10 ms·

> It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. HN, at least, had a ton of discussion

by smt88 5y ago

> It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. HN, at least, had a ton of discussion on this[1]. People advocated both ways. > This was his own corner of the internet for him to publish his own personal projects. No, it wasn't. It was Github's corner of the internet and then it was Microsoft's. If he just wanted a place to publish his personal projects, he could have put them on a personal, self-hosted website. By putting them on a social network, like Github, he is submitting to their whims. He doesn't have any legal right to stay on that site if they want to kick him off of it. He also wasn't the only author. Other people contributed to his repos. He was happy to receive the benefits of Github, and he should also realize that it comes with some loss of control. Notably, he eventually used Github as a platform to deploy a Trojan to thousands of unsuspecting users. The other circumstances don't matter. Microsoft can and should remove Trojans from Github. 1. https://news.ycombinator.com/item?id=29877745 https://news.ycombinator.com/item?id=29877745

young_unixer 5y ago
> By putting them on a social network, like Github, he is submitting to their whims. He doesn't have any legal right to stay on that site if they want to kick him off of it. Of course, legally speaking, Github can do whatever they want with their website, but we're not talking about the legal aspect. The developer community has put some trust on Github not to do whatever they want. It's an implicit, non-legal, non-enforceable, social agreement that Github is going to "respect" our user accounts on their platform as long as we don't break the TOS. They could delete all existing repositories tomorrow, and replace them with pornographic images, and they would probably be in their legal right, but that doesn't mean that we can't critizice them for it.
- shadowgovt 5y ago
  FWIW, GitHub's actions here have in no way damaged my trust in them. They interpreted a developer's attempt to harm the community via abuse of the trust the community had placed in him as damage and mitigated it in the short run. That's a value-add.
  - encryptluks2 5y ago
    Value add in to who? It sounds like you believe open source developers owe something to someone which simply isn't the case. You should evaluate the license(s): THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
    - Macha 5y ago
      I don't see where this license obligates github to distribute future versions. Also if we're expecting people to do the bare minimum specified in their license, github's license gives them all the leeway they needed for their actions too.
      - z3ncyberpunk 5y ago
        GitHub is under no obligation to distribute further versions. Neither is Marak under any obligation to maintain and upkeep the repository. While in bad faith of the community, you are the consumer who CHOSE to use his software, free and at no cost to yourself. You have no right to dictate how that repository is used, especially if you never donated or contributed to the project itself.
        Macha 5y ago
        > While in bad faith of the community, you are the consumer who CHOSE to use his software, free and at no cost to yourself. You have no right to dictate how that repository is used, especially if you never donated or contributed to the project itself. Either we're going by a legalistic interpretation of the terms in which case Marak was free to fuck up his project and github was free to kick him off npm for it, or we're agreeing that people can be held to moral standards apart from legal ones. If we agree that moral standards about bad faith should prevent npm/github/microsoft from taking control of something that Marak has put work into, then we should also be able to agree that moral standards should prevent Marak from releasing a deliberately broken version of a package as a fuck you to corporate users. Even that action of Marak's I think is wrong, but the backlash also landed on many open source projects.
- chaostheory 5y ago
  GitHub acted reasonably to mitigate harm. They didn’t delete his older commits or “replace it with porn”. They acted reasonably unlike Marak.
- dahdum 5y ago
  I trust GitHub more based on their actions in this case. They acted to prevent further attacks and gave him access back after it was mitigated.
- bawolff 5y ago
  Github is still in theory a place to collaborate on code - its not a blogging platform. I think a reasonable argument could be made that he violated the "spirit" of github.
- syshum 5y ago
