17 ms·

It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. This was his own corner of the internet

It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. This was his own corner of the internet for him to publish his own personal projects. I understand the decision for npm to take ownership of his packages, because npm is a community package repository owned by, and for, the community. All community package repositories have some sort of policy for package takeovers. But GitHub claims to be your home for public hosting of your own personal code. What GitHub policy did he violate? The really outrageous thing is that the developer going "rogue" was actually him expressing his freedom of speech, again on his own personal GitHub account, in his own personal (not organization) repositories. He spoke about his thoughts about open source, businesses, and economics. Defending this type of political speech is especially important and GitHub banning his account and censoring this type of speech(whether you agree with it or not) is especially shameful.

jrochkind1 5y ago
I didn't know about this before, is there a link for context?
PragmaticPulp 5y ago
> It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. He's not banned: https://github.com/Marak https://github.com/Marak You have to keep in mind that his changes were basically indistinguishable from a security breach of his account. Nobody really sabotages their own repos in a malicious manner like this. Suspending his account while they investigated doesn't seem like a stretch. > This was his own corner of the internet for him to publish his own personal projects. Which he's still free to do. But the actions in question had nothing to do with his "personal projects". It was specifically about his actions to intentionally break popular Node.js packages and do so with a version number that would disguise the change as a non-breaking update. It was a malicious act, and there's no way to paint it as anything else.
- nightpool 5y ago
  It was a malicious act to the users of his project, sure. But how was it a malicious act to GitHub? I'm glad to hear that they reversed the suspension, but without understanding why it was suspended in the first place, it leaves open the question of what GitHub's motives were in the whole situation. If DHH decided that Rails was contributing more harm to the world then good, and tried to remove it from GitHub, would GitHub lock his account and restore his repos "on behalf of the community", to side with the smooth operation of the open source ecosystem over a user's personal decisions? To what extent has GitHub decided that they "know best" for the open source community?
  - manquer 5y ago
    It was malicious act to Github's users. Github first responsibility comes to the community of users it supports, then to any individual user. Free speech/ personal choice / Freedom of expression come secondary to the welfare of its users. Is it a slippery slope ? Yes, but Github does not have a choice if it cared about the interest its community
    - viraptor 5y ago
      > It was malicious act to Github's users. I'm not sure why it matters they are Github users. The packages were hosted on npm through Cloudflare - does that allow Cloudflare to take over the packages too? And NS1 since they host the fakerjs domain?
      - labster 5y ago
        It’s cool that you’re internet rules-lawyering and all but ultimately he used his free account with intent to harm others, just as surely as if he backdoored his code. Freedom of speech is good, and protest is fine, but why would GitHub amplify the speech of a nutso who abused his position of trust?
        smoldesu 5y ago
nightpool 5y ago
Yes, I'm also curious about GitHub's justification for this. It feels like they should have made some sort of statement about why the account was suspended, for the sake of transparency in such a large controversy. It's perfectly imaginable that Marak used his GitHub account to spam/harass other projects, or engage in some other type of speech that went against GitHub's guidelines, but there needs to be more clarity so that this doesn't seem like a case of "You annoyed me, so you're gone". As you said, it really can give the appearance of GitHub siding with the commercial use of open source for their own self-interest, even if I have enough trust in GitHub to know that that's probably not what they intended to do. EDIT: I'm glad to hear from a sibling comment that GitHub has since unsuspended his account, since TFA and this comment made me think he was still suspended. Still, it feels like a misstep for GitHub not to have made some sort of comment here.
chillfox 5y ago
I get what you are saying, but I feel like this applies: Not your domain/site, not your corner of the internet.
- zbrozek 5y ago
  Is domain enough? I doubt it. You probably also need your own server in your own rack in your own building with your own peering to other networks. Once you've done all of that, you can probably credibly keep your site up counter to corporate interests.
  - shadowgovt 5y ago
    As a network, the internet will tend to favor the interests of large groups acting coherently. Sometimes we call those "corporations." But yes; control online is a two-way street because it's a communications network and it always takes at least two to communicate.
  - chillfox 5y ago
    Well, if you have your own domain then you can at least move it around between providers. But yeah, if you are doing anything truly unpopular then I don't think there's much you can do to stay online.
elia_is_me 5y ago
your GitHub account is not yours but GitHub's property, they just do not claim that before they ban your account. All cloud services do the similar things.
- scrollaway 5y ago
  This isn’t how it works at all. It’s not how copyright law works, it’s not how property law works, and it’s certainly not how cloud services work. What isn’t yours is your “right” to use the service.
  - feupan 5y ago
    Have you read the project’s license? That is literally how it works. It’s not even an original project by Marak, as it’s clearly shown in there. The only fault here is cutting the owner out of the repo, but given the security breach it’s strange that he isn’t permanently banned at all. And yeah, adding an infinite loop is a DoS attack. > not how cloud services work. Try placing a virus on S3 and let me know how that works out.
