10 ms·

It was malicious act to Github's users. Github first responsibility comes to the community of users it supports, then to any individual user. Free speech/ pers

It was malicious act to Github's users. Github first responsibility comes to the community of users it supports, then to any individual user. Free speech/ personal choice / Freedom of expression come secondary to the welfare of its users. Is it a slippery slope ? Yes, but Github does not have a choice if it cared about the interest its community

viraptor 5y ago
> It was malicious act to Github's users. I'm not sure why it matters they are Github users. The packages were hosted on npm through Cloudflare - does that allow Cloudflare to take over the packages too? And NS1 since they host the fakerjs domain?
- labster 5y ago
  It’s cool that you’re internet rules-lawyering and all but ultimately he used his free account with intent to harm others, just as surely as if he backdoored his code. Freedom of speech is good, and protest is fine, but why would GitHub amplify the speech of a nutso who abused his position of trust?
  - smoldesu 5y ago
    They don't have to amplify anything. This is why open source is valuable; if the current maintainer is considered to be unfit or unreliable in some way, the community that disagrees with their rhetoric/leadership can fork the package and keep going like nothing happened. If you don't care/the package is still usable, then ideally no further action has to be taken. At no point down the road should that involve revoking someone's ownership of a software project, though. Software ownership is sacred, not just because of tradition but because understanding who owns your packages and libraries is paramount to auditing security. Some of the most valuable contributions to computer science have been ones that allow people to verify integrity, be it SHA, TLS or GPG. If Microsoft abuses their position of power to break that chain of integrity, how can we be sure that other repos belong to their respective authors? I can understand if you, the individual don't find this interesting or consider it inconsequential to your workflow. But other people rely on it, and you can't pretend like an honest chain of custody is somehow valueless.
    - deleted 5y ago
      [deleted]
    - BoorishBears 5y ago
      Amazing you wrote this entire comment without taking a second confirm the premise you're so passionately defending... No one took away his ownership. Marak: https://github.com/marak/Faker.js/ https://github.com/marak/Faker.js/ https://www.npmjs.com/package/faker https://www.npmjs.com/package/faker Post: https://github.com/faker-js/faker https://github.com/faker-js/faker https://www.npmjs.com/package/@faker-js/faker https://www.npmjs.com/package/@faker-js/faker Faker.js is not a trademarked term, so someone made a new Faker.js. In fact multiple people did, and one emerged as the preferred fork: https://twitter.com/faker_js/status/1481918305669627905 https://twitter.com/faker_js/status/1481918305669627905 - And to be clear, even if NPM goes and replaces his package with this new fork, it wouldn't take away his ownership. Github could do the same... doesn't take away his ownership. His ownership of a Github page is not his ownership of the code. I don't like this rules-lawyering stuff either, yet this is one time where even if you decide to be purposely inflexible with your understanding of laws/licensing/contracts etc... there's still no issue with how this has been handled.
  - diogenesjunior 5y ago
    >he used his free account actually, marak has github pro, so it is not a free account
  - viraptor 5y ago
    > used his free account with intent to harm others, just as surely as if he backdoored his code There's a huge difference between displaying a message and going in an endless loop and backdooring as in providing an alternative access to control a system you're not supposed to have access to. Words have meaning. This wasn't a backdoor.
    - leshenka 5y ago
      There is a difference between robbery and burglary.
      - labster 5y ago
        There’s a difference between a simile and a metaphor too, but GP is ignoring the fact I used one of those entirely.
  - salawat 5y ago
    I see only one of those alleged "nutso's", and that was GitHub. Everyone else should have been responsibly consuming the dependency. You don't get to call foul when you knowingly use something for something important and don't check to make sure it is okay.
    - leshenka 5y ago
      Now that’s just plain victim blaming
      - salawat 5y ago
        As an engineer, part of your responsibility is to foresee this type of thing. Software that does exactly what it should, and is free of defects for it's immediate use case, has no need to be continually updated. As each line is adding more functionality you do not need. Even if you're trying to keep things rolling forward and buy into taking in updates anyway; you don't do it in such a way as to cause it to leak to production until you are good and certain there is no potential for breakage. If you haven't learned this yet, give a monorepo a try. I assure you, you will be divested of any naivete in this regard.
    - porlune 5y ago
      Setting your package version to allow for minor updates _is_ responsibly consuming the dependency.
      - llukas 5y ago
