7 ms·

It was a malicious act to the users of his project, sure. But how was it a malicious act to GitHub? I'm glad to hear that they reversed the suspension, but with

It was a malicious act to the users of his project, sure. But how was it a malicious act to GitHub? I'm glad to hear that they reversed the suspension, but without understanding why it was suspended in the first place, it leaves open the question of what GitHub's motives were in the whole situation. If DHH decided that Rails was contributing more harm to the world then good, and tried to remove it from GitHub, would GitHub lock his account and restore his repos "on behalf of the community", to side with the smooth operation of the open source ecosystem over a user's personal decisions? To what extent has GitHub decided that they "know best" for the open source community?

manquer 5y ago
It was malicious act to Github's users. Github first responsibility comes to the community of users it supports, then to any individual user. Free speech/ personal choice / Freedom of expression come secondary to the welfare of its users. Is it a slippery slope ? Yes, but Github does not have a choice if it cared about the interest its community
- viraptor 5y ago
  > It was malicious act to Github's users. I'm not sure why it matters they are Github users. The packages were hosted on npm through Cloudflare - does that allow Cloudflare to take over the packages too? And NS1 since they host the fakerjs domain?
  - labster 5y ago
    It’s cool that you’re internet rules-lawyering and all but ultimately he used his free account with intent to harm others, just as surely as if he backdoored his code. Freedom of speech is good, and protest is fine, but why would GitHub amplify the speech of a nutso who abused his position of trust?
    - smoldesu 5y ago
      They don't have to amplify anything. This is why open source is valuable; if the current maintainer is considered to be unfit or unreliable in some way, the community that disagrees with their rhetoric/leadership can fork the package and keep going like nothing happened. If you don't care/the package is still usable, then ideally no further action has to be taken. At no point down the road should that involve revoking someone's ownership of a software project, though. Software ownership is sacred, not just because of tradition but because understanding who owns your packages and libraries is paramount to auditing security. Some of the most valuable contributions to computer science have been ones that allow people to verify integrity, be it SHA, TLS or GPG. If Microsoft abuses their position of power to break that chain of integrity, how can we be sure that other repos belong to their respective authors? I can understand if you, the individual don't find this interesting or consider it inconsequential to your workflow. But other people rely on it, and you can't pretend like an honest chain of custody is somehow valueless.
      - deleted 5y ago
        [deleted]
      - BoorishBears 5y ago
        Amazing you wrote this entire comment without taking a second confirm the premise you're so passionately defending... No one took away his ownership. Marak: https://github.com/marak/Faker.js/ https://github.com/marak/Faker.js/ https://www.npmjs.com/package/faker https://www.npmjs.com/package/faker Post: https://github.com/faker-js/faker https://github.com/faker-js/faker https://www.npmjs.com/package/@faker-js/faker https://www.npmjs.com/package/@faker-js/faker Faker.js is not a trademarked term, so someone made a new Faker.js. In fact multiple people did, and one emerged as the preferred fork: https://twitter.com/faker_js/status/1481918305669627905 https://twitter.com/faker_js/status/1481918305669627905 - And to be clear, even if NPM goes and replaces his package with this new fork, it wouldn't take away his ownership. Github could do the same... doesn't take away his ownership. His ownership of a Github page is not his ownership of the code. I don't like this rules-lawyering stuff either, yet this is one time where even if you decide to be purposely inflexible with your understanding of laws/licensing/contracts etc... there's still no issue with how this has been handled.
  - Uehreka 5y ago
    Github owns npm.
  - DeepYogurt 5y ago
    > does that allow Cloudflare to take over the packages too? Fundamentally cloudflare can do that if they so chose. If your threat model doesn't account for that sort of action then you should reassess.
    - nightpool 5y ago
      Can != Should. we're not discussing whether Cloudflare had the physical capability of being able to take over the packages. We're asking if they should. Many people seem to believe that they should have, or would have been justified in doing so, and others disagree.
  - tedunangst 5y ago
    If the attack had been conducted by retargeting cloudflare at a hostile upstream, maybe so. But the attack originated at GitHub, so they're the ones to take action in response.
  - krainboltgreene 5y ago
