27 ms·
Open source ‘protestware’ harms Open Source
- tomjen3 5y agoIt could certainly have been done better: if it has instead ran a torrent client that downloaded actual video from Ukraine it might actually have done something. I get the author, it is impossible to see what is actually going on and not want to eviscerate Russia but the way he did it was counter productive.
- deleted 5y ago[deleted]
- foolzcrow 5y ago[dead]
- cosmiccatnap 5y ago
- seanw444 5y agoI just don't understand what the node-ipc dev was expecting when he did that. "Hm, maybe if I put malware into a community-trusted module that destroys files of people in a certain geopolitical region, the countless innocent citizens that are affected will realize what they did wrong! Wait, who am I actually targeting again?"
- Larrikin 5y agoProbably hoped the effects would negatively effect people there so they could put pressure to stop the murder of other innocent civilians. Arguments like this are similar to the BLM protest that try to equate property with human lives.
- bnt 5y agoOr, you know, I’ll never touch Vue.js again?
- JumpCrisscross 5y agoCharitably, it creates a new friction for Russian business in deploying open-source software. That drag further diminishes Russia’s economy, and thus, its warmaking ability.
- FerociousTimes 5y agoAt best, this operation could be construed as an act of vandalism or at worst an act of CYBER terrorism. This indiscriminate and malicious act of hostility was carried by what amounted to be a cyber weapon (think IED) housed in a very ordinary and non-suspicious package to cause the greatest damage to the users' data.
- JumpCrisscross 5y ago> this operation could be construed as an act of vandalism or at worst an act of CYBER terrorism Could be. But by whom? To what effect? One of the downsides of losing credibility as a nation state is the concepts of deference, retaliation and proportionality lose weight. There is no indication that the facts on the ground would affect whether Putin deems something a cyber attack. Worse, one's own policing actions are likely to cause more damage as propaganda pieces than ignoring the issue. Yes, in an international law framework this would be prosecuted in the U.S. But in that framework Russia wouldn't be in Ukraine. Add to that it's tacit approval of its own hackers, and it's difficult--in a realpolitik frame--to find support for doing anything about this other than minor finger wagging.
- FerociousTimes 5y ago> Could be. But by whom? To what effect? The general public. I speculate that publicity was one of the main objectives behind this operation to draw attention to his political grievances and maybe demands. Perhaps we should focus more on the issue of bragging rights. The perpetrator probably thinks he's some kind of a hero having conducted this operation and it was some kind of a heroic feat sticking up to Putin when he in fact is more of a lousy vandal destroying some poor guy's store window than an epic warrior conquering foreign lands and subduing evil emperors. The more people realize this and esp. people who are prone to commit these acts, the more innocent people would be spared the damage incurred by those reckless attacks.
- gruez 5y ago>Arguments like this are similar to the BLM protest that try to equate property with human lives. Yeah, but the problem with this is that, taken to its logical conclusion, you end up with a nihilistic view that's basically "do you support The Cause? if yes then any protest action is acceptable, if no then any minor transgression should be cracked down by law enforcement". This works especially well when The Cause is something that could plausibly affect tens of millions of people, so you can excuse quite a lot of damage.
- potta_coffee 5y agoArguments like this are superficial and justify bad behavior. Destruction of property isn't murder, but it's still not ok and it still causes harm to living people who have no influence over the issue.
- shadowgovt 5y ago> who have no influence I believe the crux of the political theory is that in a representative democracy, nobody has no influence over the issue.
- Miraste 5y agoThat is obviously not true, and even if it were, the country in question is Russia, an autocracy. What is our poor hypothetical node developer expected to do, march down to the Kremlin and beat Putin with his MacBook?
- shadowgovt 5y agoParent comment originally referred to Black Lives Matter; I had been responding to that part of the comment (and its relation to US politics).
- mrguyorama 5y agoThis is Russia we are talking about right? A country that has had countless uprisings of literal serfs with farming implements replacing their government.
- vorpalhex 5y agoIt's not acceptable to burn down someone's house because you disagree with them. Even if you disagree with them a lot. Please don't burn people's houses down. If you burn down people's houses, you will be arrested and go to jail.
- baud147258 5y ago> they could put pressure to stop In case you haven't checked, both targeted countries are authoritarian regimes where any kind of civil protest is ignored at best or actively suppressed at worst. And violent regime changes (aka revolutions) coming from the people don't work, at least not without the support of part of the governing elites (which aren't impacted by that kind of actions)
- wrycoder 5y agoRevolutions have succeeded time and again. The problem is that in most cases, the kind of people who lead successful revolutions are not the kind who can form a non-autocratic government. It can take generations to correct the resulting chaos and totalitarian excesses.
- HideousKojima 5y agoI have a legal (and moral) right to defend my property, often with deadly force. My property came into my possession by my own labors and time, i.e. by sacrificing part of my life to obtain it. Even if the property was gifted to me, that means that someone else sacrificed part of their life to give it to me. When someone violates my rights in the process of "protesting" something, I am legally and morally justified in using force to protect my rights. This includes the right to the property that I own.
- Larrikin 5y agoWhere is this true? In the US you have the right to murder if the person is in your home and in some states you have the right to murder if you feel your life is being threatened, in this case because you're being robbed. If you left your car running while you ran into the store you don't have the right to shoot the guy in the back as he drives off. You file a police report and potentially sue for damages. You definitely don't have the right to shoot someone for burning down your local Target.
- HideousKojima 5y agoIf someone is trying to burn down my house with me in it, I have a right to shoot them in pretty much every jurisdiction in the US. If someone is burning down my store with me in it, I also have the right to use deadly force to defend it.
- SamoyedFurFluff 5y agoLet’s step back a little, please. This original context was about some BLM protests doing property damage, which included smashing storefronts and trash fires on the street.
- HideousKojima 5y agoThey also included burning down buildings, not just trash in the street.
- yyyk 5y agoI can't agree with these arguments. A) IP geolocation is far from perfect, quite a few completely unrelated people could have been affected. B) There was a chance of massive collateral damage to stuff like hospitals, water company, etc. and therefore affecting civilians, including children. If you think Putin wouldn't use that to rally Russia and launch a massive war, you haven't observed Putin for long. We got very lucky this software equivalent of a warcrime was stopped early. Yet the punishment was absurdly light. I will staying away from NPM after that.
- FDSGSG 5y ago> If you think Putin wouldn't use that to rally Russia and launch a massive war, you haven't observed Putin for long. Do you believe that node-ipc would do this but the current vastly more impactful sanctions regime wont? Also, everybody capable of thinking understands that Russia isn't capable of launching another "massive war" when it already has almost all of its conventional combat power committed to Ukraine. If you think Putin would launch a nuclear war over wiper malware, you're an idiot. There's no other kind of "massive war" he could launch at this point. > this software equivalent of a warcrime Why not call it software holocaust if we're gonna go there? What's wrong with you?
- yyyk 5y ago>Do you believe that node-ipc would do this but the current vastly more impactful sanctions regime wont? >There's no other kind of "massive war" he could launch at this point. Russian society isn't anywhere near enthusiastic. That's why Putin has been searching for ever dumber excuses. Give him an actual indefensible incident to rally society around, and he'll get a lot more manpower. That could expand the war to Odessa and Moldova, and also 'retaliatory' cyberwar in the West. Now, there's a level of escalation I'm fine with risking - say, over stationing peacekeepers in parts of Ukraine. Stuff that actually helps Ukrainians. But over an self-appointed idiot's personal action which doesn't help anyone and nobody asked for? $#@! no. >Why not call it software holocaust if we're gonna go there? What's wrong with you? It's attacking civilians as to influence their government (except Russia is a dictatorship and the government doesn't even care). I have more pointed comparisons in mind, but I'll spare the thread.
