6 ms·

Thought experiment: imagine you were in a country being shelled by foreigners; the thought process shaping your decision making might be different from someone

Thought experiment: imagine you were in a country being shelled by foreigners; the thought process shaping your decision making might be different from someone sitting a safe country. Granted, it's possible these commits are from people outside Ukraine, in which case, I wouldn't give them a pass.

deleted 5y ago
[deleted]
pmontra 5y ago
I even agree with the message but we must keep this out of open source or we're going to lose all of it because nobody will be able to trust it and use of open source will immediately fail certifications. This is wells poisoning, all of them.
- 88913527 5y ago
  Why should I trust open source today? Packages are routinely hacked, political message or not. I 100% agree this has no place in open source but (1) people subject to the effects of war aren't in most sound state of mind and (2) "npm install" is arbitrarily running pre- and post- hook commands that can do all sorts of fun things on your machine. This commit looks harmless in comparison to packages looking for wallets and AWS credentials. OSS is used not because it's safe or secure, but because the benefits outweigh the costs.
  - hda2 5y ago
    > Why should I trust open source today? Packages are routinely hacked, political message or not. Correction: NPM packages are routinely hacked. I've been using linux packages for two decades, and not once have they been hacked (to my knowledge). I consider those packages to be infinity more secure than proprietary packages where I and others can't check what's running under the hood. OSS being safe and secure is one of the primary reasons why I prefer open source to closed source software.
    - 88913527 5y ago
      Anecdotally, I agree because it's difficult to find much on linux package distribution hacks. But there is this: https://lwn.net/Articles/295406/ https://lwn.net/Articles/295406/ I guess I wonder where you draw the line, and if this sort of incident is acceptable, why, and is the line being drawn arbitrary.
    - johnny22 5y ago
      and typo name hijacks in other language specific repos
- throw_m239339 5y ago
  > I even agree with the message but we must keep this out of open source or we're going to lose all of it because nobody will be able to trust it and use of open source will immediately fail certifications. This is wells poisoning, all of them. There are deeper issues with NPM: how many developers review or audit any packages they download anymore cause each time they pull a single package, it comes with 3000+ dependencies? I'm being hyperbolic, but "open source" isn't the issue here. What certification are you even talking about if developers themselves can't be bothered to audit their 3000+ NPM dependencies at first place? It's too much work cause too much dependencies? Well that's the architecture NPM chose. I don't have that issue with Go, PHP or Java package management oddly...
  - maxloh 5y ago
    Agree with this. Open source is not the problem, but running code written by a random guy without fixed version and without auditing between upgrades is.
- tremon 5y ago
  Correction: no one should have been trusting it for years already. There's very obvious supply-chain vulnerabilities in pretty much all open source developer repositories. And that's by design: npm, pypi, rubygems, cpan etc are developer resources. Nobody should have been deploying them unseen to production. Ever. If you want trust, use a (Linux) distribution as intermediary.
- michaelmrose 5y ago
  If they want something they can trust they ought to pay for it. If rich companies feel like they can no longer afford to mooch off people working for almost nothing and have to write their own libraries tell me what of value will be lost? I mean do you hang out in your kitchen hoping that Bezos will come by your house to borrow a cup of sugar?
Barrin92 5y ago
this sort of hacktivism is causing more damage than it does good because it just annoys people, isn't telling anyone anything they haven't heard yet, and is going to exclude that person from participating in other software projects. Donate money, take in a refugee, if you're so inclined go fight on the frontlines but this kind of theater is only done because people want personal attention.
- soraminazuki 5y ago
  Looking at the actual code, I think your criticism slightly misses the mark. > is going to exclude that person from participating in other software projects It's not targeted at developers. It targets end users. It shows a browser dialog containing the author's message if the timezone is set to a Russian city. > isn't telling anyone anything they haven't heard yet It's not trying to inform you. It's trying to inform Russian citizens by sharing an onion link to the BBC website so they could have access to uncensored information. > is only done because people want personal attention It's probably done because the author is Russian. It's stated in the author's GitHub profile.
  - croes 5y ago
    Would you follow such a link that pops up?
    - pferde 5y ago
      Would your grandmother?
      - croes 5y ago
        My grandmother doesn't have the tor browser installed. If you already have tor installed you are already capable of getting the information you want.
    - soraminazuki 5y ago
      Depending on the situation, yes. In an environment where information is heavily censored, some people are going to be desperate for outside sources of information. They just need to know where to look for. It's also a red herring too. No answer to your question validates the original commenter's factual understanding of this incident. The commenter got the basic facts completely wrong, which highly suggests that the commenter didn't bother to look beyond the title. But it was apparently enough to label someone an attention seeker.
hatware 5y ago
In today's world, it's guaranteed that these are folks outside of Ukraine. Virtue signalling will be the death of us. Wanting to look like you're doing something is winning more than actually doing something.
- vkou 5y ago
  Unless you're one of a handful of a senior politicians, you can't 'do something' meaningful. But fortunately, we live in a society where speech has an effect. Speech (which you derisively refer to as 'virtue signaling') shifts the Overton window, and influences the direction society goes.
  - prionassembly 5y ago
    The expression "virtue signaling" implies insincerity.
    - TobyTheDog123 5y ago
      Do FOSS contributors actually expect malware like this to produce signifiant positive attention to their cause? More-so than social networks and the media?
      - hatware 5y ago
        Exactly. They piss off ten people for every one they think they're helping. It's not sustainable.
    - hatware 5y ago
      And there's nothing more insincere than telling strangers on the internet to believe what you do because "it's the right thing to do!"
  - evocatus 5y ago
  - 5y ago
gorjusborg 5y ago
Losing people's trust isn't likely to help your cause, whatever it may be.
croes 5y ago
Doesn't matter where you are from, you don't know what the effect of your actions are and who will be effected. Put in onto social media, your website, your disclaimer, code comments, code license etc. But never in the functionality of your code.

deleted 5y ago

[deleted]

pmontra 5y ago

I even agree with the message but we must keep this out of open source or we're going to lose all of it because nobody will be able to trust it and use of open source will immediately fail certifications. This is wells poisoning, all of them.

