9 ms·

Marak isn’t the only one who snapped, but he’s the only one to my knowledge who has introduced malicious commits to this code to purposely hurt other people’s p

Marak isn’t the only one who snapped, but he’s the only one to my knowledge who has introduced malicious commits to this code to purposely hurt other people’s projects. (Even Hans Reiser didn’t do that.) It seems that this might have been a precursor to Marak attempting to hurt people in real life "Hospitalized Queens man charged with reckless endangerment after cops find bomb-making materials in his home" https://www.nydailynews.com/new-york/nyc-crime/ny-queens-bomb-materials-man-charged-20200916-bybbhwqwijbuxg7ndsuy43w6zu-story.html https://www.nydailynews.com/new-york/nyc-crime/ny-queens-bom... I’m not surprised with Marak’s behavior given his mental state. What surprises me is the amount of support he’s garnered for his actions with a lot of people on HN.

Sebb767 5y ago
> What surprises me is the amount of support he’s garnered for his actions with a lot of people on HN. Well, his motivations were somewhat understandable and his actions were still scratching the realm of acceptable (not cool, but no serious damage and nobody was hurt). It's actually hitting the pretty much perfect spot to generate lots of discussions, since it's very easy and understandable to argue for either side.
- chaostheory 5y ago
  What he did was no where near acceptable. Instead of adding an infinite loop to purposely sabotage other projects, he should have either walked away or changed the license for future versions of faker into a much more restricted one. SugarCRM transitioned their software from open source to closed source, and they’re still here with paying customers. There are also many restrictive licenses that change depending on the type of user eg free for personal use but paid for medium to large corporations
  - cxr 5y ago
    You don't get to tell other people what they should do for you.
    - balls187 5y ago
      But you do get to criticize poor judgement and provide reasonable alternative courses of action.
      - cxr 5y ago
        Nice bait-and-switch, but we can scroll back and see how relevant your defense of the comment I responded to really is. Declamations are fine; declarations about what is "acceptable" and what "they should have done" are more than mere criticism of poor judgement, etc., and are what the author of the comment I responded to actually wrote.
        balls187 5y ago
        > Instead of adding an infinite loop to purposely sabotage other projects, he should have either walked away or changed the license for future versions of faker into a much more restricted one Then from the context, you can clearly read the comment you responded to did not mention that Makar needed to do anything for him specifically.
        cxr 5y ago
        > he should have either [done this thing (that I deem would be "acceptable") or this other thing] (This is my last response to you, since you were strawmanning from the beginning and this is obviously not going to go anywhere that doesn't involve intellectual dishonesty dressed up as a clever retort.)
        balls187 5y ago
        Or ad hominem attacks.
  - Aeolun 5y ago
    > he should have either walked away or changed the license for future versions of faker He could have, and nobody would be talking about or remarking on it at all, which rather defeats the point.
    - chaostheory 5y ago
      Actually, when redis changed their license to get paid by cloud services like Amazon, there was a huge uproar. The people behind redis didn’t purposely break anything, had a lot of people talking about it, and had a clearer way towards getting paid. There are better ways to bring attention to an important issue.
  - Sebb767 5y ago
    > What he did was no where near acceptable. It was a rebellious act against (what seems like) overbearing organizations, comparable to spraying a graffiti on their walls. As I said, there was no serious damage and nobody was hurt; it's not like he burned down buildings or shot at people. I'm of the opinion that this was not the right way as well, but in the end it really wasn't that bad.
    - chaostheory 5y ago
      Changing the license would be just as “rebellious” and it wouldn’t have hurt anyone. It also would have drastically increased his chances of getting paid. Given his bomb making activities, I feel that this was more of an excuse to watch the world burn.
kemitchell 5y ago
I'm sure 6.6.6 threw a spanner in the works for folks who didn't lock deps. Not great. But Marak's one of us. This feels a lot bigger than that. I don't have a direct line on what happened to him, or where it took him, mentally or otherwise. But the hints so far aren't great. To one of us. I think the responses from the platforms---GitHub, OpenCollective---get folks thinking, whether they feel it that way or not.
- chaostheory 5y ago
  What GitHub did was completely reasonable. They mitigated harm to their users on their own infrastructure and property. They did not change his code. They just took down his malicious code that caused harm. The vast majority of people on HN would never purposely harm strangers. Most of these strangers are fellow developers ie “Us”
  - kemitchell 5y ago