    People point at github repositories all the time for packages.
- epolanski 5y ago
  I still keep failing to see how it's malicious to gh users and I've red all your comments.
- nightpool 5y ago
  This is an opinion you can have, but it's far from clear that it's an obvious or inherent one. What is the Github "community"? Who constitutes it? If I use Github for a personal project, and share the link with my friend, are we "part of the Github community"? How were we harmed by this incident? Did anyone say "We should shut Github down because they're irresponsibly hosting someone who would use his public JavaScript libraries to make a political statement"? How was Github's community, specifically, harmed? A lot of developers were inconvenienced, but they would have been just as inconvenienced if he pushed the code to NPM from his local git repo, and never touched Github at all. Where does Github come into this?
  - blowski 5y ago
    It sounds like you’re looking for very clear lines which can and can’t be crossed. Whereas others see a blurry grey area in which GitHub makes judgement calls, and then individuals decide whether or not to use GitHub.
    - nightpool 5y ago
      Mm, not really. There are lots of cases much more blurry and questionable then this one. What I'm looking for is 1) a recognition that Github would be in the wrong to suspend Marak for doing whatever he wanted with his own open source project, and 2) an acknowledgement that it's important for Github to be transparent about why they took the actions they did and what motivated their actions.
- cookiengineer 5y ago
  > malicious act to Github's users Usually if I modify my car in my own backyard (aka my property) it is nobody's business to intervene, as long as it's on my property. Legally speaking, fakerjs was Marak's property and GitHub has no right to intervene with a legitimate user action. I can see that they "tried their best" but we also have to uphold the law here. If GitHub, say, called him on his phone whether or not his actions were intended...they would've had to restore the account and the "broken" repository as it was before the suspension immediately...which I assume they did. My point is mostly that there is no legal contract between Marak and the "community", as he was never paid anything. Some might argue about mitigations in between disagreeing parties, but as I said there's nobody forcing you to use his library, just as there was nobody forcing you to update. It cannot be malicious intent if the other party is free to decide to just ignore it and move on.
  - anhner 5y ago
    If you modify your car in your backyard sure, but it wasn't his backyard, it was the public roads, and it wasn't (just) his car, it was his car that he shared with his neighbours. And then he decided to tamper with the brakes as a "prank", knowing full well that others would then use the car.
    - sam0x17 5y ago
      No. Imagine if all traffic lights were 3D-printed, and that entire infrastructure depended, as an active dependency each time a new traffic light is printed, on some random guy's 3D model that he decided to post on his personal blog years ago. Guy decides to take down the model, now all of a sudden his hosting provider takes control of his site and forces him to put the model back. That is the lens through which you should view this situation. The people building infrastructure that depends on one guy's 3D model existing on his blog at all times were the ones who made a mistake. If one of your thousands of dependencies breaks, shame on you, make a fork. The dependency owner owes you nothing, and he can change his creation or remove it any time he likes. If you weren't fortunate enough to fork it while it was still up, then too bad. Instead we as a corporate community are encouraging coddling and ensuring that if you make this mistake, GitHub, NPM, et al will take care of it for you. The downstream effects of this are much worse than the temporary damage of making people actually figure out their dependency chains.
PragmaticPulp 5y ago
> It was a malicious act to the users of his project, sure. But how was it a malicious act to GitHub? You can't use GitHub to perform malicious acts, even if the victim isn't GitHub. GitHub isn't obligated to support anyone's malicious acts with their platform. > If DHH decided that Rails was contributing more harm to the world then good, and tried to remove it from GitHub, would GitHub lock his account and restore his repos "on behalf of the community", to side with the smooth operation of the open source ecosystem over a user's personal decisions? To what extent has GitHub decided that they "know best" for the open source community? GitHub hasn't done any of these things with faker.js. Marak deleted the code and replaced it with a non-functional repo that has a README.md that just says "What really happened with Aaron Swartz?" (Reference to a conspiracy theory) It's still here. You can still see it: https://github.com/Marak/faker.js https://github.com/Marak/faker.js