        This sounds like "I responsibly test in production". If you do test and isolate testing environment then this kind of breaking update is just business as usual.
        porlune 5y ago
        That's fair, it does sound like a novice take; but it's still "business as usual" w/r/t what is touted as best practices where it comes to version control. At least that's my slightly above novice take on the matter.
  - hinkley 5y ago
    “Your freedom of speech ends at the tip of my nose.” as the saying goes. He took a swing, not just a stand.
- Uehreka 5y ago
  Github owns npm.
- DeepYogurt 5y ago
  > does that allow Cloudflare to take over the packages too? Fundamentally cloudflare can do that if they so chose. If your threat model doesn't account for that sort of action then you should reassess.
  - nightpool 5y ago
    Can != Should. we're not discussing whether Cloudflare had the physical capability of being able to take over the packages. We're asking if they should. Many people seem to believe that they should have, or would have been justified in doing so, and others disagree.
- tedunangst 5y ago
  If the attack had been conducted by retargeting cloudflare at a hostile upstream, maybe so. But the attack originated at GitHub, so they're the ones to take action in response.
- krainboltgreene 5y ago
  People point at github repositories all the time for packages.
epolanski 5y ago
I still keep failing to see how it's malicious to gh users and I've red all your comments.
nightpool 5y ago
This is an opinion you can have, but it's far from clear that it's an obvious or inherent one. What is the Github "community"? Who constitutes it? If I use Github for a personal project, and share the link with my friend, are we "part of the Github community"? How were we harmed by this incident? Did anyone say "We should shut Github down because they're irresponsibly hosting someone who would use his public JavaScript libraries to make a political statement"? How was Github's community, specifically, harmed? A lot of developers were inconvenienced, but they would have been just as inconvenienced if he pushed the code to NPM from his local git repo, and never touched Github at all. Where does Github come into this?
- blowski 5y ago
  It sounds like you’re looking for very clear lines which can and can’t be crossed. Whereas others see a blurry grey area in which GitHub makes judgement calls, and then individuals decide whether or not to use GitHub.
  - nightpool 5y ago
    Mm, not really. There are lots of cases much more blurry and questionable then this one. What I'm looking for is 1) a recognition that Github would be in the wrong to suspend Marak for doing whatever he wanted with his own open source project, and 2) an acknowledgement that it's important for Github to be transparent about why they took the actions they did and what motivated their actions.
cookiengineer 5y ago
> malicious act to Github's users Usually if I modify my car in my own backyard (aka my property) it is nobody's business to intervene, as long as it's on my property. Legally speaking, fakerjs was Marak's property and GitHub has no right to intervene with a legitimate user action. I can see that they "tried their best" but we also have to uphold the law here. If GitHub, say, called him on his phone whether or not his actions were intended...they would've had to restore the account and the "broken" repository as it was before the suspension immediately...which I assume they did. My point is mostly that there is no legal contract between Marak and the "community", as he was never paid anything. Some might argue about mitigations in between disagreeing parties, but as I said there's nobody forcing you to use his library, just as there was nobody forcing you to update. It cannot be malicious intent if the other party is free to decide to just ignore it and move on.
- anhner 5y ago
  If you modify your car in your backyard sure, but it wasn't his backyard, it was the public roads, and it wasn't (just) his car, it was his car that he shared with his neighbours. And then he decided to tamper with the brakes as a "prank", knowing full well that others would then use the car.
  - sam0x17 5y ago
    No. Imagine if all traffic lights were 3D-printed, and that entire infrastructure depended, as an active dependency each time a new traffic light is printed, on some random guy's 3D model that he decided to post on his personal blog years ago. Guy decides to take down the model, now all of a sudden his hosting provider takes control of his site and forces him to put the model back. That is the lens through which you should view this situation. The people building infrastructure that depends on one guy's 3D model existing on his blog at all times were the ones who made a mistake. If one of your thousands of dependencies breaks, shame on you, make a fork. The dependency owner owes you nothing, and he can change his creation or remove it any time he likes. If you weren't fortunate enough to fork it while it was still up, then too bad. Instead we as a corporate community are encouraging coddling and ensuring that if you make this mistake, GitHub, NPM, et al will take care of it for you. The downstream effects of this are much worse than the temporary damage of making people actually figure out their dependency chains.

