7 ms·

> It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. He's not banned: https://github.com/M

> It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. He's not banned: https://github.com/Marak https://github.com/Marak You have to keep in mind that his changes were basically indistinguishable from a security breach of his account. Nobody really sabotages their own repos in a malicious manner like this. Suspending his account while they investigated doesn't seem like a stretch. > This was his own corner of the internet for him to publish his own personal projects. Which he's still free to do. But the actions in question had nothing to do with his "personal projects". It was specifically about his actions to intentionally break popular Node.js packages and do so with a version number that would disguise the change as a non-breaking update. It was a malicious act, and there's no way to paint it as anything else.

nightpool 5y ago
It was a malicious act to the users of his project, sure. But how was it a malicious act to GitHub? I'm glad to hear that they reversed the suspension, but without understanding why it was suspended in the first place, it leaves open the question of what GitHub's motives were in the whole situation. If DHH decided that Rails was contributing more harm to the world then good, and tried to remove it from GitHub, would GitHub lock his account and restore his repos "on behalf of the community", to side with the smooth operation of the open source ecosystem over a user's personal decisions? To what extent has GitHub decided that they "know best" for the open source community?
- manquer 5y ago
  It was malicious act to Github's users. Github first responsibility comes to the community of users it supports, then to any individual user. Free speech/ personal choice / Freedom of expression come secondary to the welfare of its users. Is it a slippery slope ? Yes, but Github does not have a choice if it cared about the interest its community
  - viraptor 5y ago
    > It was malicious act to Github's users. I'm not sure why it matters they are Github users. The packages were hosted on npm through Cloudflare - does that allow Cloudflare to take over the packages too? And NS1 since they host the fakerjs domain?
    - labster 5y ago
      It’s cool that you’re internet rules-lawyering and all but ultimately he used his free account with intent to harm others, just as surely as if he backdoored his code. Freedom of speech is good, and protest is fine, but why would GitHub amplify the speech of a nutso who abused his position of trust?
      - smoldesu 5y ago
        They don't have to amplify anything. This is why open source is valuable; if the current maintainer is considered to be unfit or unreliable in some way, the community that disagrees with their rhetoric/leadership can fork the package and keep going like nothing happened. If you don't care/the package is still usable, then ideally no further action has to be taken. At no point down the road should that involve revoking someone's ownership of a software project, though. Software ownership is sacred, not just because of tradition but because understanding who owns your packages and libraries is paramount to auditing security. Some of the most valuable contributions to computer science have been ones that allow people to verify integrity, be it SHA, TLS or GPG. If Microsoft abuses their position of power to break that chain of integrity, how can we be sure that other repos belong to their respective authors? I can understand if you, the individual don't find this interesting or consider it inconsequential to your workflow. But other people rely on it, and you can't pretend like an honest chain of custody is somehow valueless.
        deleted 5y ago
        [deleted]
        BoorishBears 5y ago
- PragmaticPulp 5y ago
  > It was a malicious act to the users of his project, sure. But how was it a malicious act to GitHub? You can't use GitHub to perform malicious acts, even if the victim isn't GitHub. GitHub isn't obligated to support anyone's malicious acts with their platform. > If DHH decided that Rails was contributing more harm to the world then good, and tried to remove it from GitHub, would GitHub lock his account and restore his repos "on behalf of the community", to side with the smooth operation of the open source ecosystem over a user's personal decisions? To what extent has GitHub decided that they "know best" for the open source community? GitHub hasn't done any of these things with faker.js. Marak deleted the code and replaced it with a non-functional repo that has a README.md that just says "What really happened with Aaron Swartz?" (Reference to a conspiracy theory) It's still here. You can still see it: https://github.com/Marak/faker.js https://github.com/Marak/faker.js
  - judge2020 5y ago