- judge2020 5y ago
  Exactly - that really looks like malware. If the same sort of replacement happened with rails, I imagine the same course would happen there - but if there were some corresponding blog post or reasoning in the Readme, GitHub would leave it to the community to let the drama play out (maybe still investigating to see if the login was suspicious in any way).
  - encryptluks2 5y ago
    - fault1 5y ago
      I would say colors.js definitely can be considered malware. He in effect intentionally spinlocked a lot of packages either directly or indirectly via transitive dependencies, and also intentionally bypassed common semvar rules to maximize the damage. whether or not those packages should have been affected is another discussion, but it appear it probably had more of an effect on other open source packages and perhaps the work of small mom and pop companies rather than huge corporations.
    - 5y ago
floatingatoll 5y ago
If I ever get hacked someday and my repo gets defaced, I hope GitHub acts just as they did to Marek. GitHub can’t tell the difference between an authorized and an unauthorized defacement, and I’d rather they err on the side of caution in this regard. It protects me against attackers, and the only risk of false positives is having to reauth and verify to support that I’m an authorized user when I’m trying to deface my work.
sam0x17 5y ago
I completely agree with this take.
- deleted 5y ago
  [deleted]
cortesoft 5y ago
GitHub's market is developers. They want to do everything they can to protect that community, and if a developer uses their service to damage other developers, they aren't going to stand for it.
brongondwana 5y ago
If I set up a nice shopfront and invite customers in, and then start kneecapping everybody who walks through the door, you gonna bet the city will have something to say about it. I'm not kneecapping the city, just its citizens, so why should they care - and I'm doing it on my own property which they voluntarily entered after seeing my "dollar store" sign out the front - so it's their own damn fault for believing my sign.
- deleted 5y ago
  [deleted]
- runarberg 5y ago
  There is a fundamental difference between physical violence like kneecapping and industrial sabotage which causes a minor temporary disruption in production, which is why the former is punishable by most national laws, while the latter isn’t.
  - anhner 5y ago
    > industrial sabotage > causes a minor temporary disruption in production pick one ETA: if someone created a virus that would just display the text "you've been hacked!" and then that virus infected thousands of computers around the world, that someone would have a visit from the FBI with very serious charges. I don't see how this is different.
    - runarberg 5y ago
      > Pick one I don’t understand. Industrial sabotage is an act of vandalism with the intended purpose of causing disruption in productivity. This incident in particular only caused a relatively minor disruption not much bigger then e.g. a partial github outage. > I don't see how this is different. The difference is in 1) the intended targets. This incident was targeted against particular industry. The worm you are describing would be indiscriminate and would have the potential to be 2) much larger scale and therefor you could deduce the 3) intention of your hypothetical attacker would not be to cause disruptions of productivity withing a particular industry, but rather to prank random strangers. The difference is rather obvious.
tptacek 5y ago
Github will not allow you to use your personal corner of the platform to propagate malware, and hasn't allowed it for many years.
- Firehawke 5y ago
  Exactly this. The changes were intentional malware, designed to break the usage of these two modules. GitHub is under no obligation to assist you in hosting malware. The fact that these changes were intended by the original author has no bearing in this situation.
  - anhner 5y ago
    I don't get how people don't understand this.
- pydry 5y ago
  Breaking a build in a way that is trivially rolled back is not in the same league as pushing code that harvests email addresses, CCs and mines bitcoin. I'm disappointed to see this kind of comparison made.
  - tptacek 5y ago
    Deliberately breaking people's applications? It's malware.
    - pydry 5y ago
      Appreciate it can be confusing to the layperson, but a build is not quite the same thing as an application. A build will often reach out, download and install new and potentially breaking software components and it is part of its function to prevent breaking software components from reaching the application where it could cause material harm.
- fulafel 5y ago
  It was a bit of code printing ascii art in a loop, with a preceding comment "don't commit this", and we have bo information about whether it was put into the release on purpose or malicious intent afaik. Is it really malware?