    - fault1 5y ago
      not to mention that in the case of colors.js he actually owned less copyright than other contributors. they had actually changed more of the code.
    - scrollaway 5y ago
      I’m not defending the author. GitHub is in their right to do what they did. But certainly not because of the nonsense GP claims. And yes you can host viruses on S3. What you can’t do is use Amazon’s network to do illegal shit (such as distribute viruses without consent).
      - feupan 5y ago
        Obviously I mean to distribute viruses via S3, which is what’s happening here. Your account is guaranteed to be flagged as soon as they find out. The update here was distributed to every subscriber.
goodoldneon 5y ago
Freedom of speech doesn’t mean you can do whatever you want on someone else’s server. The project was hosted on GitHub, so GitHub can take significant action to protect the community. He can host his project elsewhere if he doesn’t agree with GitHub’s actions
- Aerroon 5y ago
  What about somebody else's internet connection? If we apply the same logic to ISPs then the future of the internet would look quite bleak.
  - BoysenberryPi 5y ago
    Whether you agree or disagree with it, ISPs have the right to fire you as a customer. However, I don't usually see that exercising that right unless it's for piracy.
  - bawolff 5y ago
    If we applied your logic everywhere, moderation wouldn't be allowed. That also seems pretty bleak.
  - dsego 5y ago
    https://en.wikipedia.org/wiki/Net_neutrality https://en.wikipedia.org/wiki/Net_neutrality
  - goodoldneon 5y ago
    I think ISPs should be a utility, but I don’t think git websites should
- Miner49er 5y ago
  Of course, no one is saying GitHub wasn't allowed to do what they did. What people are saying is GitHub shouldn't have done that.
smt88 5y ago
> It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. HN, at least, had a ton of discussion on this[1]. People advocated both ways. > This was his own corner of the internet for him to publish his own personal projects. No, it wasn't. It was Github's corner of the internet and then it was Microsoft's. If he just wanted a place to publish his personal projects, he could have put them on a personal, self-hosted website. By putting them on a social network, like Github, he is submitting to their whims. He doesn't have any legal right to stay on that site if they want to kick him off of it. He also wasn't the only author. Other people contributed to his repos. He was happy to receive the benefits of Github, and he should also realize that it comes with some loss of control. Notably, he eventually used Github as a platform to deploy a Trojan to thousands of unsuspecting users. The other circumstances don't matter. Microsoft can and should remove Trojans from Github. 1. https://news.ycombinator.com/item?id=29877745 https://news.ycombinator.com/item?id=29877745
- young_unixer 5y ago
  > By putting them on a social network, like Github, he is submitting to their whims. He doesn't have any legal right to stay on that site if they want to kick him off of it. Of course, legally speaking, Github can do whatever they want with their website, but we're not talking about the legal aspect. The developer community has put some trust on Github not to do whatever they want. It's an implicit, non-legal, non-enforceable, social agreement that Github is going to "respect" our user accounts on their platform as long as we don't break the TOS. They could delete all existing repositories tomorrow, and replace them with pornographic images, and they would probably be in their legal right, but that doesn't mean that we can't critizice them for it.
  - shadowgovt 5y ago
    FWIW, GitHub's actions here have in no way damaged my trust in them. They interpreted a developer's attempt to harm the community via abuse of the trust the community had placed in him as damage and mitigated it in the short run. That's a value-add.
ren_engineer 5y ago
he did it to protest billion dollar tech companies making money off open source, which is Github's entire business model. His protest was an existential threat to them so of course they are going to crack down
- PeterisP 5y ago
  I believe that none of the billion dollar tech companies were affected by this in any way as they tend to have proper process in place for managing dependencies, the only ones who suffered were small developers and other open source projects which have limited manpower and just pull in updated versions without verifying them. Saying that this is an "existential threat" is ridiculous - megacorps can and do have procedures that won't be bothered much even if you'd have a case like that every single day. Whatever his intentions were, acts like this threaten the open source community, but do not actually threaten the big companies at all.
- junon 5y ago
  This is such a bad take I don't even know where to begin. Please, read up on FOSS licenses and check which one colors.js uses. That's just the first of about five flaws with your argument.
perihelions 5y ago
>"The really outrageous thing is that the developer going "rogue" was actually him expressing his freedom of speech, again on his own personal GitHub account, in his own personal (not organization) repositories. He spoke about his thoughts about open source, businesses, and economics. Defending this type of political speech is especially important and GitHub banning his account and censoring this type of speech(whether you agree with it or not) is especially shameful." This Tuesday is the 10-year anniversary of the SOPA/PIPA blackout [0,1]. Half of the tech internet crippled their own functionality for a day, in an act of political speech. (Was GitHub part of that?) Tech culture has surely changed since then! [0] https://en.wikipedia.org/wiki/Protests_against_SOPA_and_PIPA https://en.wikipedia.org/wiki/Protests_against_SOPA_and_PIPA [1] https://hn.algolia.com/?q=sopa https://hn.algolia.com/?q=sopa
- pikelet 5y ago
  He wasn't crippling his own functionality though, he was deliberately crippling the functionality of everyone who trusted him.
hn_throwaway_99 5y ago