  What you are going to get is people separating out into 2 camps, those that believe in individuality, and those that believe in more collectivism. This is a divide that extends well beyond programming and this topic. People that support GitHub actions believe in the concept of "greater good" and believe the actions of GitHub are ethical because it prevented harm to the community People that oppose GitHub actions reject the idea of "the greater good" and believe this individual should have had the right to do with their property (i,e their code) anything they wanted and the responsibility was upon the people consuming / using that code to vet it before use.
  - chasd00 5y ago
    I have a feeling bare metal servers, a leased spot in a cage, and self hosted systems is about to become popular. There are just too many stories like this these days. I’m in the camp that if it was his repo then he can do whatever the eff he wants to it.
  - krsrhe 5y ago
  - phs318u 5y ago
    Except that use of GitHub implies you see a benefit to the collectivist use of GitHub's property, which is why you agree to GitHub's terms when using their property. If I'm leasing a part of my land to you (and others), and your use of your assets on my land has the potential to harm other users of my land - you'll be asked to leave. I have a business to run. You are still free to take your property to your own patch of land and do with it what you will. Your freedom has not been compromised. You just assumed a freedom you did not have - which is the use of my land in an unfettered way.
  - smt88 5y ago
    > What you are going to get is people separating out into 2 camps, those that believe in individuality, and those that believe in more collectivism. I am extremely individualistic. Github is also an "individual" that has its own private rights. The author of this library absolutely had the right to write code, change it, etc. He does not have the right to use Github as a delivery mechanism for malware.
- krsrhe 5y ago
- smt88 5y ago
  > but we're not talking about the legal aspect Yes we are. I was responding to someone[1] who was alluding to the legal aspect using legal terms s/he clearly doesn't understand. > > "What GitHub policy did he violate? The really outrageous thing is that the developer going "rogue" was actually him expressing his freedom of speech..." 1. https://news.ycombinator.com/item?id=29961662 https://news.ycombinator.com/item?id=29961662
deleted 5y ago
[deleted]
torstenvl 5y ago
- encryptluks2 5y ago
  - deleted 5y ago
    [deleted]
  - hn_throwaway_99 5y ago
    That's BS. Mark didn't just remove it or make it "non-functional". He deliberately changed the code to run in a infinite loop and halt any code that pulled it in. That seems exactly like the definition of a Trojan to me.
    - torstenvl 5y ago
      > That seems exactly like the definition of a Trojan to me. Link to even one report of Marak getting inside someone else's system.
      - hn_throwaway_99 5y ago
        You seem to be misunderstanding what a Trojan is. From Wikipedia: > In computing, a Trojan horse is any malware that misleads users of its true intent. The term is derived from the Ancient Greek story of the deceptive Trojan Horse that led to the fall of the city of Troy. > Trojans generally spread by some form of social engineering; for example, where a user is duped into executing an email attachment disguised to appear not suspicious (e.g., a routine form to be filled in), or by clicking on some fake advertisement on social media or anywhere else. Marak disguised his malicious DoS attack as previously released useful software. I am completely baffled why people are defending his actions, at all. He could have easily just pulled down his repo, that would have been totally within his rights. Releasing malicious software under the guise of something else is not. And the fact that people are quoting the license of "no implied warranty" is irrelevant. The law does not look kindly on those that act with malicious intent, regardless of what a license agreement says. For example, if he changed the repo to instead encrypt your hard drive, I guarantee he'd be going to jail. While thankful this was just a DoS attack and not something more serious, it was attack all the same.
lolinder 5y ago
> No, it wasn't. It was Github's corner of the internet and then it was Microsoft's. If he just wanted a place to publish his personal projects, he could have put them on a personal, self-hosted website. Exactly. Marak's defenders are quick to argue that he had every right to do what he did based on the repo's license. It's inconsistent to then blame GitHub for suspending him from their platform.