- gruez 5y ago>"Hm, maybe if I put malware into a community-trusted module that destroys files of people in a certain geopolitical region, the countless innocent citizens that are affected will realize what they did wrong! Wait, who am I actually targeting again?" "yeah but countless ukranian women and children are getting murdered by russians! surely a few wiped hard drives is worth it to raise awareness?" /s of course, but people who hold this view sincerely isn't hard to find.
- deleted 5y ago[deleted]
- lioeters 5y agoMy guess is that they got caught up in the socially accepted "hate fest" against citizens of a certain country, particularly by private companies.
- pkulak 5y agoIf a company does business in Russia right now, they are giving money to the Russian government which will be used to kill Ukrainians. Let's not conflate wartime trade policy with Twitter wokeness marketing.
- deleted 5y ago[deleted]
- slig 5y agoWhat about countries buying oil and gas from them?
- 542458 5y agoYes, that is bad too. However, in some cases it is necessary to prevent people from freezing, so there is a balancing act. Note that fossil fuel dependency just became a much more common political discussion item in Europe.
- gruez 5y agoWhile it's unreasonable to expect europeans to freeze to death to protect ukranians, I think there's a middle ground between "business as usual" and "protect ukraine at all costs" that's not being considered here. Specifically, turning the temperature down to 5-10°C and wearing a coat. I doubt you'll be freezing to death in those circumstances. Is there widespread effort by europeans to do this? If not, then the parent's is still mostly correct: europeans are not willing to endure slight discomfort to prevent "giving money to the Russian government which will be used to kill Ukrainians".
- 5y ago
- ryanmarsh 5y agoI’m ok with it as long as the maintainer is consistent and does it for “the current thing” every time. That means Sudan, Darfur, Iraq war, ISIS, Assad’s regime, etc… Heck why not even Florida after the “say gay” thing?
- KevinEldon 5y agoSounds like an opportunity to create a Protest Current Thing as a Service.
- octopoc 5y agoThis is a cool idea. You would probably want to run the PCCaaS as a non-profit and donate some of the money (5% seems generous?) to appropriate causes. The main API would be for displaying an appropriate banner of course. Another API would be to determine if a specific domain subscribes to the service and how much they care about the appropriate topic (in terms of "points" which are partly correlated with how much they spend on the PCCaaS, but also with some human input). This would be useful to people looking to vote with their wallet. I bet there are plenty of artists who would love to make custom banners, kind of like Google's doodle of the day. A third API would be to get notified when a customer downgrades or terminates their plan with the Protest Current Thing as a Service. Journalists could subscribe to this last API to get ideas for news stories. /s
- a9h74j 5y agoPivoting now from Ad-Blocker development to CurrentThingBannerBlocker development.
- gadders 5y agoNPC as a service.
- beachy 5y agoThat's a great idea. The only problem would be determining the correct set of things to be protested at any given time. So I'd suggest grouping them into flavors - say US liberal or US conservative flavors. You just choose the one you subscribe to and then let the service decide whether to insert say BLM or anti-CRT messages at any given time.
- raxxorrax 5y agoWorse, he also provides ammunition for Kremlin propaganda. Which already is easier because people don't trust the press. Which is also understandable because some write a lot of bullshit.
- joshstrange 5y agoI don't buy this argument. It's the same argument used for "Well the Democrats can't talk about/attempt doing X because the Republicans will misrepresent it and twist their words" when at the end of the day the Republicans will manufacture whatever they want regardless of what the Democrats say. Better to be called a "socialist" while actively trying to do something that will help people verses still being called a "socialist" while doing nothing. Kremlin is going to Kremlin, aka lie and spread propaganda. Let's not pretend that protestware is making their job so much easier, it's a tiny drop in a tsunami of lies and disinformation that the Kremlin puts out daily.
- FDSGSG 5y agoI just don't understand what Western governments were thinking when they sanctioned Russian businesses. "Hm, maybe if I put laws into the books that destroy the economy of a country and drives people in a certain geopolitical region into poverty, the countless innocent citizens that affected will realize what they did wrong! Wait, who am I actually targeting again?" Oh wait.
- AllegedAlec 5y agoIt's like they never looked at the effects of the Treaty of Versailles
- kbelder 5y agoPoverty and economic distress, deliberately exacerbated by the West, was what took down the USSR... and the fall of the USSR was one of the great achievements of the 2nd half of the 20th century.
- FDSGSG 5y agoExactly, demonstrating how laughable the comments here are. Malware is somehow supposed to be worse than the far more painful sanctions, it's fascinating to see how detached from reality many commenters here are. Both the sanctions and wiper malware targeting Russia are good things.
- rauli_ 5y agoAnd he used third party service to do the geolocation, so that whoever maintains that could have caused significant damage by changing it to return fake responses.
- DoctorOW 5y agoSurprised I didn't see this elsewhere in the thread but what they were thinking was totally different. From what I've heard the code wasn't meant to destroy files, it was buggy. Sure it was negligence with a bad outcome, but the intentions were good.
- hahaitsfunny 5y agoYeah well most software developers, just like most people, would rather engage in warfare with their fellow working-class man than the man, which is unfortunate because that should be everyone's target - not one another. We should be asking ourselves how can we write software the frees us from the tyranny of government, and instead helps us to foster self-reliant, communities of support and mutual-aid, which serve the best interests of those who participate in them. These are the tenants of anarcho-communism and FOSS - not sticking it to Russia and cheering on the dumping of weapons into a war zone...
- cthulha 5y agoHow about: “Actors in this geopolitical region are killing people and destroying infrastructure, and I am going to do everything in my power to disrupt them” “If more people stood up like this, then either bad actors would have to abandon open-source and pay a dramatic penalty in cost and speed of IT, or they would have to pay open-source maintainers to ensure the . Either way is a win” “People who don’t like this don’t share my values - they can prioritize the lives of Ukrainians and get on board, or they can maintain a project and provide an alternative, or they can get out of my way while I do something I think is very important”
- commandlinefan 5y agoI'm in Texas. A LOT of Californians disagree with some of the laws that Texas has passed. How long will it be until my hard drive gets reformatted by some protestor in San Francisco who localizes my IP address?
- rsstack 5y agoThe only good news I have for you is that _perhaps_ in that case the FBI and CISA will investigate, because there will be a US resident victim. IP-based geolocation is garbage but there aren't many Russian/Belarusian-attributed IPs in the US so the intersection of those with people using node-ipc was empty, and the US Government couldn't be pressured to investigate/enforce.
- nsxwolf 5y ago
- cpitman 5y ago100%. I've already seen articles in non-tech media that explain what happened to a non-technical audience, and the explanation sounded a lot like open source is the problem and that proprietary software would never have these problems. It wasn't that long ago that using open source software required a lot of politicking inside my clients, and we could easily go back there with enough spooked executives.
- Palomides 5y agoa disagreeable take: why should open source projects make any effort to be accessible to corporations that will never donate or support them?
- Cthulhu_ 5y agoBecause open source is idealistic and altruistic to a fault; it is the antithesis to "got mine, fuck you", or that of the capitalist "fuck you, pay me". If you limit access to anyone it is, by definition, no longer open source. I mean there's probably plenty of licenses that restrict commercial usage of open source software. That said, I'm all for open source software monetization; include messages in the README, code, or logging that basically says something to the tune of "If you are using this for commercial purposes, please consider donating / sponsoring / hiring". I think Github and co can do a lot more as well to encourage big corporations to pay open source contributors.