I am completely baffled by folks defending Marak, or putting any sort of blame on GitHub. What Marak did was not "political speech". If he wanted to, he could have easily done any of the following: 1. Pulled down his repo, or replace his repo by whatever message he wanted to send. 2. Output his political message during the build. 3. Heck, all faker.js does is output fake data for things like names and addresses. I think he would have been well within his rights to make this data something like "123 Fascist Way, Fascistville, NY". But he didn't. He replaced his code with an infinite loop that was a DoS attack. He deliberately released it as a patch version because he knew it would be pulled in by others that follow semver rules. The fact that his attack wasn't more severe (like, say, encrypting someone's hard drive) doesn't mean it wasn't an actual attack. And for those quoting the "no express or implied warranty" section of the license, I guarantee no legal system is going to let an actual malicious act be defended by a license.
- Handytinge 5y ago
  > I am completely baffled by folks defending Marak... > I think he would have been well within his rights to... I think this is the crux of it all. I (and many others it seems) disagree with the actions he took and think they're shitty, but also think he has a right to do this with his code that he provides and publishes for free.
- starwind 5y ago
  Correct. You basically never have the right to commit sabotage
  - z3ncyberpunk 5y ago
    Except that it was his code, and it's open source therefore the risk of using said code is your own. It's his project, He's under no obligation to maintain it in a functional state or at all just because you happen to use it. That's just egotistical and narcissistic on your part
    - starwind 5y ago
deleted 5y ago
[deleted]
dvhh 5y ago
The fact that the conversation is happening at all is a sign that GitHub reputation is damaged. As anyone would point out they are certainly within their rights to terminate any account for any reason. But certainly not beyond repair (as injecting adware in your package). Also it is certainly a reminder for everyone that GitHub should not be treated as an archive of your code, and more like a collaboration space.
- junon 5y ago
  I don't like GitHub much but their handling of this situation actually won points for me.
mpyne 5y ago
> But GitHub claims to be your home for public hosting of your own personal code. Github claims to be a home for developers to publicly host code of public use. Any benefit to an individual developer is incident to that overriding purpose and they are clear about that in their use policies. > What GitHub policy did he violate? https://docs.github.com/en/github/site-policy/github-acceptable-use-policies https://docs.github.com/en/github/site-policy/github-accepta... gives their acceptable use policies. I think they could easily make claims on any or all of sections 2, 3, 4 and 10. Section 10 in particular notes that Github is a service run for a mass of users and will favor users as a whole over individual privileges. > expressing his freedom of speech, again on his own personal GitHub account, in his own personal (not organization) repositories. Was he running his own Github server instance and I missed it somehow? The flipside to Github paying to run your git repo, issue tracker, etc. is that you agree to abide by their terms of use, and these terms are written for Github's benefit. If a million Github users are impacted by this package breaking their code then why are you surprised that Github took action to protect their users? Marak could have hosted his own git repo if he wanted to ensure his malicious code couldn't be intercepted by others. That's the tradeoff you have to choose. > He spoke about his thoughts about open source, businesses, and economics. Defending this type of political speech [snip] Inserting infinite loops into packages isn't "political speech" and trying to claim as such just waters down the entire argument...
junon 5y ago
Chalk maintainer here. I said before I wouldn't comment on Marak but I don't want to stand by and watch him profit from this like he is, monetarily or otherwise, nor should GitHub receive ANY hate for their actions. He's not banned. It was most likely an initial response to a suspected compromised account situation. Once they determined the actions were carried out by the account holder, they reinstated it. There are MANY reasons to be annoyed with GitHub but this isn't one of them. Github's actions here helped, not hurt. I would hope they'd suspend my account if they too thought it was compromised and pushing out malicious updates to packages. The security of users is of the utmost importance. Marak needs professional medical help. It is clear he's having a mental break and the people defending him and egging him on are only making things worse. He has a history of erratic behavior (dating back to almost a decade ago) and needs to find healing, not accolades. Since this whole fiasco, Marak has garnered loads of followers and has increased his sponsor count dramatically. We should not be rewarding this behavior. If you at all dig into this, you'll find not a stable, perhaps loud individual, but a troubled, erratic, unpredictable, and hurting one. He is not martyr. He's not a patriot or a revolutionist. He's an abuser, potential "freedom fighter", malicious OSS maintainer and a beggar. Please. Let's end this and not give any more attention to Marak. He needs help, and we're all collectively making things worse.
- anhner 5y ago
  Thank you for stepping up and commenting on this.
- kekkidy 5y ago
  maybe community should claim his personal account and get hold of those sponsors as well. in order to help marak and the whole community of course.
  - junon 5y ago
    This is a bad faith argument and a complete misinterpretation of what it is I've said.
numbchild 5y ago
Unbelievable that now almost all people is discussing "how" marak's action caused results. Not try to figure out "why" this happens. Just like seeing something wrong, and discuss it. DO NOTHING!! CHANGE NOTHING. ALL meanless. unless you figure out all stuff, change something. What I do? I think GitHub is wrong, so I take action, delete all repos on GitHub. F*K it, that what I do. At least I have an action. So what you did? Talking is cheap.
- numbchild 5y ago
  It takes long time to delete them all! I don't like GitHub, so I delete my repos. Is there any problem? I can manage my repos, of course Marak can too. https://twitter.com/numbchild/status/1482625168032022532 https://twitter.com/numbchild/status/1482625168032022532