by smt88 5y ago

young_unixer 5y ago

> By putting them on a social network, like Github, he is submitting to their whims. He doesn't have any legal right to stay on that site if they want to kick him off of it. Of course, legally speaking, Github can do whatever they want with their website, but we're not talking about the legal aspect. The developer community has put some trust on Github not to do whatever they want. It's an implicit, non-legal, non-enforceable, social agreement that Github is going to "respect" our user accounts on their platform as long as we don't break the TOS. They could delete all existing repositories tomorrow, and replace them with pornographic images, and they would probably be in their legal right, but that doesn't mean that we can't critizice them for it.

shadowgovt 5y ago
FWIW, GitHub's actions here have in no way damaged my trust in them. They interpreted a developer's attempt to harm the community via abuse of the trust the community had placed in him as damage and mitigated it in the short run. That's a value-add.
- encryptluks2 5y ago
  Value add in to who? It sounds like you believe open source developers owe something to someone which simply isn't the case. You should evaluate the license(s): THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  - Macha 5y ago
    I don't see where this license obligates github to distribute future versions. Also if we're expecting people to do the bare minimum specified in their license, github's license gives them all the leeway they needed for their actions too.
    - z3ncyberpunk 5y ago
      GitHub is under no obligation to distribute further versions. Neither is Marak under any obligation to maintain and upkeep the repository. While in bad faith of the community, you are the consumer who CHOSE to use his software, free and at no cost to yourself. You have no right to dictate how that repository is used, especially if you never donated or contributed to the project itself.
      - Macha 5y ago
        > While in bad faith of the community, you are the consumer who CHOSE to use his software, free and at no cost to yourself. You have no right to dictate how that repository is used, especially if you never donated or contributed to the project itself. Either we're going by a legalistic interpretation of the terms in which case Marak was free to fuck up his project and github was free to kick him off npm for it, or we're agreeing that people can be held to moral standards apart from legal ones. If we agree that moral standards about bad faith should prevent npm/github/microsoft from taking control of something that Marak has put work into, then we should also be able to agree that moral standards should prevent Marak from releasing a deliberately broken version of a package as a fuck you to corporate users. Even that action of Marak's I think is wrong, but the backlash also landed on many open source projects.
chaostheory 5y ago
GitHub acted reasonably to mitigate harm. They didn’t delete his older commits or “replace it with porn”. They acted reasonably unlike Marak.
dahdum 5y ago
I trust GitHub more based on their actions in this case. They acted to prevent further attacks and gave him access back after it was mitigated.
bawolff 5y ago
Github is still in theory a place to collaborate on code - its not a blogging platform. I think a reasonable argument could be made that he violated the "spirit" of github.
syshum 5y ago
What you are going to get is people separating out into 2 camps, those that believe in individuality, and those that believe in more collectivism. This is a divide that extends well beyond programming and this topic. People that support GitHub actions believe in the concept of "greater good" and believe the actions of GitHub are ethical because it prevented harm to the community People that oppose GitHub actions reject the idea of "the greater good" and believe this individual should have had the right to do with their property (i,e their code) anything they wanted and the responsibility was upon the people consuming / using that code to vet it before use.
- chasd00 5y ago
  I have a feeling bare metal servers, a leased spot in a cage, and self hosted systems is about to become popular. There are just too many stories like this these days. I’m in the camp that if it was his repo then he can do whatever the eff he wants to it.
- krsrhe 5y ago
- phs318u 5y ago
  Except that use of GitHub implies you see a benefit to the collectivist use of GitHub's property, which is why you agree to GitHub's terms when using their property. If I'm leasing a part of my land to you (and others), and your use of your assets on my land has the potential to harm other users of my land - you'll be asked to leave. I have a business to run. You are still free to take your property to your own patch of land and do with it what you will. Your freedom has not been compromised. You just assumed a freedom you did not have - which is the use of my land in an unfettered way.
- smt88 5y ago
  > What you are going to get is people separating out into 2 camps, those that believe in individuality, and those that believe in more collectivism. I am extremely individualistic. Github is also an "individual" that has its own private rights. The author of this library absolutely had the right to write code, change it, etc. He does not have the right to use Github as a delivery mechanism for malware.
krsrhe 5y ago
smt88 5y ago
> but we're not talking about the legal aspect Yes we are. I was responding to someone[1] who was alluding to the legal aspect using legal terms s/he clearly doesn't understand. > > "What GitHub policy did he violate? The really outrageous thing is that the developer going "rogue" was actually him expressing his freedom of speech..." 1. https://news.ycombinator.com/item?id=29961662 https://news.ycombinator.com/item?id=29961662

deleted 5y ago

[deleted]

torstenvl 5y ago

encryptluks2 5y ago
- deleted 5y ago
  [deleted]
- hn_throwaway_99 5y ago
  That's BS. Mark didn't just remove it or make it "non-functional". He deliberately changed the code to run in a infinite loop and halt any code that pulled it in. That seems exactly like the definition of a Trojan to me.
  - torstenvl 5y ago
    > That seems exactly like the definition of a Trojan to me. Link to even one report of Marak getting inside someone else's system.
    - hn_throwaway_99 5y ago
      You seem to be misunderstanding what a Trojan is. From Wikipedia: > In computing, a Trojan horse is any malware that misleads users of its true intent. The term is derived from the Ancient Greek story of the deceptive Trojan Horse that led to the fall of the city of Troy. > Trojans generally spread by some form of social engineering; for example, where a user is duped into executing an email attachment disguised to appear not suspicious (e.g., a routine form to be filled in), or by clicking on some fake advertisement on social media or anywhere else. Marak disguised his malicious DoS attack as previously released useful software. I am completely baffled why people are defending his actions, at all. He could have easily just pulled down his repo, that would have been totally within his rights. Releasing malicious software under the guise of something else is not. And the fact that people are quoting the license of "no implied warranty" is irrelevant. The law does not look kindly on those that act with malicious intent, regardless of what a license agreement says. For example, if he changed the repo to instead encrypt your hard drive, I guarantee he'd be going to jail. While thankful this was just a DoS attack and not something more serious, it was attack all the same.

lolinder 5y ago

> No, it wasn't. It was Github's corner of the internet and then it was Microsoft's. If he just wanted a place to publish his personal projects, he could have put them on a personal, self-hosted website. Exactly. Marak's defenders are quick to argue that he had every right to do what he did based on the repo's license. It's inconsistent to then blame GitHub for suspending him from their platform.