    Exactly - that really looks like malware. If the same sort of replacement happened with rails, I imagine the same course would happen there - but if there were some corresponding blog post or reasoning in the Readme, GitHub would leave it to the community to let the drama play out (maybe still investigating to see if the login was suspicious in any way).
    - encryptluks2 5y ago
      - fault1 5y ago
        I would say colors.js definitely can be considered malware. He in effect intentionally spinlocked a lot of packages either directly or indirectly via transitive dependencies, and also intentionally bypassed common semvar rules to maximize the damage. whether or not those packages should have been affected is another discussion, but it appear it probably had more of an effect on other open source packages and perhaps the work of small mom and pop companies rather than huge corporations.
      - 5y ago
- floatingatoll 5y ago
  If I ever get hacked someday and my repo gets defaced, I hope GitHub acts just as they did to Marek. GitHub can’t tell the difference between an authorized and an unauthorized defacement, and I’d rather they err on the side of caution in this regard. It protects me against attackers, and the only risk of false positives is having to reauth and verify to support that I’m an authorized user when I’m trying to deface my work.
- sam0x17 5y ago
  I completely agree with this take.
  - deleted 5y ago
    [deleted]
- cortesoft 5y ago
  GitHub's market is developers. They want to do everything they can to protect that community, and if a developer uses their service to damage other developers, they aren't going to stand for it.
- brongondwana 5y ago
  If I set up a nice shopfront and invite customers in, and then start kneecapping everybody who walks through the door, you gonna bet the city will have something to say about it. I'm not kneecapping the city, just its citizens, so why should they care - and I'm doing it on my own property which they voluntarily entered after seeing my "dollar store" sign out the front - so it's their own damn fault for believing my sign.
  - deleted 5y ago
    [deleted]
  - runarberg 5y ago
    There is a fundamental difference between physical violence like kneecapping and industrial sabotage which causes a minor temporary disruption in production, which is why the former is punishable by most national laws, while the latter isn’t.
    - anhner 5y ago
      > industrial sabotage > causes a minor temporary disruption in production pick one ETA: if someone created a virus that would just display the text "you've been hacked!" and then that virus infected thousands of computers around the world, that someone would have a visit from the FBI with very serious charges. I don't see how this is different.
      - runarberg 5y ago
        > Pick one I don’t understand. Industrial sabotage is an act of vandalism with the intended purpose of causing disruption in productivity. This incident in particular only caused a relatively minor disruption not much bigger then e.g. a partial github outage. > I don't see how this is different. The difference is in 1) the intended targets. This incident was targeted against particular industry. The worm you are describing would be indiscriminate and would have the potential to be 2) much larger scale and therefor you could deduce the 3) intention of your hypothetical attacker would not be to cause disruptions of productivity withing a particular industry, but rather to prank random strangers. The difference is rather obvious.
- tptacek 5y ago
  Github will not allow you to use your personal corner of the platform to propagate malware, and hasn't allowed it for many years.
  - Firehawke 5y ago
    Exactly this. The changes were intentional malware, designed to break the usage of these two modules. GitHub is under no obligation to assist you in hosting malware. The fact that these changes were intended by the original author has no bearing in this situation.
    - anhner 5y ago
      I don't get how people don't understand this.
  - pydry 5y ago
    Breaking a build in a way that is trivially rolled back is not in the same league as pushing code that harvests email addresses, CCs and mines bitcoin. I'm disappointed to see this kind of comparison made.
    - tptacek 5y ago
      Deliberately breaking people's applications? It's malware.
      - pydry 5y ago
        Appreciate it can be confusing to the layperson, but a build is not quite the same thing as an application. A build will often reach out, download and install new and potentially breaking software components and it is part of its function to prevent breaking software components from reaching the application where it could cause material harm.
  - fulafel 5y ago
    It was a bit of code printing ascii art in a loop, with a preceding comment "don't commit this", and we have bo information about whether it was put into the release on purpose or malicious intent afaik. Is it really malware?
ohgodplsno 5y ago