jrochkind1 5y ago

I didn't know about this before, is there a link for context?

PragmaticPulp 5y ago

> It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. He's not banned: https://github.com/Marak https://github.com/Marak You have to keep in mind that his changes were basically indistinguishable from a security breach of his account. Nobody really sabotages their own repos in a malicious manner like this. Suspending his account while they investigated doesn't seem like a stretch. > This was his own corner of the internet for him to publish his own personal projects. Which he's still free to do. But the actions in question had nothing to do with his "personal projects". It was specifically about his actions to intentionally break popular Node.js packages and do so with a version number that would disguise the change as a non-breaking update. It was a malicious act, and there's no way to paint it as anything else.

nightpool 5y ago
It was a malicious act to the users of his project, sure. But how was it a malicious act to GitHub? I'm glad to hear that they reversed the suspension, but without understanding why it was suspended in the first place, it leaves open the question of what GitHub's motives were in the whole situation. If DHH decided that Rails was contributing more harm to the world then good, and tried to remove it from GitHub, would GitHub lock his account and restore his repos "on behalf of the community", to side with the smooth operation of the open source ecosystem over a user's personal decisions? To what extent has GitHub decided that they "know best" for the open source community?
- manquer 5y ago
  It was malicious act to Github's users. Github first responsibility comes to the community of users it supports, then to any individual user. Free speech/ personal choice / Freedom of expression come secondary to the welfare of its users. Is it a slippery slope ? Yes, but Github does not have a choice if it cared about the interest its community
  - viraptor 5y ago
    > It was malicious act to Github's users. I'm not sure why it matters they are Github users. The packages were hosted on npm through Cloudflare - does that allow Cloudflare to take over the packages too? And NS1 since they host the fakerjs domain?
    - labster 5y ago
      It’s cool that you’re internet rules-lawyering and all but ultimately he used his free account with intent to harm others, just as surely as if he backdoored his code. Freedom of speech is good, and protest is fine, but why would GitHub amplify the speech of a nutso who abused his position of trust?
      - smoldesu 5y ago