- harry8 5y agoCounter point: if bigcos are so damn stupid they avoid open source & Free software for idiotic reasons that creates space for less stupid startups who will do and be better. Why do we need to save the rich ignorant and prejudiced from themselves? They're not worthy object of charity.
- JumpCrisscross 5y ago> not worthy object of charity Most people, certainly productive people, are employed by companies. Take an extremist position on who your product works for and you limit the developer pool. An agnostic competitor would be expected to replace you.
- DeathArrow 5y agoOpen source malware? That's a new one!
- BaronVonSteuben 5y agoPerhaps I'm overthinking this, but open source malware is absolutely not new. It's been around basically as long as the internet has (and I mean pre-www). You could even argue that it pre-exists the internet since phone phreakers were sharing "code" earlier than that.
- DeathArrow 5y agoThat's true that malware source code was available in the open even before large scale Internet access. But no one made a fuss about licensing, "freedom", philosophy and the authors were mostly unknown.
- Aspie96 5y agoTechnically it was obfuscated, so not open source by definition.
- jraph 5y agonpm install is such a scary command these days (or yarn install, same thing). I never liked it because of the shitload of dependencies it usually pulls but now I would hesitate running it outside a well isolated container. This event added to the strong distrust I came to have on NPM these last months. The NPM ecosystem seems incredibly immature and unreliable and any Javascript project depending on NPM is now a potential future malware. By the way, does anyone know an easy way to use Svelte without depending on NPM? Because if not I might reconsider my choice of using it in a side project despite me liking it. In theory the same things could happen for PIP, Maven, Gradle, their Rust and Go counterpart and any such package manager. Any data on this?
- cyberpunk 5y ago> In theory the same things could happen for PIP, Maven, Gradle, their Rust and Go counterpart and any such package manager. Any data on this? Supply chain attacks, such as these, can definitely happen to any language. NPM seems to be a nice target simply because the volume of deps your avg 'simple' node project has (I mean, 'npm generate'ing a simple strapi-backed static site for us and there's ~300mb of node_modules...). There's not really a cure. You can peg your deps to a version, but with that much code in there, you're never going to really know if that version is compromised. If you can come up with a solution, there's money to be made.. Edit: The best we really have atm is just scanning for known vulns with stuff like xray/lifecycle/dependabot. Better than nothing, but for sure there are malicious packages out there yet to be discovered.
- potta_coffee 5y agoIt can be a problem in any language or package manager but in my Golang project, I have a single dependency outside of the standard library, in my Javascript project I conservatively have 200+ (if I consider all the packages installed by my primary dependencies). The surface area is just that much bigger and the packages change so frequently.
- cyberpunk 5y agoSo you recon a better (bigger?) node stdlib would solve a lot of this?
- cestith 5y agoBram Moolenaar famously uses Vim to raise awareness. A VPN package, dead drop website, steganography package, onion router, multi-point P2P routing mesh drivers, or other software and education on how to use them could really make a difference for dissidents. There are certainly productive ways to use software to support protests, organizing, workers' strikes, or even support targeted sabotage or insurrections without indiscriminately destroying people's data.
- alexb_ 5y agoHe uses it to help starving children by including a message on startup. That's a little more agreeable and less political than all of the things you listed. To try and compare it is fucking absurd.
- dspillett 5y ago> That's a little more agreeable and less political I don't think the difference is the message and how political it might be, but the way the message is delivered. A message, or even refusing to run¹, is completely different to deleting or corrupting data. [1] though unless that is very precisely targetted I'd still think it a step too far.
- shkkmo 5y agoHuh? It isn't really clear what you are arguin against. The commentor you are responding to is agreeing with the article that using your project to spread a message is ok and possibly even helpful. It is betraying that trust to make indescriminant attacks that harms. If peoole want to do more than just add a message, the author pointa out a number of types of software that people can cobtribute to that would have a more direct positive impact.
- cestith 5y agoOne of the things I listed is more agreeable than all of the things I listed? Please tell me more about how that works.
- ZeroGravitas 5y agoPoorly chosen headline. As the text makes clear, 'protestware' as a concept is fine, destroying random people's data is not. > When deployed, this ‘protestware’ expresses the maintainer’s opposition to the Russian government’s invasion of Ukraine. Most protestware simply displays anti-war or pro-Ukrainian messages when run. This is a non-violent, creative form of protest that can be effective.
- laurent123456 5y agoI wonder is protestware as a concept is fine. It's a form of ads, just people pushing their opinion in front of everybody just because they can. Sure, everybody's against the war, but what if the message was a more controversial anti-this or pro-that topic - do we really want to have these messages popup during installation and even after?
- alexb_ 5y agoIf a large project had "unpopular" opinions in the commit messages, it would be top of HN instantly and companies everywhere would be pressured into not using the project in the future. Software should do what you want, only what you want, and do that thing well. Political messages are horrible additions that accomplish nothing but isolate people and make free software look bad.
- whatever1 5y agoWhatever it takes to bring that dictator down.
- marginalia_nu 5y agoThis may actually be counterproductive to that end, as it disrupts the ability of the Russian grass roots to develop their own software. That capacity is fairly important to provide the technical ability to avoid state surveillance and to communicate without ending up in the cell next to Navalny.
- jcadam 5y agoOr it results in a balkanization of the FOSS community. Also bad.
- spamizbad 5y agoWhile I am personally disgusted with what transpired with node-ipc and am also completely gutted and outraged at Russias violent invasion of Ukraine - I don’t like the idea of us trying to “tone police” open source projects. If some idiot maintainer wants to pull a stupid stunt like that they should have the right to do so. In my view it’s the software equivalent of “hate speech” which, while vile, should be protected. This could quickly devolve into a nasty slippery slope where people who simply disagree with a direction of an open source project try to strip it of its licenses or eject it from various package managers.
- gruez 5y ago>I don’t like the idea of us trying to “tone police” open source projects. If some idiot maintainer wants to pull a stupid stunt like that they should have the right to do so. In my view it’s the software equivalent of “hate speech” which, while vile, should be protected. I don't understand your characterization of this issue as "trying to “tone police” open source projects". In this case it's quite likely breaking the law (ie. CFAA), and for good reason. It's one thing to start a website with racist content. It's another to actually damage people's property. Not even US, home of the most liberal free speech laws (at least when it comes to "hate speech") allows this.
- slackfan 5y ago1. I agree, as much as I think the maintainer of node-ipc is a flipping idiot and should be given an atomic wedgie, it's their project to do with as they wish. 2. That being said, forking a project due to maintainer disagreements is a time-honored open source thing to do. 3. The last point you made is already happening on both sides of the political aisle. Conclusion: Maybe software being political isn't a great thing, but that's what everybody chose, and that's what everybody gets to live with. I am looking forward to the +NOPOLITICS licensing clauses. E: Bring on the downvote brigade, I'm just happy knowing that in the end this too will inevitably burn itself out.
- alexb_ 5y agoHe has the legal right to, of course. And that right won't be stripped from free software ever. He also has the freedom to be called a dumbass who is harming open source on a massive scale.
- gurkendoktor 5y agoA curious inverse of this headline from last year: > Code in huge ransomware attack written to avoid computers that use Russian, says new report Edit, a better reference than the NBC article: https://krebsonsecurity.com/2021/05/try-this-one-weird-trick-russian-hackers-hate/ https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...