manquer 5y ago

It was malicious act to Github's users. Github first responsibility comes to the community of users it supports, then to any individual user. Free speech/ personal choice / Freedom of expression come secondary to the welfare of its users. Is it a slippery slope ? Yes, but Github does not have a choice if it cared about the interest its community

viraptor 5y ago
> It was malicious act to Github's users. I'm not sure why it matters they are Github users. The packages were hosted on npm through Cloudflare - does that allow Cloudflare to take over the packages too? And NS1 since they host the fakerjs domain?
- labster 5y ago
  It’s cool that you’re internet rules-lawyering and all but ultimately he used his free account with intent to harm others, just as surely as if he backdoored his code. Freedom of speech is good, and protest is fine, but why would GitHub amplify the speech of a nutso who abused his position of trust?
  - smoldesu 5y ago
    They don't have to amplify anything. This is why open source is valuable; if the current maintainer is considered to be unfit or unreliable in some way, the community that disagrees with their rhetoric/leadership can fork the package and keep going like nothing happened. If you don't care/the package is still usable, then ideally no further action has to be taken. At no point down the road should that involve revoking someone's ownership of a software project, though. Software ownership is sacred, not just because of tradition but because understanding who owns your packages and libraries is paramount to auditing security. Some of the most valuable contributions to computer science have been ones that allow people to verify integrity, be it SHA, TLS or GPG. If Microsoft abuses their position of power to break that chain of integrity, how can we be sure that other repos belong to their respective authors? I can understand if you, the individual don't find this interesting or consider it inconsequential to your workflow. But other people rely on it, and you can't pretend like an honest chain of custody is somehow valueless.
    - deleted 5y ago
      [deleted]
    - BoorishBears 5y ago
      Amazing you wrote this entire comment without taking a second confirm the premise you're so passionately defending... No one took away his ownership. Marak: https://github.com/marak/Faker.js/ https://github.com/marak/Faker.js/ https://www.npmjs.com/package/faker https://www.npmjs.com/package/faker Post: https://github.com/faker-js/faker https://github.com/faker-js/faker https://www.npmjs.com/package/@faker-js/faker https://www.npmjs.com/package/@faker-js/faker Faker.js is not a trademarked term, so someone made a new Faker.js. In fact multiple people did, and one emerged as the preferred fork: https://twitter.com/faker_js/status/1481918305669627905 https://twitter.com/faker_js/status/1481918305669627905 - And to be clear, even if NPM goes and replaces his package with this new fork, it wouldn't take away his ownership. Github could do the same... doesn't take away his ownership. His ownership of a Github page is not his ownership of the code. I don't like this rules-lawyering stuff either, yet this is one time where even if you decide to be purposely inflexible with your understanding of laws/licensing/contracts etc... there's still no issue with how this has been handled.
- Uehreka 5y ago
  Github owns npm.
- DeepYogurt 5y ago
  > does that allow Cloudflare to take over the packages too? Fundamentally cloudflare can do that if they so chose. If your threat model doesn't account for that sort of action then you should reassess.
  - nightpool 5y ago
    Can != Should. we're not discussing whether Cloudflare had the physical capability of being able to take over the packages. We're asking if they should. Many people seem to believe that they should have, or would have been justified in doing so, and others disagree.
- tedunangst 5y ago
  If the attack had been conducted by retargeting cloudflare at a hostile upstream, maybe so. But the attack originated at GitHub, so they're the ones to take action in response.