    I understand some of the imperatives GitHub's people must have felt. I've advised folks providing open source infra under drama, though I can't talk details. I'm sure the people who got burned on builds had bad days. It's not fair to blame them entirely, for not locking deps. It is fair to point out this isn't the first time builds have broken, with npm or other repositories. Nor the most widespread in effect. Does this count as a crisis? If anything, I suspect a crisis of faith. Seeing bad things can come of `npm install`, and those bad things might be intentional or just plain weird, instead of well intended but accidental, can make people anxious. Publishers to npm don't just disappear or malfunction. Their faults can be byzantine. But there are defenses against them. On the maintainer side, like it or not, we all have an editor when it comes to publishing on GitHub. But it matters how invasively that power gets wielded, and how heavy-handed it's perceived. This episode suggests to me that the threshold for intervention in the name of user interest's pretty low. That's based on the information I have. Perhaps GitHub will share more on the blog.
    - chaostheory 5y ago
      If people want full control over their repo, then they shouldn’t use GitHub, gitlab, bitbucket or any other free service. They should host it on their own server. This is an open and shut case. GitHub did the right thing.
Gigachad 5y ago
I don't think what he did was particularly good but I think he was entitled to do it. And the blame falls on the system we have which relies on random people to do work for free with no contract or obligation. It's like if a business delivered packages by asking some random homeless person on the street to walk it to its destination. And then one day the person just chucks your package in the river instead of delivering it. It's amazing that the company got so much value out of a free service for so long rather than shocking that it eventually didn't work.
- balls187 5y ago
  > And then one day the person just chucks your package in the river instead of delivering it. That analogy makes little sense. In my county, what you described is malicious mischief, and is a crime. A homeless person is not entitled to act in such a manner.
- bee_rider 5y ago
  Most of the companies that got hit by this (and any paying attention) will probably just change their deployment strategy to slightly slow down their updates. I guess this is equivalent to... I dunno, checking if the random homeless person had at least made one successful delivery? Except the analogy breaks down because code doesn't randomly begin to pick up different behaviors without any intervention (Well, hopefully!).
- WarChortle 5y ago
  Open source works because we can trust authors to not maliciously harm other people. If it was a bug that's one thing it happens, you move on. But when you purposely do something that you know will cause harm to people that is where I draw the line. Your analogy isn't even close. No one forced him to write faker.js. He chose to do it and he chose to make it open source under a license allowing people to use it. He also chose to maintain it and help people with issues. If he didn't want to maintain it anymore, It is his right to stop. No company could force him to continue. But he nor anyone is not entitled to add malicious code. Full stop that is where I draw the line. I can't believe anyone is defending that.
runarberg 5y ago
A social scientist who has studied industrial sabotage might be able to correct me if I’m wrong: But I have read one (1) book on the subject—which frankly is one more then most—and I don’t think there is any evidence of correlation between industrial saboteurs and sociopathy. In fact, quite the contrary, saboteurs often go to quite a length to prevent people being physically harmed in the sabotage. A saboteur is more often then not mostly frustrated at their employer, or the industry, and try to maximize harm to those entities, not innocent bystanders. However given that saboteurs are often quite angry and have often been in a prolonged state of stress, and most often act alone—keeping their plans secret until they are executed—they are often not in the best position to correctly estimate who will receive the most harm. In our industry there are plenty of frustrated workers, some are underpaid, others are overworked, some work for entities they morally object to, etc. When a colleague engages in this kind of sabotage which causes disruption on some scale we might see it as an act of solidarity from a shared frustration. This is certainly the case in other industries, and I don’t think tech is any different. In fact this incident reviles that our industry might even be more vulnerable to industrial sabotage then other industries.
- chaostheory 5y ago
  Most of what you’ve written is valid. The main issue I have is that you’re implying that software developers and engineers are “underpaid”. That doesn’t reflect reality. We are one of the highest paid professions in the US due to several factors. There is also a lot of career mobility ie If you’re not happy, change companies. The other issue is assuming that Marak is rational. I do not believe he is at the moment since he was involved with manufacturing homemade bombs at his apartment.