viraptor 5y ago

> It was malicious act to Github's users. I'm not sure why it matters they are Github users. The packages were hosted on npm through Cloudflare - does that allow Cloudflare to take over the packages too? And NS1 since they host the fakerjs domain?

labster 5y ago
It’s cool that you’re internet rules-lawyering and all but ultimately he used his free account with intent to harm others, just as surely as if he backdoored his code. Freedom of speech is good, and protest is fine, but why would GitHub amplify the speech of a nutso who abused his position of trust?
- smoldesu 5y ago
  They don't have to amplify anything. This is why open source is valuable; if the current maintainer is considered to be unfit or unreliable in some way, the community that disagrees with their rhetoric/leadership can fork the package and keep going like nothing happened. If you don't care/the package is still usable, then ideally no further action has to be taken. At no point down the road should that involve revoking someone's ownership of a software project, though. Software ownership is sacred, not just because of tradition but because understanding who owns your packages and libraries is paramount to auditing security. Some of the most valuable contributions to computer science have been ones that allow people to verify integrity, be it SHA, TLS or GPG. If Microsoft abuses their position of power to break that chain of integrity, how can we be sure that other repos belong to their respective authors? I can understand if you, the individual don't find this interesting or consider it inconsequential to your workflow. But other people rely on it, and you can't pretend like an honest chain of custody is somehow valueless.
  - deleted 5y ago
    [deleted]
  - BoorishBears 5y ago
    Amazing you wrote this entire comment without taking a second confirm the premise you're so passionately defending... No one took away his ownership. Marak: https://github.com/marak/Faker.js/ https://github.com/marak/Faker.js/ https://www.npmjs.com/package/faker https://www.npmjs.com/package/faker Post: https://github.com/faker-js/faker https://github.com/faker-js/faker https://www.npmjs.com/package/@faker-js/faker https://www.npmjs.com/package/@faker-js/faker Faker.js is not a trademarked term, so someone made a new Faker.js. In fact multiple people did, and one emerged as the preferred fork: https://twitter.com/faker_js/status/1481918305669627905 https://twitter.com/faker_js/status/1481918305669627905 - And to be clear, even if NPM goes and replaces his package with this new fork, it wouldn't take away his ownership. Github could do the same... doesn't take away his ownership. His ownership of a Github page is not his ownership of the code. I don't like this rules-lawyering stuff either, yet this is one time where even if you decide to be purposely inflexible with your understanding of laws/licensing/contracts etc... there's still no issue with how this has been handled.
- diogenesjunior 5y ago
  >he used his free account actually, marak has github pro, so it is not a free account
- viraptor 5y ago
  > used his free account with intent to harm others, just as surely as if he backdoored his code There's a huge difference between displaying a message and going in an endless loop and backdooring as in providing an alternative access to control a system you're not supposed to have access to. Words have meaning. This wasn't a backdoor.
  - leshenka 5y ago
    There is a difference between robbery and burglary.
    - labster 5y ago
      There’s a difference between a simile and a metaphor too, but GP is ignoring the fact I used one of those entirely.
- salawat 5y ago
  I see only one of those alleged "nutso's", and that was GitHub. Everyone else should have been responsibly consuming the dependency. You don't get to call foul when you knowingly use something for something important and don't check to make sure it is okay.
  - leshenka 5y ago
    Now that’s just plain victim blaming
    - salawat 5y ago
      As an engineer, part of your responsibility is to foresee this type of thing. Software that does exactly what it should, and is free of defects for it's immediate use case, has no need to be continually updated. As each line is adding more functionality you do not need. Even if you're trying to keep things rolling forward and buy into taking in updates anyway; you don't do it in such a way as to cause it to leak to production until you are good and certain there is no potential for breakage. If you haven't learned this yet, give a monorepo a try. I assure you, you will be divested of any naivete in this regard.
  - porlune 5y ago
    Setting your package version to allow for minor updates _is_ responsibly consuming the dependency.
    - llukas 5y ago
      This sounds like "I responsibly test in production". If you do test and isolate testing environment then this kind of breaking update is just business as usual.
      - porlune 5y ago
        That's fair, it does sound like a novice take; but it's still "business as usual" w/r/t what is touted as best practices where it comes to version control. At least that's my slightly above novice take on the matter.
- hinkley 5y ago
  “Your freedom of speech ends at the tip of my nose.” as the saying goes. He took a swing, not just a stand.
Uehreka 5y ago
Github owns npm.
DeepYogurt 5y ago
> does that allow Cloudflare to take over the packages too? Fundamentally cloudflare can do that if they so chose. If your threat model doesn't account for that sort of action then you should reassess.
- nightpool 5y ago
  Can != Should. we're not discussing whether Cloudflare had the physical capability of being able to take over the packages. We're asking if they should. Many people seem to believe that they should have, or would have been justified in doing so, and others disagree.
tedunangst 5y ago
If the attack had been conducted by retargeting cloudflare at a hostile upstream, maybe so. But the attack originated at GitHub, so they're the ones to take action in response.
krainboltgreene 5y ago
People point at github repositories all the time for packages.

