8 ms·

We should probably start an open source sanction list of individuals who abuse trust to ship malware. The faker/colors guy, node-ipc guy, whoever's responsible

• TobyTheDog123 5y ago
  100% agree, perhaps instead of only tracking usernames it can also track external Github URLs (to portfolios, linkedin, twitter, and the like), email addresses, etc etc, just to make it a little harder to evade the sanction while also taking credit for their work off of Github.
  • 0des 5y ago
    Maybe we could pin a symbol on their avatars, to make them easy to identify
    • TobyTheDog123 5y ago
      • idontknowifican 5y ago
        it’s always the people accusing folks of being nazis, but it turns out they’re the real nazi. pretty cool shit going on
      • deleted 5y ago
        [deleted]
      • rubyist5eva 5y ago
        Or a scarlet letter. https://en.wikipedia.org/wiki/The_Scarlet_Letter?msclkid=b47519cbb7a311eca375463a82e75c1c https://en.wikipedia.org/wiki/The_Scarlet_Letter?msclkid=b47...
        • TobyTheDog123 5y ago
          The defense is that it's an obscure reference to a story in which women are physically marked instead of Jews?
          • rubyist5eva 5y ago
            The Scarlet Letter is not obscure, there was even a major Hollywood movie made a few years ago that was extremely loosely based on it. Perhaps you need to read more.
            • TobyTheDog123 5y ago
              Perhaps you need to find a better argument. https://trends.google.com/trends/explore?date=today%201-m&geo=US&q=%2Fm%2F01pk4g,%2Fm%2F03hzt https://trends.google.com/trends/explore?date=today%201-m&ge...
      • JohnHaugeland 5y ago
        Uh. Interpreting that as referencing the Holocaust seems a little extreme.
        • TobyTheDog123 5y ago
          To not interpret it that way would be naive.
          • rubyist5eva 5y ago
            [flagged]
            • TobyTheDog123 5y ago
              [flagged]
          • JohnHaugeland 5y ago
            It's not actually naive to disagree with you, and at the time of this writing, several other people have disagreed with you as well, including two people giving alternative and less extreme interpretations which also fit the casual usage of the phrase. Several other people have pushed back on what they suggest is you inserting nazis into the conversation. It's pretty aggressive to tell someone they're being naive because they don't agree with you and are trying to defend someone, in my opinion. Nominally, saying someone is being naive suggests that you can show that something is not just wrong but shouldn't have been believed by anyone sensible. Since you appear to be interpreting the words of a stranger, I doubt that this is the case. Usually, in my experience, going to the most extreme possible interpretation without direct support isn't actually justified. If several different people have disagreed with you, perhaps that's a point at which you might reconsider, instead of criticizing everyone as being unable to see what you see. One possibility is that you might be overreacting. But to be clear, to me, the wording that they used seems to specifically indicate the novel The Scarlet Letter, by Nathanial Hawthorne. This is a culturally significant phrasing with frequent repetition, which is non-offensive, and unlike a mention of the Nazis, actually makes sense in context. In the rest of the text, they are talking about shaming, not wholesale slaughter of human life. If I wanted to discuss someone wearing a mark of social shame as a pariah, it's quite likely that I would phrase it the same way, and I'm quite startled to realize that anyone might interpret such a comment in this radically other way. It's pretty common to talk about wearing a mark of shame, and you are the first person I've ever seen in my life suggest that that should be associated with the genocidal extermination of people by their religion. I think that you might be well advised to look at what other people are saying here. Two people have told you that they feel that other interpretations are appropriate besides me, and another two have expressed concern for what they suggest is the inappropriate addition of a genocide to what was being discussed. I'm inclined to agree with them. It's hard, because earlier in the discussion when you were saying "zero tolerance policy," I was super on your side. I thought that you were one of the few people here discussing solid common sense. But also, ... I dunno, man, this just seems like an unjustified public shaming, to me. In my private experience - and this has no attached data, and I could be wrong - but in my private experience, when someone is actually making a comparison like that, they're doing it for one of three reasons: 1. Shock value 2. Demonization 3. It's actually legitimately relevant in context In all three of those cases, I would expect the person to come out and directly say what they meant, instead of making a vague metaphoric reference. Metaphor defeats shock value; metaphor does not make people look evil; metaphor doesn't have impact when you're trying to make someone face history. Call me naive if you want, but I just don't think that person said what you claim, and I'm not alone in that. If someone didn't say "nazi," and there's a reasonable common way to interpret what they said which makes sense in context, when "nazi" doesn't, probably ... probably they didn't mean nazi, friend. Horses and zebra, and all that stuff.