Sebb767 5y ago

> What surprises me is the amount of support he’s garnered for his actions with a lot of people on HN. Well, his motivations were somewhat understandable and his actions were still scratching the realm of acceptable (not cool, but no serious damage and nobody was hurt). It's actually hitting the pretty much perfect spot to generate lots of discussions, since it's very easy and understandable to argue for either side.

chaostheory 5y ago
What he did was no where near acceptable. Instead of adding an infinite loop to purposely sabotage other projects, he should have either walked away or changed the license for future versions of faker into a much more restricted one. SugarCRM transitioned their software from open source to closed source, and they’re still here with paying customers. There are also many restrictive licenses that change depending on the type of user eg free for personal use but paid for medium to large corporations
- cxr 5y ago
  You don't get to tell other people what they should do for you.
  - balls187 5y ago
    But you do get to criticize poor judgement and provide reasonable alternative courses of action.
    - cxr 5y ago
      Nice bait-and-switch, but we can scroll back and see how relevant your defense of the comment I responded to really is. Declamations are fine; declarations about what is "acceptable" and what "they should have done" are more than mere criticism of poor judgement, etc., and are what the author of the comment I responded to actually wrote.
      - balls187 5y ago
        > Instead of adding an infinite loop to purposely sabotage other projects, he should have either walked away or changed the license for future versions of faker into a much more restricted one Then from the context, you can clearly read the comment you responded to did not mention that Makar needed to do anything for him specifically.
        cxr 5y ago
        > he should have either [done this thing (that I deem would be "acceptable") or this other thing] (This is my last response to you, since you were strawmanning from the beginning and this is obviously not going to go anywhere that doesn't involve intellectual dishonesty dressed up as a clever retort.)
        balls187 5y ago
        Or ad hominem attacks.
- Aeolun 5y ago
  > he should have either walked away or changed the license for future versions of faker He could have, and nobody would be talking about or remarking on it at all, which rather defeats the point.
  - chaostheory 5y ago
    Actually, when redis changed their license to get paid by cloud services like Amazon, there was a huge uproar. The people behind redis didn’t purposely break anything, had a lot of people talking about it, and had a clearer way towards getting paid. There are better ways to bring attention to an important issue.
- Sebb767 5y ago
  > What he did was no where near acceptable. It was a rebellious act against (what seems like) overbearing organizations, comparable to spraying a graffiti on their walls. As I said, there was no serious damage and nobody was hurt; it's not like he burned down buildings or shot at people. I'm of the opinion that this was not the right way as well, but in the end it really wasn't that bad.
  - chaostheory 5y ago
    Changing the license would be just as “rebellious” and it wouldn’t have hurt anyone. It also would have drastically increased his chances of getting paid. Given his bomb making activities, I feel that this was more of an excuse to watch the world burn.

kemitchell 5y ago

I'm sure 6.6.6 threw a spanner in the works for folks who didn't lock deps. Not great. But Marak's one of us. This feels a lot bigger than that. I don't have a direct line on what happened to him, or where it took him, mentally or otherwise. But the hints so far aren't great. To one of us. I think the responses from the platforms---GitHub, OpenCollective---get folks thinking, whether they feel it that way or not.