- JumpCrisscross 5y ago> harms peacemakers as much as the warmongers—even ethical hackers using a VPN to work against the invasion might become collateral damage This line of criticism could be blunted by targeting government IP blocks. Would that make it okay? (I don’t think so. But it’s less black and white.)
- meken 5y agoThis is crazy. The monetary system is fracturing, now the open source system could be fracturing. If I was Russia, I might start seeing the need to develop in-country versions of open source packages, as a matter of national security.
- quantified 5y agoIn any country, really.
- ScoobleDoodle 5y agoIt’s open source: If the government’s are willing to pay people to fork the original and vet and merge all the future deltas then they just need to host their own package manager. But would developers trust a government managed set of packages? In the US that is doubtful (I’d assume at some point FBI, CIA, NSA, DOD do something dishonest with it at some point.)
- FredPret 5y agoAt least they’d have an incentive to make it work reliably and not nuke your files. Sounds like an improvement already
- Latty 5y agoDo people think the people protesting like this don't know that this is damaging? They presumably feel that the issue at hand is more important than that damage. Every protest every has been met with "but this protest is being done the wrong way, don't inconvenience me", but that's the point: protest has to disrupt things to make people take notice and make changes. Would I do this? No. I don't think it's effective or right (it really isn't going to harm Putin, even indirectly, in any meaningful way), but I think it's silly to pretend people don't know what they are doing. The intent is to disrupt.
- duxup 5y agoI don't know what the next step is after "I've deleted your files... now listen to what I have to say." That makes no sense. It sounds more like an excuse for acting out.
- BaronVonSteuben 5y agoOnce your hard drive is wiped, you're supposed to automatically realize it must be a legitimate open source developer protesting the war, rather than some other type of malware. Then, rather than the natural human instinct to blame the person who did it, you're supposed to realize that your government must be lying to you and must actually be evil, and you're supposed to start a revolution to overthrow Putin. I guess that's the thinking?
- slackfan 5y agoIf the intent is to disrupt, why be surprised at people being pissed off about it? Seems like a natural progression of the conversation.
- mothsonasloth 5y agoThankfully none of my Java deps have turned my files into digital swiss cheese.... yet! What is it with some people wanting to "make the world a better place", but end up starting fires and making it worse. Is it just middle class western liberal arrogance manifesting through a software developer's actions? I don't want to make the world a better place, I just want to keep it from burning.
- FredPret 5y agoI just want to use Javascript to display the odd modal!
- meken 5y agoIt’s crazy how much trust plays a factor in the success of open source. And if that trust is eroded, the whole system comes crumbling down.
- vladvasiliu 5y agoI'd say this is the case in the broader society, too. Companies paying after the service is rendered, delivery services not having to be escorted by armed guards, being sure that a random worker won't poison the food on the production chain, etc
- acomjean 5y agoWhen I worked on Radar software (over a decade ago) they were very hesitant to use open source packages and such. Like everything there, there was a process that had to be followed. We'd have to vet the source and such and then bring it over to the development network. I don't think anyone did. When I was leaving they were looking to run new projects on Linux (from the proprietary unixes we were running) so I'm not sure how that would work. I'm guessing that's where the linux vendors fees come in.
- young_unixer 5y agoOn one hand, I don't want to be anywhere near protestware when it comes to my work or the tools I use. On the other hand, Javascript developers have a whole different culture than the developer circles I like to frequent. In npm-land, the societal expectations of quality and solemnity (for lack of a better word) are lower, and this kind of behaviour is even celebrated if it favors the "right cause". The last two cases we've seen (faker/colors, node-ipc) just took it one step further, but we've seen a lack of seriosness from both the npm organization and the community during the last... what? 6 years?. At this point, if you stay in the whole npm ecosystem, it's understood that you do so at your own risk.
- edgyquant 5y agoI don’t think it is understood. Most people who write JavaScript aren’t keeping up with the latest drama. I hadn’t seen any of these political complaints before this thread and I’m a lead engineer on a full stack typescript stack. Not that I have an opinion either way I just don’t think you can reasonably expect devs to keep up with stuff like this.
- ep103 5y agoI think keeping up on things like this is the bare minimum expectation I would have of any lead developer worth his or her salt, because keeping up on things like this is a fundamental aspect of knowing the technological ecosystem in which you claim to have the skills and knowledge in which to make decisions about things like which technical ecosystem your entire team should be using. Whether or not most engineers _do_ keep up on things like this, is a different question. But that's why there's a large range in salaries for similar positions across our industry.
- duxup 5y ago>I think keeping up on things like this Keeping up on actual code related concerns yeah. Internet drama, no.
- ocdtrekkie 5y ago
- ekianjo 5y ago> Instead of malware, a better approach to free expression would be to use messages in commit logs to send anti-propaganda messages and to issue trackers to share accurate news inside Russia of what is really happening in Ukraine at the hands of the Russian military, to cite two obvious possibilities How about not taking sides instead of acting like a kid believing one side is black and the other white with absolutely no gradient in the middle? Also, propaganda goes both sides, just like in absolutely every conflict in History. Stop being a tool of your own government.
- _Nat_ 5y agoA lot of folks are just anti-war and are protesting the invasion for being an act of military-aggression.
- matsemann 5y agoNot taking a side is agreeing with the oppressor.
- ekianjo 5y agoNo, not taking sides is just not taking sides. There's no need to turn such a position into a shortcut to something else. It's as stupid as the kids saying "if you are not with us you are against us". Typical populist bullshit.
- Cederfjard 5y agoAre there limits to this, or do you think ”not taking sides” is a morally defensible position to have regarding everything? Is it ethical to be neutral when it comes to the holocaust?
- mwcampbell 5y agoI think it's OK to refrain from taking sides about anything that we don't have firsthand knowledge about. There's no shortage of political and moral busybodies in the world, especially now that we have the Internet. I'm sure I've been one at times. So I think it's not so bad if we start going in the other direction, just minding our own business and sticking to things we can actually do something about. I should get back to that.
- makecheck 5y agoOne of the things I think protestware doesn’t understand is that the “users” of something are not clear-cut, and that should be especially obvious for things like chains of dependencies in modules/libraries. In other words, some (if not many or even most) people have no idea that something else they use (or even need) is depending on your stupid module. For example, how would I know if my mouse driver software happens to use a certain Node module, and one of its auto-updates just starts breaking things? Yes, it would be a stupid technical decision on the part of the mouse driver company (and that company would ultimately be responsible for the fallout) but how does that help the person actually affected, in the meantime? And did the protestware developer really not think that someone “downstream” like this could be affected by such decisions? Not everyone is sitting at a terminal seeing a message printed out. Of course there are other reasons too, e.g. you completely destroy your credibility as a project (or even potential employee in the industry) by pulling stunts like this, and how could that be worth it in the long run?
- _fat_santa 5y ago> and how could that be worth it in the long run? fake internet points.
- merrywhether 5y agoSo company is making mice in bad place X, mice break after update, tech sleuths inevitably link mouse problem to protestware, people start asking questions about company? Isn’t that potentially causing change? Doesn’t that specifically rely on affecting downstream users? So you weigh the likelihood of positive vs negative outcomes against your risk tolerance and act accordingly. I’d personally think that working on Truth Social would permanently affect your credibility in the industry, yet they have some devs who probably feel proud to work there. So people have different priorities in their lives.