      • ComputerGuru 5y ago
        Wow. You escalated that quickly.
        • zo1 5y ago
          It was the other guy that "escalated it" there. "pin a symbol on their avatars, to make them easy to identify" is a reference to the star of David that Jews were made to wear in Germany, so they could be "easy to identify".
          • 0des 5y ago
            Its a reference to the scarlet letter and making bad actors of marriage easy to identify. Here we are identifying bad actors in the field of business, analogous to a marriage. You people are insufferable.
            • zo1 5y ago
              I never read the book/story, nor do I know anything about it. Star of David and the stuff around Jews in Germany I do. You can't blame people for not knowing some "more" obscure reference that you know.
              • 0des 5y ago
                I'm defending an assault of my character. Your ignorance of common knowledge does not negate anything I said in my own defense.
                • awb 5y ago
                  > Your ignorance of common knowledge The Star of David and Scarlet Letter (or letter "A" for adulterer) were both symbols people were made to wear, so they could be identified as "undesirable". The Star of David is probably far more well known world-wide because of how much more recently it was used (some people still alive today were forced to wear it) and the atrocities that followed. Either way, in history it's never been a good thing when people are shaming and identifying people publicly by "marking" them. > I'm defending an assault of my character I hope "Maybe we could pin a symbol on their avatars, to make them easy to identify" was missing a "/s". Unfortunately, from the other comments in the thread and your follow up: "Here we are identifying bad actors in the field of business, analogous to a marriage.", it seems like proposals like this are unfortunately real. And it's unclear how comparing your proposal to a Scarlet Letter would be a good thing. The Scarlet Letter (https://en.wikipedia.org/wiki/The_Scarlet_Letter https://en.wikipedia.org/wiki/The_Scarlet_Letter) is a cautionary tale of public shaming: > The major theme of The Scarlet Letter is shaming and social stigmatizing Plus, the analogy doesn't even make sense. 1) business is nothing like marriage 2) this isn't even a business situation since you have no fiduciary relationship with the author (you got something, but paid nothing), and you have no contractual relationship with the author, other than you unilaterally agreeing to be bound by the "AS IS, WITHOUT WARRANTY OF ANY KIND" terms of the MIT license 3) adulterers (or "bad actors" in a marriage) are rarely punished in modern society, and are no longer "marked" in any country I know of Badges of shame (https://en.wikipedia.org/wiki/Badge_of_shame https://en.wikipedia.org/wiki/Badge_of_shame) are long gone from modern society because of how cruel, unusual and humiliating they were. This idea of creating a symbol and process to "publicly identify bad actors" is more in alignment with 17th century Puritans and 20th century dictators, not any modern social structure I know of. The better thing to do is: if they broke a law or a Terms of Service, or a Code of Conduct, then warn, suspend or ban them from the platform and/or repository where the offense took place. If they didn't break any rules, then let them be and use your GitHub stars, free speech, forks, etc. to promote alternatives.
    • tbrownaw 5y ago
      But what? Something like an "H" for "hacker" would be considered a positive by far too many people who wouldn't realize at first that it's using the other, wrong, definition.
  • oauea 5y ago
    Until they invoke their right to erasure
    • rubyist5eva 5y ago
      Only silly people think that right exists.
      • tbrownaw 5y ago
        Sure retcons are inherently a silly idea, but if "silly people" includes courts and law enforcement is it really that silly?
        • JohnHaugeland 5y ago
          "Sure retcons are inherently a silly idea, but if "silly people" includes courts and law enforcement is it really that silly?" The key understanding is that silly people do not, here, include courts and law enforcement. The thing the poster is trying to reference is the GDPR, and the GDPR does not offer this right with regard to other individuals. What makes this silly is people pretending rights exist that actually do not.
          • oauea 5y ago
            If someone is publicly compiling a database of other individuals, and hosts this on e.g. github, you can absolutely get it taken down.
