3 ms·

CVE-2021-23567

4 points by soheilpro 5y ago

soheilpro 5y ago
The commit that caused this: https://github.com/Marak/colors.js/commit/074a0f8ed0c31c35d13d28632bd8a049ff136fb6 https://github.com/Marak/colors.js/commit/074a0f8ed0c31c35d1...
alexb_ 5y ago
So let me get this straight - open source maintainer gets mad when large companies "abuse" open source, despite him making it MIT licensed and choosing himself to allow large companies to use it? And he believes the best response is to break the entire library? Absolutely nobody forced this guy to use MIT - so why be mad when the license is used as written?
- greyface- 5y ago
  The MIT license says: THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT People are getting mad that this guy removed functionality from his open source project -- as if the open source license warranted fitness for a particular purpose.
  - alexb_ 5y ago
    I know what it says. Businesses, organizations, and basically everyone uses open source software because we all have a sort of agreement that says "Hey, the guy who maintains this software isn't going to purposefully fuck over everyone who is using it in a temper tantrum". Yes, what he did was legal. Conflating legality with morality is horrible, because this type of stuff is in no way, shape, or form moral. Doing things like this is also how you get absolutely nobody to use anything open source ever. It's horrible not just for his corner of the web that he wanted to have control over for some reason, but it affects the standing of ALL open source projects. Besides, what if instead of just breaking it, he installed a cryptominer? Or a backdoor? You can't just say "lulz it says no warranty, you have to hold that" and expect literally anybody to think that is a reasonable response. This is how you get large organizations to decide that maybe open source isn't worth the risk.

CVE-2021-23567

4 points by soheilpro 5y ago

The commit that caused this: https://github.com/Marak/colors.js/commit/074a0f8ed0c31c35d13d28632bd8a049ff136fb6 https://github.com/Marak/colors.js/commit/074a0f8ed0c31c35d1...

alexb_ 5y ago

So let me get this straight - open source maintainer gets mad when large companies "abuse" open source, despite him making it MIT licensed and choosing himself to allow large companies to use it? And he believes the best response is to break the entire library? Absolutely nobody forced this guy to use MIT - so why be mad when the license is used as written?

greyface- 5y ago
The MIT license says: THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT People are getting mad that this guy removed functionality from his open source project -- as if the open source license warranted fitness for a particular purpose.
- alexb_ 5y ago
  I know what it says. Businesses, organizations, and basically everyone uses open source software because we all have a sort of agreement that says "Hey, the guy who maintains this software isn't going to purposefully fuck over everyone who is using it in a temper tantrum". Yes, what he did was legal. Conflating legality with morality is horrible, because this type of stuff is in no way, shape, or form moral. Doing things like this is also how you get absolutely nobody to use anything open source ever. It's horrible not just for his corner of the web that he wanted to have control over for some reason, but it affects the standing of ALL open source projects. Besides, what if instead of just breaking it, he installed a cryptominer? Or a backdoor? You can't just say "lulz it says no warranty, you have to hold that" and expect literally anybody to think that is a reasonable response. This is how you get large organizations to decide that maybe open source isn't worth the risk.