- JasonFruit 5y agoI think a lot of efforts to support one or the other side in a war overlook that governments often do things that are supported by only a small portion of their people, and that support is often achieved only through dishonest propaganda. And while the governments have the resources to weather economic and social pressure, their people frequently do not, the more so the more repressive the government. If we can't very directly target the government, not the people, we should keep out of wars that are not an attack on us.
- darepublic 5y agoKeep dependencies low and use only the really crucial and well vetted ones. i.e. on recent web application I'm using next.js react and styled components, express and knex.js. you don't need anything else
- spicybright 5y agoIt sucks because it only targets individuals, not companies that have actual power to change things. A big site has production, testing, dev servers spun up by docker or whatever. So to fix this you just need to roll back the node package version and redeploy. A person learning code/developing locally now just lost everything.
- scohesc 5y agoIt's eye-opening to see the amount of unexpected changes we're going to go through as a result of the west deciding to completely remove an entire country from their economic systems and encouraging/allowing their citizens to harass the (mostly innocent) populace trying to just survive. I don't like how open source is being co-opted by people supporting _ANY_ political ideology or belief to cause harm to other people around the world. It's not _your_ code, so why are people openly advocating to modify it to cause harm to others? It's a net negative all around, in my mind.
- slackfan 5y agoArguments about protesting aside, isn't this not the first time npm has been hit with what is basically an injection attack that screwed up the day for a lot of people? And people ask me why I refuse to use *.js.
- shadowgovt 5y agoOpen source, at its core, depends on cooperation and a mutual expectation of benefit from that cooperation. When those expectations break down, the open source software process becomes but one of many casualties.
- ISL 5y agoThere is an argument to be made in the opposite direction. One of the key benefits to open source software is the opportunity to inspect the code that you're running... before you run it. At issue here isn't open source as a concept, but rather an emergent ecosystem in that blindly trusts package uploaders not to be malevolent. It points to a need for improved testing coverage. Indeed, since open source is open, it is also amenable to static analysis of uploaded package revisions, something one cannot readily do with closed-source software.
- shkkmo 5y agoThere were deliberate attempts to hide the file deletion payload in obfuscated d code. Running your tests would have resulted in your files being deleted or the test passing and would have done nothing to protect you from this particular instance.
- TeeMassive 5y agoI never understood why any maintainer worth his salt would admit logic bombs into his own turf. This is literally putting a wolf in the sheepfold in the hope he only eats the black sheep. OSS is built on hard earned collective trust. Once this is gone, the golden age we are surfing on right now will be gone.
- jddil 5y agoOh good we're discussing this again. The rancor this protest has caused in certain tech circles has really shown that we believe we're somehow different or better than the rest of the world. In the real world 1 specific region has violated the norms the rest of us have agreed to ... you don't get to indiscriminately kill innocents while taking their land and has accted appropriately by cutting them off. In the tech world we are screaming about how the people in that region are getting inconvenienced by the free tools we provide because we are supposed to be above "politics"
- shkkmo 5y ago> In the tech world we are screaming about how the people in that region are getting inconvenienced by the free tools we provide because we are supposed to be above "politics" It isn't about being above politics. It is about abusing and destroying trust. If you want to add messaging to your project, that is not harmful to the ecosystem and will just cause some people to view you as unprofessional. If you try to actively destroy people's file, you have stepped up at over that line are attacking and harming people, not just "inconveniencing" them.
- moonchrome 5y agoAnd this is why I hate the JS ecosystem. Everything is monkey patched by a bunch of randoms who published a package that scratched their itch and you have 0 assurances of their intent or stewardship. If you want to vet dependencies- good luck - the standard library is so shit that pulling one dependency might bring in a 100+ packages with it. Even the "big corporate sponsored" libraries depend on random crapware - like the leftpad incident clearly demonstrated. Returning to .NET Core recently I'm very fond of the ecosystem in this regard - everything is open source - but so many things are provided by Microsoft you rarely have to venture out, even stuff that's not under their repo/umbrella has people paid by Microsoft working on it (eg. npgsql).
- lostmsu 5y agoWhy do you think .NET's NuGet is immune? Are you aware, that Microsoft bought NPM (or at least tried to)?
- moonchrome 5y agoBecause most nuget packages I get are from Microsoft, and if I use something that's not there is usually a Microsoft employee on the team or it's a trusted community package without random third party dependencies. Meanwhile half of npm was broken because of left pad. It's got nothing to do with npm as a repository - I don't trust the community.
- jcadam 5y agoMajor projects are going to need to add a clause to their CLA and/or vet their contributors. Sad we've come to this place, but everything is politics now. Time to start paying for closed source and/or curated/vetted OS libraries now?
- CodeWriter23 5y agoThis is why I file node_modules into the project's repo, so as to avoid the ever-expanding perils of npm install.
- mannykannot 5y agoThe broader issue here is the security problem that this article highlights, which was present before the invasion. If the thesis of this article is correct now, it was correct then, and will continue to be correct. Even if you could put the cat back in the bag, we would still have the cat.
- pimterry 5y ago> Instead of malware, a better approach to free expression would be to use messages in commit logs to send anti-propaganda messages and to issue trackers to share accurate news inside Russia of what is really happening in Ukraine at the hands of the Russian military, to cite two obvious possibilities. There are so many outlets for open source communities to be creative without harming everyone who happens to load the update. For anybody looking for an easy way to do this, https://infowarship.pages.dev/howto-en https://infowarship.pages.dev/howto-en may be interesting. Add a single script tag to your project website, and all visitors from Russian IPs see a popup providing real information about the war in Russian, and links to accurate Russian-language reporting & Telegram groups, from outside the Russian state propaganda bubble. Not malicious or damaging, no problem for anybody in Russia visiting who doesn't support the war, but a quick & easy way to inform those who do, and to push back against Russia's internal propaganda & censorship.
- oauea 5y agoIsn't it likely for Russian ISPs to start blocking infowarship.com, if they haven't already? Since the script is loaded from their domain this would be easy to censor.
- shkkmo 5y agoI certainly hope people don't just load this random website's script directly from their website frontend. That seem super insecure. If people want to use that popup they should download the code, give it a quick review, then host it themselves. This also solves the issue with that domain getting blocked.
- aspenmayer 5y ago> That seem super insecure. If people want to use that popup they should download the code, give it a quick review, then host it themselves. If the node devs did the same thing, this whole story would have been a nonstarter. I don’t recall if you suggested for node devs to also do this. Ironically, if the dev who made the hard drive wiping changes had said that it was a protest against the bad practices of the node ecosystem which allowed for their hard drive wiping code to work as intended, I think that the dev would be getting just as much ire cast their way, if not more. This way, they get to perform two protest actions at once. I’m impressed. I don’t approve of his methods, but I do find the causes justifiable.
- avereveard 5y agowhat they doing matches literally with the definition of terrorism: "use of violence and intimidation, especially against civilians, in the pursuit of political aims." so let's not dilute that into "protestware"
- akagusu 5y agoThe problem is not protestware, sabotage, or whatever. The problem is who does it. Suppose US government did this to sabotage Russia, since it cannot directly act against Russia because it would trigger WWIII. Nobody would care about. But this guy doing it, or you, or me? No. We are not allowed.
- shkkmo 5y ago> Suppose US government did this to sabotage Russia, since it cannot directly act against Russia because it would trigger WWIII. Nobody would care about. I would care even more about it. I absolutely don't want our government destroying trust in open source in such a fashion.
- duxup 5y ago"proestware" is just malware.