88913527 5y ago
Why should I trust open source today? Packages are routinely hacked, political message or not. I 100% agree this has no place in open source but (1) people subject to the effects of war aren't in most sound state of mind and (2) "npm install" is arbitrarily running pre- and post- hook commands that can do all sorts of fun things on your machine. This commit looks harmless in comparison to packages looking for wallets and AWS credentials. OSS is used not because it's safe or secure, but because the benefits outweigh the costs.
- hda2 5y ago
  > Why should I trust open source today? Packages are routinely hacked, political message or not. Correction: NPM packages are routinely hacked. I've been using linux packages for two decades, and not once have they been hacked (to my knowledge). I consider those packages to be infinity more secure than proprietary packages where I and others can't check what's running under the hood. OSS being safe and secure is one of the primary reasons why I prefer open source to closed source software.
  - 88913527 5y ago
    Anecdotally, I agree because it's difficult to find much on linux package distribution hacks. But there is this: https://lwn.net/Articles/295406/ https://lwn.net/Articles/295406/ I guess I wonder where you draw the line, and if this sort of incident is acceptable, why, and is the line being drawn arbitrary.
  - johnny22 5y ago
    and typo name hijacks in other language specific repos
throw_m239339 5y ago
> I even agree with the message but we must keep this out of open source or we're going to lose all of it because nobody will be able to trust it and use of open source will immediately fail certifications. This is wells poisoning, all of them. There are deeper issues with NPM: how many developers review or audit any packages they download anymore cause each time they pull a single package, it comes with 3000+ dependencies? I'm being hyperbolic, but "open source" isn't the issue here. What certification are you even talking about if developers themselves can't be bothered to audit their 3000+ NPM dependencies at first place? It's too much work cause too much dependencies? Well that's the architecture NPM chose. I don't have that issue with Go, PHP or Java package management oddly...
- maxloh 5y ago
  Agree with this. Open source is not the problem, but running code written by a random guy without fixed version and without auditing between upgrades is.
tremon 5y ago
Correction: no one should have been trusting it for years already. There's very obvious supply-chain vulnerabilities in pretty much all open source developer repositories. And that's by design: npm, pypi, rubygems, cpan etc are developer resources. Nobody should have been deploying them unseen to production. Ever. If you want trust, use a (Linux) distribution as intermediary.
michaelmrose 5y ago
If they want something they can trust they ought to pay for it. If rich companies feel like they can no longer afford to mooch off people working for almost nothing and have to write their own libraries tell me what of value will be lost? I mean do you hang out in your kitchen hoping that Bezos will come by your house to borrow a cup of sugar?

Barrin92 5y ago

this sort of hacktivism is causing more damage than it does good because it just annoys people, isn't telling anyone anything they haven't heard yet, and is going to exclude that person from participating in other software projects. Donate money, take in a refugee, if you're so inclined go fight on the frontlines but this kind of theater is only done because people want personal attention.

soraminazuki 5y ago
Looking at the actual code, I think your criticism slightly misses the mark. > is going to exclude that person from participating in other software projects It's not targeted at developers. It targets end users. It shows a browser dialog containing the author's message if the timezone is set to a Russian city. > isn't telling anyone anything they haven't heard yet It's not trying to inform you. It's trying to inform Russian citizens by sharing an onion link to the BBC website so they could have access to uncensored information. > is only done because people want personal attention It's probably done because the author is Russian. It's stated in the author's GitHub profile.
- croes 5y ago
  Would you follow such a link that pops up?
  - pferde 5y ago
    Would your grandmother?
    - croes 5y ago
      My grandmother doesn't have the tor browser installed. If you already have tor installed you are already capable of getting the information you want.
  - soraminazuki 5y ago
    Depending on the situation, yes. In an environment where information is heavily censored, some people are going to be desperate for outside sources of information. They just need to know where to look for. It's also a red herring too. No answer to your question validates the original commenter's factual understanding of this incident. The commenter got the basic facts completely wrong, which highly suggests that the commenter didn't bother to look beyond the title. But it was apparently enough to label someone an attention seeker.

hatware 5y ago

In today's world, it's guaranteed that these are folks outside of Ukraine. Virtue signalling will be the death of us. Wanting to look like you're doing something is winning more than actually doing something.

vkou 5y ago
Unless you're one of a handful of a senior politicians, you can't 'do something' meaningful. But fortunately, we live in a society where speech has an effect. Speech (which you derisively refer to as 'virtue signaling') shifts the Overton window, and influences the direction society goes.
- prionassembly 5y ago
  The expression "virtue signaling" implies insincerity.
  - TobyTheDog123 5y ago
    Do FOSS contributors actually expect malware like this to produce signifiant positive attention to their cause? More-so than social networks and the media?
    - hatware 5y ago
      Exactly. They piss off ten people for every one they think they're helping. It's not sustainable.
  - hatware 5y ago
    And there's nothing more insincere than telling strangers on the internet to believe what you do because "it's the right thing to do!"
- evocatus 5y ago
- 5y ago

gorjusborg 5y ago

Losing people's trust isn't likely to help your cause, whatever it may be.

croes 5y ago

Doesn't matter where you are from, you don't know what the effect of your actions are and who will be effected. Put in onto social media, your website, your disclaimer, code comments, code license etc. But never in the functionality of your code.