nightpool 5y ago

Yes, I'm also curious about GitHub's justification for this. It feels like they should have made some sort of statement about why the account was suspended, for the sake of transparency in such a large controversy. It's perfectly imaginable that Marak used his GitHub account to spam/harass other projects, or engage in some other type of speech that went against GitHub's guidelines, but there needs to be more clarity so that this doesn't seem like a case of "You annoyed me, so you're gone". As you said, it really can give the appearance of GitHub siding with the commercial use of open source for their own self-interest, even if I have enough trust in GitHub to know that that's probably not what they intended to do. EDIT: I'm glad to hear from a sibling comment that GitHub has since unsuspended his account, since TFA and this comment made me think he was still suspended. Still, it feels like a misstep for GitHub not to have made some sort of comment here.

chillfox 5y ago

I get what you are saying, but I feel like this applies: Not your domain/site, not your corner of the internet.

zbrozek 5y ago
Is domain enough? I doubt it. You probably also need your own server in your own rack in your own building with your own peering to other networks. Once you've done all of that, you can probably credibly keep your site up counter to corporate interests.
- shadowgovt 5y ago
  As a network, the internet will tend to favor the interests of large groups acting coherently. Sometimes we call those "corporations." But yes; control online is a two-way street because it's a communications network and it always takes at least two to communicate.
- chillfox 5y ago
  Well, if you have your own domain then you can at least move it around between providers. But yeah, if you are doing anything truly unpopular then I don't think there's much you can do to stay online.

elia_is_me 5y ago

your GitHub account is not yours but GitHub's property, they just do not claim that before they ban your account. All cloud services do the similar things.

scrollaway 5y ago
This isn’t how it works at all. It’s not how copyright law works, it’s not how property law works, and it’s certainly not how cloud services work. What isn’t yours is your “right” to use the service.
- feupan 5y ago
  Have you read the project’s license? That is literally how it works. It’s not even an original project by Marak, as it’s clearly shown in there. The only fault here is cutting the owner out of the repo, but given the security breach it’s strange that he isn’t permanently banned at all. And yeah, adding an infinite loop is a DoS attack. > not how cloud services work. Try placing a virus on S3 and let me know how that works out.
  - fault1 5y ago
    not to mention that in the case of colors.js he actually owned less copyright than other contributors. they had actually changed more of the code.
  - scrollaway 5y ago
    I’m not defending the author. GitHub is in their right to do what they did. But certainly not because of the nonsense GP claims. And yes you can host viruses on S3. What you can’t do is use Amazon’s network to do illegal shit (such as distribute viruses without consent).
    - feupan 5y ago
      Obviously I mean to distribute viruses via S3, which is what’s happening here. Your account is guaranteed to be flagged as soon as they find out. The update here was distributed to every subscriber.

goodoldneon 5y ago

Freedom of speech doesn’t mean you can do whatever you want on someone else’s server. The project was hosted on GitHub, so GitHub can take significant action to protect the community. He can host his project elsewhere if he doesn’t agree with GitHub’s actions

Aerroon 5y ago
What about somebody else's internet connection? If we apply the same logic to ISPs then the future of the internet would look quite bleak.
- BoysenberryPi 5y ago
  Whether you agree or disagree with it, ISPs have the right to fire you as a customer. However, I don't usually see that exercising that right unless it's for piracy.
- bawolff 5y ago
  If we applied your logic everywhere, moderation wouldn't be allowed. That also seems pretty bleak.
- dsego 5y ago
  https://en.wikipedia.org/wiki/Net_neutrality https://en.wikipedia.org/wiki/Net_neutrality
- goodoldneon 5y ago
  I think ISPs should be a utility, but I don’t think git websites should
Miner49er 5y ago
Of course, no one is saying GitHub wasn't allowed to do what they did. What people are saying is GitHub shouldn't have done that.