- manofmanysmiles 5y agoI'm probably going to start sounding like a broken record here, but what I have realized is I am living here as a man. I am not a citizen, or another entity, and my morality is is between my myself, and my "creator". This creator could be God, could be nature/natural selection, just whatever process brought the "I am" here. I am also aware that with this knowledge I chose to not harm any other living entities. The "problem" is that people calling themselves "agents of governments" go around asking other people initiate violence on other people, using words such as "laws" and "orders", and these other people, believing that "the government" i a real entity, and that these "laws" somehow overwrite our natural sense of morality and free will decided to act and initiate violence. In this current conflict, people who call themselves the government on both "sides" are instructing people to go initiate violence, and people thinking the authority is real do so, and go murder other people. We, as people who are mostly "uninvolved", acting in the role of "citizens", are seeing this evil occur, and want it to stop. However, we are still supporting this idea that government is real, that "Russia" is doing something to "Ukraine", when there is no "Ukraine", or "Russia" or "United States", but simply people who act as if these entities exist. We give power to these egregores, or intersubjective entities, and by doing so believe we are somehow absolved from making our own moral decisions. All of this stops when each and every one of us (or at least a big enough percentage) takes individual moral responsibility for our actions, and learns to be moral for its own sake. A big part of this that a lot of people I've talked to seem to be missing is the role of "money", and how people with free will thinking that pieces of paper, or numbers on a computer have power or value. The only value that exists is us as conscious entities. Every aspect of reality, from this computer I am typing this response on, to buildings, art, and technology is the output of consciousness acting on matter on its own free will. When we believe that having money in our possession gives us power and freedom, it gives us a false sense of security. If I have some sum of money, I believe I can use this money to influence reality by giving it to other conscious entities. For now this is somewhat true, because you, and other entities agree to do thing in exchange for these imaginary numbers. However, what is true is that each and every one of us acts on our own free will, and we use money because we are too afraid to admit we are dependent on each other. As we continue believing this, we allow other people who know how to manipulate the numbers in clever ways, such as those people controlling central banks, and printing money to exert large influence on the direction of the world. During the last two years, a very large number of money was printed, and used to reshape reality. The value of every dollar decreased, as suddenly the equation was out of balance, but again, those in control of the money supply use this new money, and we, believing it represents value change our behavior trying to capture the value, forgetting it is us who are the real value the whole time. So my message to other people who want to hear it is: you are the value. There are no governments, companies or money. There is only us, and we are the value.
- eternityforest 5y agoIt harms all of technology and by extension anyone who participates in the modern world. Just like any malware or other antisocial behaviour. It's a bit too indiscriminate to be a good protest, unless the thing you want to tear down IS the whole modern development process, which is based on the idea that most people are somewhat trustworthy and you can get the risk down to an acceptable level through the usual means. It doesn't quite work if malware is not only a threat, but a semi-mainstream thing sometimes made by people you would think you could trust. The normal social process of trust breaks down if malware is included in the scope of normal things people sometimes do, as opposed to purely being something by the more criminal types. I almost wonder if these people don't actively want to tear down tech itself, or not care, given how many coders dislike the fact that society is tech dependant.
- thot_experiment 5y ago> It harms all of technology and by extension anyone who participates in the modern world. Just like any malware or other antisocial behaviour. Sure but the problems are in order of significance are: Putin invading Ukraine Trusting things from NPM This author adding malware to his package I'm disappointed by the chorus of "keep politics out of tech" that seems so prevalent on HN, though not surprised. In general I'm in the "don't be a dick or cause problems" camp but when things are this completely broken I think anything goes. Countries are made up of people, people en masse can effect change, but often times the vibe of that one poem holds true, doesn't effect me so I don't care. It's wrong to stay silent. Every bit counts, it's only death by a thousand cuts if you actually make all of the thousand cuts, if everyone who's social responsibility to make a cut thinks "this doesn't matter anyway and i don't wanna be a dick" well... look around you at everyone who's got theirs and doesn't care.
- Aspie96 5y ago> but when things are this completely broken I think anything goes Why? If something doesn't help in any way, it shouldn't "go". Putin's invasion of Urkaine doesn't justify doing other bad things, just because those bad things aren't quite as evil. Something can be wrong without it beying literally invading another country. Putting malware in software is an example of that. > but often times the vibe of that one poem holds true, doesn't effect me so I don't care. The issue is not "not caring". The issue is weighting advantages and disadvantages and be responsible in one's actions. Politics in tech should be rejected at least in all cases in which it doesn't lead to any advantage. The existence of worse things is irrelevant.
- kekebo 5y agoCould (/should) this be mitigated on the repository host side by scanning for and flagging malicious commits? A paper from last year evaluating this on Github achieves a ~50% success rate[0]. Given Github already training ml models across all repositories for Copilot I would guess higher rates would be possible. [0] https://arxiv.org/abs/2103.03846 https://arxiv.org/abs/2103.03846 Edit: add link
- tjpnz 5y agoIIRC the recent examples of genuine "protestware" included a modification to the license. There are already tools on the SCM side which will detect that (Whitesource being one).
- ComradePhil 5y agoI think there needs to be a counter effort against these people. Some entity like the EFF should maintain a database of people who have engaged in protestware so that there can exist APIs which will check for whether any of your dependencies come from these blacklisted people... or if you are about to hire them.
- raxxorrax 5y agoNot really a fan of exorcism, but it would pose a security risk. The probability it will hit the wrong people is immense to almost certain. Maybe even someone organizing protest within Russia. But random acts against Russian developers is an infantile form of protest in my opinion.
- renewiltord 5y agoYou can say what you want but this is a risk in remote unpinned dependencies. As platforms it is important to protect against this making artifacts immutable. As people we can only protect against it by auditing upgrades depending on risk. I much preferred the old world, where I could pick pretty much any software package and it would be safe but that is not today’s world. It’s entirely possible that a colorizer scans my disk for ethereum keys. In practice I rely on social validation but it is not a safe thing in general. Unhappy about the outcome but this tends to happen in time. In the end, it’s true. If you bomb my house, I will strike back in whatever way I can. If the only thing I can do is burn you and your children, I will. If the only thing I can do is destroy your hard disk, I will. I am limited in retaliation not by morality but by ability. And if I am like this, then I must assume that others are, too. And that I might get caught in the collateral blast zone.
- Ajedi32 5y agoI personally think this kind of thing is just a symptom of a larger problem; the modern open source software ecosystem is highly vulnerable to supply chain attacks. Frankly, given how normal it is to just blindly download unverified, unsandboxed code from random developers and execute it on our machines it's surprising this sort of incident isn't more common. What we need are better tools and processes to detect and block malicious code in dependencies before it has a chance to execute. I wrote up a few suggestions for that several months ago and I think they're still applicable: https://news.ycombinator.com/item?id=29266992 https://news.ycombinator.com/item?id=29266992
- rectang 5y agoQuorum publishing would help a lot, and is doable. It would guard against supply chain attacks where the identity of a publisher is taken over by an attacker, by multiplying the difficulty and requiring multiple takeovers. However, it would not fully guard against a conspiracy by people willing to burn their reputations, as in the "peacenotwar" attack. Per-dependency sandboxing and permissions might mitigate things to a degree, just as it has on iOS etc with apps. But it would require a different software module architecture than we have today for common languages.
- seqizz 5y agoBut on the other hand, these people are not promising anything, do they? Check the MIT/BSD/GPL etc, all of them explicitly state that the software does _not_ come with any kind of guarantee. Harsh reality is: It's user's responsibility to test for those. Noone is forcing you to use this piece of code which is given as-is without any guarantees. Noone is forcing you to update. It might be a dependency, but still it's not the problem of the code owner. Or am I missing something?
