the way it should. > The difference is merely a matter of degree. In the same way that using your front door to break someone's nose on purpose and someone skinning their knee on an unfortunately placed step in your garden is different degrees of assault, sure (i.e. it's not and the only way in which it is is pedantic and not useful).
- Macha 5y ago
  > No. You use what they wrote because they allowed you to. It is not then their responsibility what you do with it or how things inconvenience you. It is up to the user to vendor the dependencies and make sure everything works the way it should. There is also no obligation for you to use or distribute newer versions, even if you are NPM.