smt88 5y ago

> It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. HN, at least, had a ton of discussion on this[1]. People advocated both ways. > This was his own corner of the internet for him to publish his own personal projects. No, it wasn't. It was Github's corner of the internet and then it was Microsoft's. If he just wanted a place to publish his personal projects, he could have put them on a personal, self-hosted website. By putting them on a social network, like Github, he is submitting to their whims. He doesn't have any legal right to stay on that site if they want to kick him off of it. He also wasn't the only author. Other people contributed to his repos. He was happy to receive the benefits of Github, and he should also realize that it comes with some loss of control. Notably, he eventually used Github as a platform to deploy a Trojan to thousands of unsuspecting users. The other circumstances don't matter. Microsoft can and should remove Trojans from Github. 1. https://news.ycombinator.com/item?id=29877745 https://news.ycombinator.com/item?id=29877745

young_unixer 5y ago
> By putting them on a social network, like Github, he is submitting to their whims. He doesn't have any legal right to stay on that site if they want to kick him off of it. Of course, legally speaking, Github can do whatever they want with their website, but we're not talking about the legal aspect. The developer community has put some trust on Github not to do whatever they want. It's an implicit, non-legal, non-enforceable, social agreement that Github is going to "respect" our user accounts on their platform as long as we don't break the TOS. They could delete all existing repositories tomorrow, and replace them with pornographic images, and they would probably be in their legal right, but that doesn't mean that we can't critizice them for it.
- shadowgovt 5y ago
  FWIW, GitHub's actions here have in no way damaged my trust in them. They interpreted a developer's attempt to harm the community via abuse of the trust the community had placed in him as damage and mitigated it in the short run. That's a value-add.

ren_engineer 5y ago

he did it to protest billion dollar tech companies making money off open source, which is Github's entire business model. His protest was an existential threat to them so of course they are going to crack down

PeterisP 5y ago
I believe that none of the billion dollar tech companies were affected by this in any way as they tend to have proper process in place for managing dependencies, the only ones who suffered were small developers and other open source projects which have limited manpower and just pull in updated versions without verifying them. Saying that this is an "existential threat" is ridiculous - megacorps can and do have procedures that won't be bothered much even if you'd have a case like that every single day. Whatever his intentions were, acts like this threaten the open source community, but do not actually threaten the big companies at all.
junon 5y ago
This is such a bad take I don't even know where to begin. Please, read up on FOSS licenses and check which one colors.js uses. That's just the first of about five flaws with your argument.

perihelions 5y ago

>"The really outrageous thing is that the developer going "rogue" was actually him expressing his freedom of speech, again on his own personal GitHub account, in his own personal (not organization) repositories. He spoke about his thoughts about open source, businesses, and economics. Defending this type of political speech is especially important and GitHub banning his account and censoring this type of speech(whether you agree with it or not) is especially shameful." This Tuesday is the 10-year anniversary of the SOPA/PIPA blackout [0,1]. Half of the tech internet crippled their own functionality for a day, in an act of political speech. (Was GitHub part of that?) Tech culture has surely changed since then! [0] https://en.wikipedia.org/wiki/Protests_against_SOPA_and_PIPA https://en.wikipedia.org/wiki/Protests_against_SOPA_and_PIPA [1] https://hn.algolia.com/?q=sopa https://hn.algolia.com/?q=sopa

pikelet 5y ago
He wasn't crippling his own functionality though, he was deliberately crippling the functionality of everyone who trusted him.

hn_throwaway_99 5y ago

I am completely baffled by folks defending Marak, or putting any sort of blame on GitHub. What Marak did was not "political speech". If he wanted to, he could have easily done any of the following: 1. Pulled down his repo, or replace his repo by whatever message he wanted to send. 2. Output his political message during the build. 3. Heck, all faker.js does is output fake data for things like names and addresses. I think he would have been well within his rights to make this data something like "123 Fascist Way, Fascistville, NY". But he didn't. He replaced his code with an infinite loop that was a DoS attack. He deliberately released it as a patch version because he knew it would be pulled in by others that follow semver rules. The fact that his attack wasn't more severe (like, say, encrypting someone's hard drive) doesn't mean it wasn't an actual attack. And for those quoting the "no express or implied warranty" section of the license, I guarantee no legal system is going to let an actual malicious act be defended by a license.