- phreezie 5y agoI think what you're missing is that this discussion is not about the legal consequences of these individuals, but about ethical decisions that will have a negative impact on the ecosystem as a whole.
- seqizz 5y agoTbh I don't see an ecosystem here, there are some dots which are connected but seems like people are thinking there is a liable vendor polishing npm packages.. Also I'm not sure which one is more unethical: Malware from a random developer or profiting over his/her "free code" * by not giving any care about open source or sustainability of it at all. * (in the view of big corp)
- Aspie96 5y agoThey are not. And there would be absolutely nothing wrong with them no longer maintaining the package, deleting it, or with the package not working. The issue here is spreading actual malware. A developer doesn't owe anything to anyone. But actually and actively harming others trough actual malware is unethical even if someone didn't promise they wouldn't do so. If I give someone a piece of food that I expressly don't guarantee anything about, the worse one would assume is that it might be spoiled and I didn't check, or that the ingredients may be of very law quality. Not that I actually purposefully poisoned it.
- seqizz 5y agoI don't know. Going from same example, if you give me food with a note on it saying "I don't be liable for anything, I am not giving any guarantees. And if you'd like to give this food to someone else, you must give a copy of this note too.", poison possibility is not off the table. Anyway, I understand the frustration of people who got broken tests, but just noting the different angle.
- Traster 5y ago>The “weaponization of open source” as Gerald Benischke calls it in his March 16 blog post is indiscriminate, and the collateral damage it causes damages the work of developers and operators solely because they have a Russia-assigned IP address. It harms peacemakers as much as the warmongers—even ethical hackers using a VPN to work against the invasion might become collateral damage. I think this is a weirdly bad argument. All the sanctions against Russia harm pretty much all Russians because they're in Russia even if they're peacemakers. That's just the price of using sanctions. You can absolutely apply that to open source - block all Russian IPs and say "Sorry, but we endorse the sanctions that our government has put on Russia, and we're going to boycott your country for that reason" - just the same way that hundreds of western countries have pulled their businesses out of China. Now they also make the argument that it's ineffective - that you're ruining your own codebase to try and make Russia suffer, but at the end of the day that's a judgement for the developer of the repo. It's also naive to think posting "anti-propaganda" in commit logs is in any way an effective way of circumventing censorship, at best you're just hoping that your obscurity prevents you being censored, but that's basically just playing by the censors rules.
- temp-dude-87844 5y agoI get why the OSI published this post. They have a vested interest in the conversation and I agree with their points. But the battle for the narrative has already been lost when people consider this to be a problem with 'open source'. Rather, it's a problem with software that's being given away for reputation brownie points. Here, the author showed exceedingly poor judgment towards users of their software, and this should result in the loss of goodwill and respect towards the author and the forking of their works if the license allows. Open Source didn't enable this behavior. The author's poor judgement and the author's lack of need to care for the users of one's software is what didn't dissuade this behavior. In this case, it was giveaway software causing harm. In other cases, it's commercial software pushing hamfisted changes users don't want, because the users aren't empowered enough to fight it. The reason commercial software would avoid this particular type of stunt is because it's poor business sense to harm one's direct customers. So what of Open Source? Open Source allows anyone to review or modify the software that engages in this behavior. So the community can salvage the author's good contributions and better custodians can carry the software forward. Open Source also allows anyone to discover these cases proactively. Of course, almost nobody does this, because we as an "industry" have gotten used to four troubling trends, and ridicule those who aren't on this "bleeding edge": * thinking that software that costs $0 to obtain incurs no additional costs * not auditing our dependencies * being unconcerned about the sheer quantity of dependencies * blindly updating dependencies It's a sad but predictable development that the field of Open Source software has basically merged with the community of authors actively looking to give away software for $0 (for fame or to upsell advanced features). Basically, the Open Source movement was too successful (in its advocacy and in raising the demands of the customers of software), and it has largely subsumed and supplanted the formerly-separate fields of shareware and trialware software. This development is what truly hurts Open Source: so much software but too little emphasis on (or even demand for) curation, massive imbalance of contributors to users, the decreasing influence programming-language-specific spaces, and increasing dominance of the "move-fast-and-break-things" culture. The way forward is to achieve stronger curation, more focused maker spaces, tighter (as opposed to larger) communities, and an outreach effort to re-establish the philosophical distinctions between Open Source and freeware.
- anoncow419 5y agoFeels like we always come back to this xkcd comic. https://xkcd.com/2347/ https://xkcd.com/2347/
- KyeRussell 5y ago
- lliamander 5y ago> We don’t need more whinging by men... What if the "whinging" is done by women? Or non-white men? Do Ukranian men get a pass for now, considering it's their country that is being invaded? Seriously, this is a sexist qualifier. It speaks volumes about your ideology that it is important what kind of people believe something, rather than just evaluating the idea on it's merits. > Also, there’s certainly a subset of people with genuinely shitty views that don’t like that tech circles are becoming less of a save haven. Is it so wrong to want feel a sense of belonging somewhere? Especially if many of those people with "shitty views" actually helped make tech such a desirable industry to work in? In general a person's ideology is not the best filter of their quality or whether they should be included in a community. A lot of toxic people hold the "correct" beliefs. > Open source / free software philosophy’s demand for apolitical stoicism is dripping with privilege and the way people treat the ramblings of RMS et al as inherently infallible just because it helped push this industry through its infancy shows how immature this industry is. FOSS is far from apolitical. What it is, is relentlessly focused on its mission. Many of these virtue signaling acts do nothing for their claimed political goals and at the same time undermine the great good FOSS had brought to the world. That you don’t understand this is a sign of your own immaturity.
- noirchen 5y agoIn the past the big multinational corporations did not give a shit about ethics. IBM happily sold Hitler machines to categorize jews gipsies slavs and gay people. Now programmers 'protest', or more accurately, attack what they conceive as evil, and it suddenly become a thing. Which one is better? Of course neither is good enough, but I certainly think programmers can express their views and values. Sometimes you have to admit that fairytale concepts, such as open source, or the internet that every person can get access to, or globalization, or the end of history, are hitting a hard wall. Maybe none of these thing from the last few decades are everlasting in the time scale of human history. If I have to choose between freedom of speech which proves true for like several hundreds of years and decades old open source, I would not hesitate.
- rd07 5y agoI have never disappointed by open source projects until this recent weeks. The acts of some OSS maintainers that blatantly use the tools they maintained as a platform to show their support for one side has disappointed me. Especially because they have never took side nor notice other bloody conflict before this. I won't be as disappointed if they always use their tools to promote peace and stand with whichever nation being invaded and oppressed. But no, they only care when a western/western-aligned country being invaded. This just shows their hiprocricy and racism.
- UltraViolence 5y agoI absolutely agree with this premise. Software (open source or not) should be usable and perform a useful function, not swarm users with spam to protest this or that. The developer of the software that made the protestware was rightfully banned by Github. I haven't heard if he ever regained access to his account.
- minerva23 5y agoUnpopular opinion: telling people they need to keep their protests non-disruptive is akin to telling them they can’t protest. “Protest in a way where I can ignore you.” Do I think “protestware” is a bad idea? Sure. Am I going to tell them to take their fight for human rights elsewhere? Not a chance.
- Aspie96 5y ago> Not a chance. Why not? Is every action legitimate as long as it uses "human rights" as an excuse? Something doesn't become more ethical just because it's described as an act of protest.
