7 ms·

This strikes me as hyper-defensive exercise in wrapping the lib thick with every cheap trapping of "community" to hand. I suspect because of the Open Collectiv

This strikes me as hyper-defensive exercise in wrapping the lib thick with every cheap trapping of "community" to hand. I suspect because of the Open Collective handover. In the end, this thing spits out strings. Does it need eight maintainers, only a few of whom had commits, in low double digits? Does it need its own GitHub org, Twitter account, and Google .dev domain? Addressing open pull requests could be good, but the rest of the roadmap looks like packaging, doc, twiddling with test infra, and more "community" again. That is also work, I suppose, but API and function feel baked. Before he did "bad", Marak did good. Overall, the vibe here is self-righteous hostile takeover. That's a pretty fraught concept I don't see a need to go near. Maybe it's not fair or accurate, for those better in the know. But from the outside looking in, seems to me a fork, a new name, and a quick tweak to package.json could fully address the issue of another 6.6.6-like release, cleanly. No special deals with the platforms. Name brainstorm, clone, fork, push, and publish of existing MIT code would have been intensely normal. Especially in JS land. I get that "community" is supposed to make me happy and calm. But in the end, I don't see anything here addressing root causes of what happened, or even speculating on what they might have been. Marak isn't the only solo leading projects who's snapped, and he won't be the last. It's convenient, but ridiculous, to say that has nothing to do with the environment we've built up. Plus we've learned a new way to lose donors, it being no mean feat to get them in the first place.

onion2k 5y ago
In the end, this thing spits out strings. That's not really a critism. 90% of web dev is string manipulation.
- balls187 5y ago
  Not worrying about endian conversion or the format of your floating point is a very good thing (Yes, I'm old enough to have dealt with software developed on Intel machines having to be ported to run on VAX based machines).
chaostheory 5y ago
Marak isn’t the only one who snapped, but he’s the only one to my knowledge who has introduced malicious commits to this code to purposely hurt other people’s projects. (Even Hans Reiser didn’t do that.) It seems that this might have been a precursor to Marak attempting to hurt people in real life "Hospitalized Queens man charged with reckless endangerment after cops find bomb-making materials in his home" https://www.nydailynews.com/new-york/nyc-crime/ny-queens-bomb-materials-man-charged-20200916-bybbhwqwijbuxg7ndsuy43w6zu-story.html https://www.nydailynews.com/new-york/nyc-crime/ny-queens-bom... I’m not surprised with Marak’s behavior given his mental state. What surprises me is the amount of support he’s garnered for his actions with a lot of people on HN.
- Sebb767 5y ago
  > What surprises me is the amount of support he’s garnered for his actions with a lot of people on HN. Well, his motivations were somewhat understandable and his actions were still scratching the realm of acceptable (not cool, but no serious damage and nobody was hurt). It's actually hitting the pretty much perfect spot to generate lots of discussions, since it's very easy and understandable to argue for either side.
  - chaostheory 5y ago
    What he did was no where near acceptable. Instead of adding an infinite loop to purposely sabotage other projects, he should have either walked away or changed the license for future versions of faker into a much more restricted one. SugarCRM transitioned their software from open source to closed source, and they’re still here with paying customers. There are also many restrictive licenses that change depending on the type of user eg free for personal use but paid for medium to large corporations
    - cxr 5y ago
      You don't get to tell other people what they should do for you.
      - 5y ago
Sebb767 5y ago
> In the end, this thing spits out strings. Does it need eight maintainers, only a few of whom had commits, in low double digits? Does it need its own GitHub org, Twitter account, and Google .dev domain? I'm pretty sure the org and multiple people are to avoid a single point of (mental) failure - quite reasonable given the project history. Also, if we really want to go that way, Google Search is also just a product that spits out strings. And a few orders of magnitude more over-engineered ;) > But in the end, I don't see anything here addressing root causes of what happened, or even speculating on what they might have been. Well, they have a larger team now, which can reasonably prevent a single person from doing that kind of damage when set up correctly. What other root cause are you looking for? Mental checkups for open-source maintainers? Redefining the "free" in free software?
- kemitchell 5y ago
  If what happened here was mental health, I'm not sure more people is more better, from a security standpoint. If it was strongly linked to workload and maintainers' plight, I'm not sure more scope is, either. If the harm done was time wasted and confusion incurred, I wonder about users who got burned teaming up as a group of eight. In any event, the median count of contributors to an open source project remains one. This team-up doesn't help projects != faker.js. As for scope, I haven't looked at this source in a while. But it seems the strings are still static, in the package: <https://github.com/faker-js/faker/tree/29234378807c4141588861f69421bf20b5ac635e/lib/locales https://github.com/faker-js/faker/tree/29234378807c414158886...>.
kekkidy 5y ago