Handytinge 5y ago
> I am completely baffled by folks defending Marak... > I think he would have been well within his rights to... I think this is the crux of it all. I (and many others it seems) disagree with the actions he took and think they're shitty, but also think he has a right to do this with his code that he provides and publishes for free.
starwind 5y ago
Correct. You basically never have the right to commit sabotage
- z3ncyberpunk 5y ago
  Except that it was his code, and it's open source therefore the risk of using said code is your own. It's his project, He's under no obligation to maintain it in a functional state or at all just because you happen to use it. That's just egotistical and narcissistic on your part
  - starwind 5y ago

deleted 5y ago

[deleted]

dvhh 5y ago

The fact that the conversation is happening at all is a sign that GitHub reputation is damaged. As anyone would point out they are certainly within their rights to terminate any account for any reason. But certainly not beyond repair (as injecting adware in your package). Also it is certainly a reminder for everyone that GitHub should not be treated as an archive of your code, and more like a collaboration space.

junon 5y ago
I don't like GitHub much but their handling of this situation actually won points for me.

mpyne 5y ago

> But GitHub claims to be your home for public hosting of your own personal code. Github claims to be a home for developers to publicly host code of public use. Any benefit to an individual developer is incident to that overriding purpose and they are clear about that in their use policies. > What GitHub policy did he violate? https://docs.github.com/en/github/site-policy/github-acceptable-use-policies https://docs.github.com/en/github/site-policy/github-accepta... gives their acceptable use policies. I think they could easily make claims on any or all of sections 2, 3, 4 and 10. Section 10 in particular notes that Github is a service run for a mass of users and will favor users as a whole over individual privileges. > expressing his freedom of speech, again on his own personal GitHub account, in his own personal (not organization) repositories. Was he running his own Github server instance and I missed it somehow? The flipside to Github paying to run your git repo, issue tracker, etc. is that you agree to abide by their terms of use, and these terms are written for Github's benefit. If a million Github users are impacted by this package breaking their code then why are you surprised that Github took action to protect their users? Marak could have hosted his own git repo if he wanted to ensure his malicious code couldn't be intercepted by others. That's the tradeoff you have to choose. > He spoke about his thoughts about open source, businesses, and economics. Defending this type of political speech [snip] Inserting infinite loops into packages isn't "political speech" and trying to claim as such just waters down the entire argument...

junon 5y ago

Chalk maintainer here. I said before I wouldn't comment on Marak but I don't want to stand by and watch him profit from this like he is, monetarily or otherwise, nor should GitHub receive ANY hate for their actions. He's not banned. It was most likely an initial response to a suspected compromised account situation. Once they determined the actions were carried out by the account holder, they reinstated it. There are MANY reasons to be annoyed with GitHub but this isn't one of them. Github's actions here helped, not hurt. I would hope they'd suspend my account if they too thought it was compromised and pushing out malicious updates to packages. The security of users is of the utmost importance. Marak needs professional medical help. It is clear he's having a mental break and the people defending him and egging him on are only making things worse. He has a history of erratic behavior (dating back to almost a decade ago) and needs to find healing, not accolades. Since this whole fiasco, Marak has garnered loads of followers and has increased his sponsor count dramatically. We should not be rewarding this behavior. If you at all dig into this, you'll find not a stable, perhaps loud individual, but a troubled, erratic, unpredictable, and hurting one. He is not martyr. He's not a patriot or a revolutionist. He's an abuser, potential "freedom fighter", malicious OSS maintainer and a beggar. Please. Let's end this and not give any more attention to Marak. He needs help, and we're all collectively making things worse.

anhner 5y ago
Thank you for stepping up and commenting on this.
kekkidy 5y ago
maybe community should claim his personal account and get hold of those sponsors as well. in order to help marak and the whole community of course.
- junon 5y ago
  This is a bad faith argument and a complete misinterpretation of what it is I've said.

numbchild 5y ago

Unbelievable that now almost all people is discussing "how" marak's action caused results. Not try to figure out "why" this happens. Just like seeing something wrong, and discuss it. DO NOTHING!! CHANGE NOTHING. ALL meanless. unless you figure out all stuff, change something. What I do? I think GitHub is wrong, so I take action, delete all repos on GitHub. F*K it, that what I do. At least I have an action. So what you did? Talking is cheap.

numbchild 5y ago
It takes long time to delete them all! I don't like GitHub, so I delete my repos. Is there any problem? I can manage my repos, of course Marak can too. https://twitter.com/numbchild/status/1482625168032022532 https://twitter.com/numbchild/status/1482625168032022532