            • JohnHaugeland 5y ago
              Well, go ahead, then. They've been up for literal decades.
              • oauea 5y ago
                Link to any that have my personal data listed on them?
• rwalle 5y ago
  There is some validity in the idea itself, but I am pretty sure there is no way to actually make it work.
  • tragictrash 5y ago
    I see a downside too, like forcing a package owner out of anonymity by flagging their package as "by an unscrupulous author", therefore forcing them to reveal their identity to dispute it.
    • cphoover 5y ago
      ehh nobody has to reveal themselves... but I don't want to necessarily consume random packages from anonymous authors either... I think that a sanction list would make sense, perhaps https://socket.dev/ https://socket.dev/ could use it as a data point for alerts if they are not already
      • feross 5y ago
        Founder of https://socket.dev https://socket.dev here. We’re considering an alert like “Maintainer has engaged in sabotage behavior in the past” to cover cases like colors, node-ipc, event-source-polyfill.
        • awb 5y ago
          It's sad watching OSS go from the carrot approach (GitHub stars, blog posts, etc.) to the stick approach (blacklisting developers). If you insist on doing this, maybe try to answer a few of these questions first: * How are you defining "sabotage"? And how do you reconcile the act of "sabotage" on a project with an MIT license: "AS IS, WITHOUT WARRANTY OF ANY KIND"? * What are the rights of the accused? Is there a review / appeal process? A way to get your record expunged? Who will be the arbiters? * Many minors contribute to OSS, what are their rights? And what age is a minor? How will you verify age? * How long does this "black mark" last once "convicted"? * How are you going to differentiate between a bug, an intentional breaking change, activism, sabotage, malware, etc.? And will it make a different if it's in the test suite? In non-breaking functionality? In undocumented functionality? In documented functionality? Or if it affects a minority of users vs. all users? * What's your tolerance for jokes, easter eggs, etc. that intentionally or unintentionally cause mischief / unexpected results? * What's your stance on maintainers that refuse to remove or revert code committed by other developers that you consider "sabotage"? Will the entire project team be flagged as "sympathizers"? Or will everyone but the author of the offending commit get a pass? * How do you disambiguate between developers, through their birth name or username? What happens if a "blacklisted" developer changes their username or creates a new one? Lots more questions, but if you proceed, I hope it done with a firm understanding of history. Joe McCarthy (https://en.wikipedia.org/wiki/Joseph_McCarthy https://en.wikipedia.org/wiki/Joseph_McCarthy) famously tried to stamp out communism with a list of "subversive" individuals. The blacklist ultimately became a way to intimidate and control, because it had no safe guards, no transparent criteria, no neutral arbiters, no compassion, no due process, etc.
• ajross 5y ago
  So... cancel them? I get that people are angry, but such a central enforcement authority would be at least as abusable, if not more. You can't win here. If you trust someone else's software, you need to evaluate the author and establish a relationship. For decades in open source, we did this via formal organizations with charters and incorporations and foundations and boards and stuff (FSF, Red Hat, yada, yada). We can trust gcc or Linux because we have visibility into the reward structure that produced it beyond "what this developer did". NPM's big failing is in short-circuiting that process and inviting a culture where any rando can push out a package that can be trivially slurped up and used by everyone, transitively. That's great for the rando developers, not so great for the consumers as it turns out. But you don't fix it via mob justice. You fix it via organization.
  • oefrha 5y ago
    If you classify revoking a malware author’s developer certificate in a signed environment (e.g. Apple platforms) as cancelling, sure. Not to mention warnings from a checker which can be ignored are far weaker than revoked certificates.
    • ajross 5y ago
      Your hyperbolic use of "malware" for what is clearly a prank is precisely why this is abusable. I buy that you feel strongly and think this developer should be punished for, essentially, making their views visible in their work. Now imagine the people who would want to punish you for your views. Think they won't find anything?
      • oefrha 5y ago
        This is as much a “prank” as “benign” adware that pops up an ad on your desktop every hour.
        • ficklepickle 5y ago
          Maybe adware that pops a message that doesn't generate any revenue once after 15 seconds would be more accurate. But I suppose that depends on if a single non-commercial message counts as an ad.