chaostheory 5y ago
What GitHub did was completely reasonable. They mitigated harm to their users on their own infrastructure and property. They did not change his code. They just took down his malicious code that caused harm. The vast majority of people on HN would never purposely harm strangers. Most of these strangers are fellow developers ie “Us”
- kemitchell 5y ago
  I understand some of the imperatives GitHub's people must have felt. I've advised folks providing open source infra under drama, though I can't talk details. I'm sure the people who got burned on builds had bad days. It's not fair to blame them entirely, for not locking deps. It is fair to point out this isn't the first time builds have broken, with npm or other repositories. Nor the most widespread in effect. Does this count as a crisis? If anything, I suspect a crisis of faith. Seeing bad things can come of `npm install`, and those bad things might be intentional or just plain weird, instead of well intended but accidental, can make people anxious. Publishers to npm don't just disappear or malfunction. Their faults can be byzantine. But there are defenses against them. On the maintainer side, like it or not, we all have an editor when it comes to publishing on GitHub. But it matters how invasively that power gets wielded, and how heavy-handed it's perceived. This episode suggests to me that the threshold for intervention in the name of user interest's pretty low. That's based on the information I have. Perhaps GitHub will share more on the blog.
  - chaostheory 5y ago
    If people want full control over their repo, then they shouldn’t use GitHub, gitlab, bitbucket or any other free service. They should host it on their own server. This is an open and shut case. GitHub did the right thing.

Gigachad 5y ago

I don't think what he did was particularly good but I think he was entitled to do it. And the blame falls on the system we have which relies on random people to do work for free with no contract or obligation. It's like if a business delivered packages by asking some random homeless person on the street to walk it to its destination. And then one day the person just chucks your package in the river instead of delivering it. It's amazing that the company got so much value out of a free service for so long rather than shocking that it eventually didn't work.

balls187 5y ago
> And then one day the person just chucks your package in the river instead of delivering it. That analogy makes little sense. In my county, what you described is malicious mischief, and is a crime. A homeless person is not entitled to act in such a manner.
bee_rider 5y ago
Most of the companies that got hit by this (and any paying attention) will probably just change their deployment strategy to slightly slow down their updates. I guess this is equivalent to... I dunno, checking if the random homeless person had at least made one successful delivery? Except the analogy breaks down because code doesn't randomly begin to pick up different behaviors without any intervention (Well, hopefully!).
WarChortle 5y ago
Open source works because we can trust authors to not maliciously harm other people. If it was a bug that's one thing it happens, you move on. But when you purposely do something that you know will cause harm to people that is where I draw the line. Your analogy isn't even close. No one forced him to write faker.js. He chose to do it and he chose to make it open source under a license allowing people to use it. He also chose to maintain it and help people with issues. If he didn't want to maintain it anymore, It is his right to stop. No company could force him to continue. But he nor anyone is not entitled to add malicious code. Full stop that is where I draw the line. I can't believe anyone is defending that.

runarberg 5y ago

A social scientist who has studied industrial sabotage might be able to correct me if I’m wrong: But I have read one (1) book on the subject—which frankly is one more then most—and I don’t think there is any evidence of correlation between industrial saboteurs and sociopathy. In fact, quite the contrary, saboteurs often go to quite a length to prevent people being physically harmed in the sabotage. A saboteur is more often then not mostly frustrated at their employer, or the industry, and try to maximize harm to those entities, not innocent bystanders. However given that saboteurs are often quite angry and have often been in a prolonged state of stress, and most often act alone—keeping their plans secret until they are executed—they are often not in the best position to correctly estimate who will receive the most harm. In our industry there are plenty of frustrated workers, some are underpaid, others are overworked, some work for entities they morally object to, etc. When a colleague engages in this kind of sabotage which causes disruption on some scale we might see it as an act of solidarity from a shared frustration. This is certainly the case in other industries, and I don’t think tech is any different. In fact this incident reviles that our industry might even be more vulnerable to industrial sabotage then other industries.

chaostheory 5y ago
Most of what you’ve written is valid. The main issue I have is that you’re implying that software developers and engineers are “underpaid”. That doesn’t reflect reality. We are one of the highest paid professions in the US due to several factors. There is also a lot of career mobility ie If you’re not happy, change companies. The other issue is assuming that Marak is rational. I do not believe he is at the moment since he was involved with manufacturing homemade bombs at his apartment.