nightpool 5y ago

It was a malicious act to the users of his project, sure. But how was it a malicious act to GitHub? I'm glad to hear that they reversed the suspension, but without understanding why it was suspended in the first place, it leaves open the question of what GitHub's motives were in the whole situation. If DHH decided that Rails was contributing more harm to the world then good, and tried to remove it from GitHub, would GitHub lock his account and restore his repos "on behalf of the community", to side with the smooth operation of the open source ecosystem over a user's personal decisions? To what extent has GitHub decided that they "know best" for the open source community?

manquer 5y ago
It was malicious act to Github's users. Github first responsibility comes to the community of users it supports, then to any individual user. Free speech/ personal choice / Freedom of expression come secondary to the welfare of its users. Is it a slippery slope ? Yes, but Github does not have a choice if it cared about the interest its community
- viraptor 5y ago
  > It was malicious act to Github's users. I'm not sure why it matters they are Github users. The packages were hosted on npm through Cloudflare - does that allow Cloudflare to take over the packages too? And NS1 since they host the fakerjs domain?
  - labster 5y ago
    It’s cool that you’re internet rules-lawyering and all but ultimately he used his free account with intent to harm others, just as surely as if he backdoored his code. Freedom of speech is good, and protest is fine, but why would GitHub amplify the speech of a nutso who abused his position of trust?
    - smoldesu 5y ago
      They don't have to amplify anything. This is why open source is valuable; if the current maintainer is considered to be unfit or unreliable in some way, the community that disagrees with their rhetoric/leadership can fork the package and keep going like nothing happened. If you don't care/the package is still usable, then ideally no further action has to be taken. At no point down the road should that involve revoking someone's ownership of a software project, though. Software ownership is sacred, not just because of tradition but because understanding who owns your packages and libraries is paramount to auditing security. Some of the most valuable contributions to computer science have been ones that allow people to verify integrity, be it SHA, TLS or GPG. If Microsoft abuses their position of power to break that chain of integrity, how can we be sure that other repos belong to their respective authors? I can understand if you, the individual don't find this interesting or consider it inconsequential to your workflow. But other people rely on it, and you can't pretend like an honest chain of custody is somehow valueless.
      - deleted 5y ago
        [deleted]
      - BoorishBears 5y ago
PragmaticPulp 5y ago
> It was a malicious act to the users of his project, sure. But how was it a malicious act to GitHub? You can't use GitHub to perform malicious acts, even if the victim isn't GitHub. GitHub isn't obligated to support anyone's malicious acts with their platform. > If DHH decided that Rails was contributing more harm to the world then good, and tried to remove it from GitHub, would GitHub lock his account and restore his repos "on behalf of the community", to side with the smooth operation of the open source ecosystem over a user's personal decisions? To what extent has GitHub decided that they "know best" for the open source community? GitHub hasn't done any of these things with faker.js. Marak deleted the code and replaced it with a non-functional repo that has a README.md that just says "What really happened with Aaron Swartz?" (Reference to a conspiracy theory) It's still here. You can still see it: https://github.com/Marak/faker.js https://github.com/Marak/faker.js
- judge2020 5y ago
  Exactly - that really looks like malware. If the same sort of replacement happened with rails, I imagine the same course would happen there - but if there were some corresponding blog post or reasoning in the Readme, GitHub would leave it to the community to let the drama play out (maybe still investigating to see if the login was suspicious in any way).
  - encryptluks2 5y ago
    - fault1 5y ago
      I would say colors.js definitely can be considered malware. He in effect intentionally spinlocked a lot of packages either directly or indirectly via transitive dependencies, and also intentionally bypassed common semvar rules to maximize the damage. whether or not those packages should have been affected is another discussion, but it appear it probably had more of an effect on other open source packages and perhaps the work of small mom and pop companies rather than huge corporations.
    - 5y ago
floatingatoll 5y ago
If I ever get hacked someday and my repo gets defaced, I hope GitHub acts just as they did to Marek. GitHub can’t tell the difference between an authorized and an unauthorized defacement, and I’d rather they err on the side of caution in this regard. It protects me against attackers, and the only risk of false positives is having to reauth and verify to support that I’m an authorized user when I’m trying to deface my work.
sam0x17 5y ago
I completely agree with this take.
- deleted 5y ago
  [deleted]
cortesoft 5y ago
GitHub's market is developers. They want to do everything they can to protect that community, and if a developer uses their service to damage other developers, they aren't going to stand for it.
brongondwana 5y ago
If I set up a nice shopfront and invite customers in, and then start kneecapping everybody who walks through the door, you gonna bet the city will have something to say about it. I'm not kneecapping the city, just its citizens, so why should they care - and I'm doing it on my own property which they voluntarily entered after seeing my "dollar store" sign out the front - so it's their own damn fault for believing my sign.
- deleted 5y ago
  [deleted]
- runarberg 5y ago
  There is a fundamental difference between physical violence like kneecapping and industrial sabotage which causes a minor temporary disruption in production, which is why the former is punishable by most national laws, while the latter isn’t.
  - anhner 5y ago
    > industrial sabotage > causes a minor temporary disruption in production pick one ETA: if someone created a virus that would just display the text "you've been hacked!" and then that virus infected thousands of computers around the world, that someone would have a visit from the FBI with very serious charges. I don't see how this is different.
    - runarberg 5y ago
      > Pick one I don’t understand. Industrial sabotage is an act of vandalism with the intended purpose of causing disruption in productivity. This incident in particular only caused a relatively minor disruption not much bigger then e.g. a partial github outage. > I don't see how this is different. The difference is in 1) the intended targets. This incident was targeted against particular industry. The worm you are describing would be indiscriminate and would have the potential to be 2) much larger scale and therefor you could deduce the 3) intention of your hypothetical attacker would not be to cause disruptions of productivity withing a particular industry, but rather to prank random strangers. The difference is rather obvious.
tptacek 5y ago
Github will not allow you to use your personal corner of the platform to propagate malware, and hasn't allowed it for many years.
- Firehawke 5y ago
  Exactly this. The changes were intentional malware, designed to break the usage of these two modules. GitHub is under no obligation to assist you in hosting malware. The fact that these changes were intended by the original author has no bearing in this situation.
  - anhner 5y ago
    I don't get how people don't understand this.
- pydry 5y ago
  Breaking a build in a way that is trivially rolled back is not in the same league as pushing code that harvests email addresses, CCs and mines bitcoin. I'm disappointed to see this kind of comparison made.
  - tptacek 5y ago
    Deliberately breaking people's applications? It's malware.
    - pydry 5y ago
      Appreciate it can be confusing to the layperson, but a build is not quite the same thing as an application. A build will often reach out, download and install new and potentially breaking software components and it is part of its function to prevent breaking software components from reaching the application where it could cause material harm.
- fulafel 5y ago
  It was a bit of code printing ascii art in a loop, with a preceding comment "don't commit this", and we have bo information about whether it was put into the release on purpose or malicious intent afaik. Is it really malware?

ohgodplsno 5y ago