- krainboltgreene 5y ago
  People point at github repositories all the time for packages.
epolanski 5y ago
I still keep failing to see how it's malicious to gh users and I've red all your comments.
nightpool 5y ago
This is an opinion you can have, but it's far from clear that it's an obvious or inherent one. What is the Github "community"? Who constitutes it? If I use Github for a personal project, and share the link with my friend, are we "part of the Github community"? How were we harmed by this incident? Did anyone say "We should shut Github down because they're irresponsibly hosting someone who would use his public JavaScript libraries to make a political statement"? How was Github's community, specifically, harmed? A lot of developers were inconvenienced, but they would have been just as inconvenienced if he pushed the code to NPM from his local git repo, and never touched Github at all. Where does Github come into this?
- blowski 5y ago
  It sounds like you’re looking for very clear lines which can and can’t be crossed. Whereas others see a blurry grey area in which GitHub makes judgement calls, and then individuals decide whether or not to use GitHub.
  - nightpool 5y ago
    Mm, not really. There are lots of cases much more blurry and questionable then this one. What I'm looking for is 1) a recognition that Github would be in the wrong to suspend Marak for doing whatever he wanted with his own open source project, and 2) an acknowledgement that it's important for Github to be transparent about why they took the actions they did and what motivated their actions.
cookiengineer 5y ago
> malicious act to Github's users Usually if I modify my car in my own backyard (aka my property) it is nobody's business to intervene, as long as it's on my property. Legally speaking, fakerjs was Marak's property and GitHub has no right to intervene with a legitimate user action. I can see that they "tried their best" but we also have to uphold the law here. If GitHub, say, called him on his phone whether or not his actions were intended...they would've had to restore the account and the "broken" repository as it was before the suspension immediately...which I assume they did. My point is mostly that there is no legal contract between Marak and the "community", as he was never paid anything. Some might argue about mitigations in between disagreeing parties, but as I said there's nobody forcing you to use his library, just as there was nobody forcing you to update. It cannot be malicious intent if the other party is free to decide to just ignore it and move on.
- anhner 5y ago
  If you modify your car in your backyard sure, but it wasn't his backyard, it was the public roads, and it wasn't (just) his car, it was his car that he shared with his neighbours. And then he decided to tamper with the brakes as a "prank", knowing full well that others would then use the car.
  - sam0x17 5y ago
    No. Imagine if all traffic lights were 3D-printed, and that entire infrastructure depended, as an active dependency each time a new traffic light is printed, on some random guy's 3D model that he decided to post on his personal blog years ago. Guy decides to take down the model, now all of a sudden his hosting provider takes control of his site and forces him to put the model back. That is the lens through which you should view this situation. The people building infrastructure that depends on one guy's 3D model existing on his blog at all times were the ones who made a mistake. If one of your thousands of dependencies breaks, shame on you, make a fork. The dependency owner owes you nothing, and he can change his creation or remove it any time he likes. If you weren't fortunate enough to fork it while it was still up, then too bad. Instead we as a corporate community are encouraging coddling and ensuring that if you make this mistake, GitHub, NPM, et al will take care of it for you. The downstream effects of this are much worse than the temporary damage of making people actually figure out their dependency chains.