onion2k 5y ago

In the end, this thing spits out strings. That's not really a critism. 90% of web dev is string manipulation.

balls187 5y ago
Not worrying about endian conversion or the format of your floating point is a very good thing (Yes, I'm old enough to have dealt with software developed on Intel machines having to be ported to run on VAX based machines).

chaostheory 5y ago

Marak isn’t the only one who snapped, but he’s the only one to my knowledge who has introduced malicious commits to this code to purposely hurt other people’s projects. (Even Hans Reiser didn’t do that.) It seems that this might have been a precursor to Marak attempting to hurt people in real life "Hospitalized Queens man charged with reckless endangerment after cops find bomb-making materials in his home" https://www.nydailynews.com/new-york/nyc-crime/ny-queens-bomb-materials-man-charged-20200916-bybbhwqwijbuxg7ndsuy43w6zu-story.html https://www.nydailynews.com/new-york/nyc-crime/ny-queens-bom... I’m not surprised with Marak’s behavior given his mental state. What surprises me is the amount of support he’s garnered for his actions with a lot of people on HN.

Sebb767 5y ago
> What surprises me is the amount of support he’s garnered for his actions with a lot of people on HN. Well, his motivations were somewhat understandable and his actions were still scratching the realm of acceptable (not cool, but no serious damage and nobody was hurt). It's actually hitting the pretty much perfect spot to generate lots of discussions, since it's very easy and understandable to argue for either side.
- chaostheory 5y ago
  What he did was no where near acceptable. Instead of adding an infinite loop to purposely sabotage other projects, he should have either walked away or changed the license for future versions of faker into a much more restricted one. SugarCRM transitioned their software from open source to closed source, and they’re still here with paying customers. There are also many restrictive licenses that change depending on the type of user eg free for personal use but paid for medium to large corporations
  - cxr 5y ago
    You don't get to tell other people what they should do for you.
    - 5y ago

Sebb767 5y ago

> In the end, this thing spits out strings. Does it need eight maintainers, only a few of whom had commits, in low double digits? Does it need its own GitHub org, Twitter account, and Google .dev domain? I'm pretty sure the org and multiple people are to avoid a single point of (mental) failure - quite reasonable given the project history. Also, if we really want to go that way, Google Search is also just a product that spits out strings. And a few orders of magnitude more over-engineered ;) > But in the end, I don't see anything here addressing root causes of what happened, or even speculating on what they might have been. Well, they have a larger team now, which can reasonably prevent a single person from doing that kind of damage when set up correctly. What other root cause are you looking for? Mental checkups for open-source maintainers? Redefining the "free" in free software?

kemitchell 5y ago
If what happened here was mental health, I'm not sure more people is more better, from a security standpoint. If it was strongly linked to workload and maintainers' plight, I'm not sure more scope is, either. If the harm done was time wasted and confusion incurred, I wonder about users who got burned teaming up as a group of eight. In any event, the median count of contributors to an open source project remains one. This team-up doesn't help projects != faker.js. As for scope, I haven't looked at this source in a while. But it seems the strings are still static, in the package: <https://github.com/faker-js/faker/tree/29234378807c4141588861f69421bf20b5ac635e/lib/locales https://github.com/faker-js/faker/tree/29234378807c414158886...>.

kekkidy 5y ago