epolanski 5y ago

I still keep failing to see how it's malicious to gh users and I've red all your comments.

nightpool 5y ago

This is an opinion you can have, but it's far from clear that it's an obvious or inherent one. What is the Github "community"? Who constitutes it? If I use Github for a personal project, and share the link with my friend, are we "part of the Github community"? How were we harmed by this incident? Did anyone say "We should shut Github down because they're irresponsibly hosting someone who would use his public JavaScript libraries to make a political statement"? How was Github's community, specifically, harmed? A lot of developers were inconvenienced, but they would have been just as inconvenienced if he pushed the code to NPM from his local git repo, and never touched Github at all. Where does Github come into this?

blowski 5y ago
It sounds like you’re looking for very clear lines which can and can’t be crossed. Whereas others see a blurry grey area in which GitHub makes judgement calls, and then individuals decide whether or not to use GitHub.
- nightpool 5y ago
  Mm, not really. There are lots of cases much more blurry and questionable then this one. What I'm looking for is 1) a recognition that Github would be in the wrong to suspend Marak for doing whatever he wanted with his own open source project, and 2) an acknowledgement that it's important for Github to be transparent about why they took the actions they did and what motivated their actions.

cookiengineer 5y ago

> malicious act to Github's users Usually if I modify my car in my own backyard (aka my property) it is nobody's business to intervene, as long as it's on my property. Legally speaking, fakerjs was Marak's property and GitHub has no right to intervene with a legitimate user action. I can see that they "tried their best" but we also have to uphold the law here. If GitHub, say, called him on his phone whether or not his actions were intended...they would've had to restore the account and the "broken" repository as it was before the suspension immediately...which I assume they did. My point is mostly that there is no legal contract between Marak and the "community", as he was never paid anything. Some might argue about mitigations in between disagreeing parties, but as I said there's nobody forcing you to use his library, just as there was nobody forcing you to update. It cannot be malicious intent if the other party is free to decide to just ignore it and move on.

anhner 5y ago
If you modify your car in your backyard sure, but it wasn't his backyard, it was the public roads, and it wasn't (just) his car, it was his car that he shared with his neighbours. And then he decided to tamper with the brakes as a "prank", knowing full well that others would then use the car.
- sam0x17 5y ago
  No. Imagine if all traffic lights were 3D-printed, and that entire infrastructure depended, as an active dependency each time a new traffic light is printed, on some random guy's 3D model that he decided to post on his personal blog years ago. Guy decides to take down the model, now all of a sudden his hosting provider takes control of his site and forces him to put the model back. That is the lens through which you should view this situation. The people building infrastructure that depends on one guy's 3D model existing on his blog at all times were the ones who made a mistake. If one of your thousands of dependencies breaks, shame on you, make a fork. The dependency owner owes you nothing, and he can change his creation or remove it any time he likes. If you weren't fortunate enough to fork it while it was still up, then too bad. Instead we as a corporate community are encouraging coddling and ensuring that if you make this mistake, GitHub, NPM, et al will take care of it for you. The downstream effects of this are much worse than the temporary damage of making people actually figure out their dependency chains.