- minerva23 5y ago> Something doesn't become more ethical just because it's described as an act of protest. Agreed, but fighting back is often seen as ethical when unwarranted aggression is not. In the case of this “protestware”, they’re both fighting back against unwarranted unjustifiable war AND doing no direct harm. They’re free to restrict who or where their software may run. They’re also free to include a boobytrap for anyone who doesn’t respect the license/restriction.
- Aspie96 5y agoWhat? That malware was directed to anyone with a Russian IP. The license was an open source license.
- minerva23 5y agoThe license change was implied by the boobytrap. Are you saying they didn’t have the right to change the license?
- Aspie96 5y agoI'm saying malware isn't the same as a license change. If we consider malware to be simply a form of licensing, than all malware is allowed, in every place. If malware hits you, it means you shouldn't have been using the software.
- baryphonic 5y agoTo be honest, I'm annoyed by the benign protestware messages when they start to get in the way of using the software, particularly on mobile. I was looking at the isomorphic git documentation the other day, and noticed that their "#BlackLivesMatter #DefundThePolice" banner scrolls under the rest of the content, leaving this annoying gap that takes up screen real estate, especially in landscape mode on a phone.[0] What's the point? Is a single person going to be persuaded to support either cause by seeing this banner on a relatively niche JS library that reduces readability of its documentation? Will anyone find the library any more useful because they support the cause? (I support neither cause, but find the library useful nevertheless.) Recently, I saw a similar pattern with the Svelte REPL adding a pro-Ukraine message.[1] The banner along the bottom is so large that landscape mode becomes unusable, and non-trivial examples are hard to see even in portrait mode. Again, who does this help? (I support Ukraine, so feel like, "yeah, I get it; can I close the banner now?") The worst part about these patterns is that they can't be disabled and seem to be deployed haphazardly without regard for the overall design. While these aren't malware, they are still hostile for the majority of users who aren't so gung ho in their support for the current thing. [0] https://isomorphic-git.org/docs/en/deleteBranch https://isomorphic-git.org/docs/en/deleteBranch [1] https://svelte.dev/repl/hello-world?version=3.46.4 https://svelte.dev/repl/hello-world?version=3.46.4
- amelius 5y agoIt's still better than ads, though.
- rnd0 5y agoIt's indistinguishable from an ad.
- gadders 5y ago>>Is a single person going to be persuaded to support either cause by seeing this banner on a relatively niche JS library that reduces readability of its documentation? The purpose of the banner is not to convert anyone, the purpose is to demonstrate that the author of the package subscribes to the correct opinions.
- PeePeePooPooMan 5y ago
- julienfr112 5y agoYou are right, but economic sanctions harms also the countries that are making these sanctions. Shell leaving Russia harms also Shell. Banning Russian airlines harms aviation as a whole. And it's not a reason not to do them. I think also that's it's better to focus on propaganda, like displaying a ascii-art of the old woman threatening a Russian soldier or whatever. But at the end, maintainers have the right to do anything they see fit. And disruptive actions are in my view better than apathy and just ignoring the whole thing.
- x3c 5y agoWithdrawing a service is very different from delivering a malignant service. McDonalds is withdrawing from Russia instead of serving contaminated Burgers.
- cosmiccatnap 5y ago
- Mikeb85 5y agoIsn't NPM all malware anyway? /s Seriously though, adding malware to OSS code harms trust. I'm down with messages or comments in support of X cause though.
- reaperducer 5y agoIsn't that the whole point of "open source" software? The author gets to put out code that matches their will, and if you don't like it, you either don't use it, or you fork it and make your own. It's funny how every time there is an "open" project on the internet, from code to Wikipedia to whatever, there is always a group of people that forms to quantify, collate, tabulate, and regulate it into some imagined corporate structure. Don't like the protest? Fork away!
- throw7 5y agoI don't think "protestware" is fully correct. Destructive behavior is more than just protest (my understanding is the dev deleted and changed user files to "heart emojis") and is something that shouldn't be tolerated. It's malware.
- twofornone 5y agoI miss the golden age when people more or less adhered to a "no politics at work" rule. Yes it's not possible to be 100% apolitical in most decisions but that's not an excuse to inject unrelated political signaling into everything.
- ltbarcly3 5y agoI think almost anything that makes corporations realize they are exposed to the whims of people contributing most of the labor to build their businesses is a good thing. They should be careful about what open source code they use, and more open to paying for support contracts or other contracts that provide some warranty of functionality. Right now they are freeloading, and THAT actually does hurt open source.
- waoush 5y agoI work in the banking industry which has a bit of regulation, and is a bit risk-averse. People are expected to engage in risk management at all levels. If sabotaging became more common, OSS adoption would likely become unacceptable at these organizations. Mine already blocks Github and you need to request permission just to view it, and even then you can't pull code via command line. Putting in code that is destructive like that, for any reason, is a good and fast way to scare management away from using your code. If you are going to insist on doing that stuff, just engage in hacking on the side lol.
- fattless 5y agoWas talking with a friend about the peacenotwar thing. I think its pretty interesting to view so many of the decisions like this through the “we have to do something” mindset so many people have, especially on social media. All of these companies shutting down in Russia, people pressuring others to take a stand or shut down their services, upset the population. On HN I remember the namecheap thing and the service that allows westerners to call random Russians and inform them. On paper these seem like solid moves, but I cant help but feel like its only harming the citizens, and potentially irresponsible in a place where someone faces consequences for speaking out. I dont think anyone is going to risk their lives and take notable action because they need to find another service for their website, or some random foreigner telling them their government is lying. Of course these issues are more complicated, and taking these actions isnt a bad thing necessarily, namecheap has offices in Ukraine so they are going to take it personally, but there have been many cases where the company does it out of nowhere. These actions are inconveniencing the population, and when taken to the extreme like with peacenotwar, potentially very harmful. And I dont know if its doing much else. Yet too many people are acting like inaction is unacceptable. I understand, you feel powerless in situations like these, but that shouldn’t stand in the way of making smart decisions. The need to do something has been pressuring people to take actions without considering the actual consequences vs the intent.
- fattless 5y agoSomewhat related, but I have talked about this twitter thread a few times recently Essentially, this someone was working at a homeless community shelter, and often found the bathroom completely destroyed. Paper everywhere, missing the toilet, intentional destruction and trying to make it as messy as possible. Every time they would clean it it would just get trashed once again They had a theory that being trapped in that kind of situation gives them so little control that their brain wanted to take control over something however it can, which lead to the bathroom situations. They related this to “cancel culture”, needing to call out people for the littlest things, or the loss of direction in social justice, but I find it applies to a lot more than that. My device is freaking out rn, cant pull up a link, but if you search for “the trashed bathroom thread” you should be able to find it. Maybe got it?: https://twitter.com/tercicatrix/status/1376210092492791809?lang=en https://twitter.com/tercicatrix/status/1376210092492791809?l...
- io23joi 5y ago
- bradgranath 5y agoMaybe reframe this to "War harms open source"?
- sangnoir 5y agoConsidering that HN skews Libertarian, I'm a bit surprised by the anger directed at people excercising control over projects they own. I guess it's easier for folks here to empathize with why a level of restraints over ownership for "the common good" when it's an open source library they imagine using.
- Jiro 5y agoLibertarians oppose fraud. Software that deletes your files on purpose, in a context where people reasonably expect it not to delete your files on purpose, is fraud unless thete's a notice on it prominent enough to make the expectation not reasonable.