PragmaticPulp 5y ago

> It was a malicious act to the users of his project, sure. But how was it a malicious act to GitHub? You can't use GitHub to perform malicious acts, even if the victim isn't GitHub. GitHub isn't obligated to support anyone's malicious acts with their platform. > If DHH decided that Rails was contributing more harm to the world then good, and tried to remove it from GitHub, would GitHub lock his account and restore his repos "on behalf of the community", to side with the smooth operation of the open source ecosystem over a user's personal decisions? To what extent has GitHub decided that they "know best" for the open source community? GitHub hasn't done any of these things with faker.js. Marak deleted the code and replaced it with a non-functional repo that has a README.md that just says "What really happened with Aaron Swartz?" (Reference to a conspiracy theory) It's still here. You can still see it: https://github.com/Marak/faker.js https://github.com/Marak/faker.js

judge2020 5y ago
Exactly - that really looks like malware. If the same sort of replacement happened with rails, I imagine the same course would happen there - but if there were some corresponding blog post or reasoning in the Readme, GitHub would leave it to the community to let the drama play out (maybe still investigating to see if the login was suspicious in any way).
- encryptluks2 5y ago
  - fault1 5y ago
    I would say colors.js definitely can be considered malware. He in effect intentionally spinlocked a lot of packages either directly or indirectly via transitive dependencies, and also intentionally bypassed common semvar rules to maximize the damage. whether or not those packages should have been affected is another discussion, but it appear it probably had more of an effect on other open source packages and perhaps the work of small mom and pop companies rather than huge corporations.
  - 5y ago

floatingatoll 5y ago

If I ever get hacked someday and my repo gets defaced, I hope GitHub acts just as they did to Marek. GitHub can’t tell the difference between an authorized and an unauthorized defacement, and I’d rather they err on the side of caution in this regard. It protects me against attackers, and the only risk of false positives is having to reauth and verify to support that I’m an authorized user when I’m trying to deface my work.

sam0x17 5y ago

I completely agree with this take.

deleted 5y ago
[deleted]

cortesoft 5y ago

GitHub's market is developers. They want to do everything they can to protect that community, and if a developer uses their service to damage other developers, they aren't going to stand for it.

brongondwana 5y ago

If I set up a nice shopfront and invite customers in, and then start kneecapping everybody who walks through the door, you gonna bet the city will have something to say about it. I'm not kneecapping the city, just its citizens, so why should they care - and I'm doing it on my own property which they voluntarily entered after seeing my "dollar store" sign out the front - so it's their own damn fault for believing my sign.

deleted 5y ago
[deleted]
runarberg 5y ago
There is a fundamental difference between physical violence like kneecapping and industrial sabotage which causes a minor temporary disruption in production, which is why the former is punishable by most national laws, while the latter isn’t.
- anhner 5y ago
  > industrial sabotage > causes a minor temporary disruption in production pick one ETA: if someone created a virus that would just display the text "you've been hacked!" and then that virus infected thousands of computers around the world, that someone would have a visit from the FBI with very serious charges. I don't see how this is different.
  - runarberg 5y ago
    > Pick one I don’t understand. Industrial sabotage is an act of vandalism with the intended purpose of causing disruption in productivity. This incident in particular only caused a relatively minor disruption not much bigger then e.g. a partial github outage. > I don't see how this is different. The difference is in 1) the intended targets. This incident was targeted against particular industry. The worm you are describing would be indiscriminate and would have the potential to be 2) much larger scale and therefor you could deduce the 3) intention of your hypothetical attacker would not be to cause disruptions of productivity withing a particular industry, but rather to prank random strangers. The difference is rather obvious.

tptacek 5y ago

Github will not allow you to use your personal corner of the platform to propagate malware, and hasn't allowed it for many years.

Firehawke 5y ago
Exactly this. The changes were intentional malware, designed to break the usage of these two modules. GitHub is under no obligation to assist you in hosting malware. The fact that these changes were intended by the original author has no bearing in this situation.
- anhner 5y ago
  I don't get how people don't understand this.
pydry 5y ago
Breaking a build in a way that is trivially rolled back is not in the same league as pushing code that harvests email addresses, CCs and mines bitcoin. I'm disappointed to see this kind of comparison made.
- tptacek 5y ago
  Deliberately breaking people's applications? It's malware.
  - pydry 5y ago
    Appreciate it can be confusing to the layperson, but a build is not quite the same thing as an application. A build will often reach out, download and install new and potentially breaking software components and it is part of its function to prevent breaking software components from reaching the application where it could cause material harm.
fulafel 5y ago
It was a bit of code printing ascii art in a loop, with a preceding comment "don't commit this", and we have bo information about whether it was put into the release on purpose or malicious intent afaik. Is it really malware?