4 ms·

It’s cool that you’re internet rules-lawyering and all but ultimately he used his free account with intent to harm others, just as surely as if he backdoored hi

It’s cool that you’re internet rules-lawyering and all but ultimately he used his free account with intent to harm others, just as surely as if he backdoored his code. Freedom of speech is good, and protest is fine, but why would GitHub amplify the speech of a nutso who abused his position of trust?

smoldesu 5y ago
They don't have to amplify anything. This is why open source is valuable; if the current maintainer is considered to be unfit or unreliable in some way, the community that disagrees with their rhetoric/leadership can fork the package and keep going like nothing happened. If you don't care/the package is still usable, then ideally no further action has to be taken. At no point down the road should that involve revoking someone's ownership of a software project, though. Software ownership is sacred, not just because of tradition but because understanding who owns your packages and libraries is paramount to auditing security. Some of the most valuable contributions to computer science have been ones that allow people to verify integrity, be it SHA, TLS or GPG. If Microsoft abuses their position of power to break that chain of integrity, how can we be sure that other repos belong to their respective authors? I can understand if you, the individual don't find this interesting or consider it inconsequential to your workflow. But other people rely on it, and you can't pretend like an honest chain of custody is somehow valueless.
- deleted 5y ago
  [deleted]
- BoorishBears 5y ago
  Amazing you wrote this entire comment without taking a second confirm the premise you're so passionately defending... No one took away his ownership. Marak: https://github.com/marak/Faker.js/ https://github.com/marak/Faker.js/ https://www.npmjs.com/package/faker https://www.npmjs.com/package/faker Post: https://github.com/faker-js/faker https://github.com/faker-js/faker https://www.npmjs.com/package/@faker-js/faker https://www.npmjs.com/package/@faker-js/faker Faker.js is not a trademarked term, so someone made a new Faker.js. In fact multiple people did, and one emerged as the preferred fork: https://twitter.com/faker_js/status/1481918305669627905 https://twitter.com/faker_js/status/1481918305669627905 - And to be clear, even if NPM goes and replaces his package with this new fork, it wouldn't take away his ownership. Github could do the same... doesn't take away his ownership. His ownership of a Github page is not his ownership of the code. I don't like this rules-lawyering stuff either, yet this is one time where even if you decide to be purposely inflexible with your understanding of laws/licensing/contracts etc... there's still no issue with how this has been handled.
diogenesjunior 5y ago
>he used his free account actually, marak has github pro, so it is not a free account
viraptor 5y ago
> used his free account with intent to harm others, just as surely as if he backdoored his code There's a huge difference between displaying a message and going in an endless loop and backdooring as in providing an alternative access to control a system you're not supposed to have access to. Words have meaning. This wasn't a backdoor.
- leshenka 5y ago
  There is a difference between robbery and burglary.
  - labster 5y ago
    There’s a difference between a simile and a metaphor too, but GP is ignoring the fact I used one of those entirely.
salawat 5y ago
I see only one of those alleged "nutso's", and that was GitHub. Everyone else should have been responsibly consuming the dependency. You don't get to call foul when you knowingly use something for something important and don't check to make sure it is okay.
- leshenka 5y ago
  Now that’s just plain victim blaming
  - salawat 5y ago
    As an engineer, part of your responsibility is to foresee this type of thing. Software that does exactly what it should, and is free of defects for it's immediate use case, has no need to be continually updated. As each line is adding more functionality you do not need. Even if you're trying to keep things rolling forward and buy into taking in updates anyway; you don't do it in such a way as to cause it to leak to production until you are good and certain there is no potential for breakage. If you haven't learned this yet, give a monorepo a try. I assure you, you will be divested of any naivete in this regard.
- porlune 5y ago
  Setting your package version to allow for minor updates _is_ responsibly consuming the dependency.
  - llukas 5y ago
    This sounds like "I responsibly test in production". If you do test and isolate testing environment then this kind of breaking update is just business as usual.
    - porlune 5y ago
      That's fair, it does sound like a novice take; but it's still "business as usual" w/r/t what is touted as best practices where it comes to version control. At least that's my slightly above novice take on the matter.
hinkley 5y ago
“Your freedom of speech ends at the tip of my nose.” as the saying goes. He took a swing, not just a stand.

smoldesu 5y ago

They don't have to amplify anything. This is why open source is valuable; if the current maintainer is considered to be unfit or unreliable in some way, the community that disagrees with their rhetoric/leadership can fork the package and keep going like nothing happened. If you don't care/the package is still usable, then ideally no further action has to be taken. At no point down the road should that involve revoking someone's ownership of a software project, though. Software ownership is sacred, not just because of tradition but because understanding who owns your packages and libraries is paramount to auditing security. Some of the most valuable contributions to computer science have been ones that allow people to verify integrity, be it SHA, TLS or GPG. If Microsoft abuses their position of power to break that chain of integrity, how can we be sure that other repos belong to their respective authors? I can understand if you, the individual don't find this interesting or consider it inconsequential to your workflow. But other people rely on it, and you can't pretend like an honest chain of custody is somehow valueless.

deleted 5y ago
[deleted]
BoorishBears 5y ago
Amazing you wrote this entire comment without taking a second confirm the premise you're so passionately defending... No one took away his ownership. Marak: https://github.com/marak/Faker.js/ https://github.com/marak/Faker.js/ https://www.npmjs.com/package/faker https://www.npmjs.com/package/faker Post: https://github.com/faker-js/faker https://github.com/faker-js/faker https://www.npmjs.com/package/@faker-js/faker https://www.npmjs.com/package/@faker-js/faker Faker.js is not a trademarked term, so someone made a new Faker.js. In fact multiple people did, and one emerged as the preferred fork: https://twitter.com/faker_js/status/1481918305669627905 https://twitter.com/faker_js/status/1481918305669627905 - And to be clear, even if NPM goes and replaces his package with this new fork, it wouldn't take away his ownership. Github could do the same... doesn't take away his ownership. His ownership of a Github page is not his ownership of the code. I don't like this rules-lawyering stuff either, yet this is one time where even if you decide to be purposely inflexible with your understanding of laws/licensing/contracts etc... there's still no issue with how this has been handled.

diogenesjunior 5y ago

>he used his free account actually, marak has github pro, so it is not a free account

viraptor 5y ago

> used his free account with intent to harm others, just as surely as if he backdoored his code There's a huge difference between displaying a message and going in an endless loop and backdooring as in providing an alternative access to control a system you're not supposed to have access to. Words have meaning. This wasn't a backdoor.

leshenka 5y ago
There is a difference between robbery and burglary.
- labster 5y ago
  There’s a difference between a simile and a metaphor too, but GP is ignoring the fact I used one of those entirely.

salawat 5y ago

I see only one of those alleged "nutso's", and that was GitHub. Everyone else should have been responsibly consuming the dependency. You don't get to call foul when you knowingly use something for something important and don't check to make sure it is okay.

leshenka 5y ago
Now that’s just plain victim blaming
- salawat 5y ago
  As an engineer, part of your responsibility is to foresee this type of thing. Software that does exactly what it should, and is free of defects for it's immediate use case, has no need to be continually updated. As each line is adding more functionality you do not need. Even if you're trying to keep things rolling forward and buy into taking in updates anyway; you don't do it in such a way as to cause it to leak to production until you are good and certain there is no potential for breakage. If you haven't learned this yet, give a monorepo a try. I assure you, you will be divested of any naivete in this regard.
porlune 5y ago
Setting your package version to allow for minor updates _is_ responsibly consuming the dependency.
- llukas 5y ago
  This sounds like "I responsibly test in production". If you do test and isolate testing environment then this kind of breaking update is just business as usual.
  - porlune 5y ago
    That's fair, it does sound like a novice take; but it's still "business as usual" w/r/t what is touted as best practices where it comes to version control. At least that's my slightly above novice take on the matter.

hinkley 5y ago

“Your freedom of speech ends at the tip of my nose.” as the saying goes. He took a swing, not just a stand.