4 ms·

I'm not sure why you're making the claim that writing out a list is somehow "mob justice." It's just documentation.

awb 5y ago
Lists have been used as far more than documentation throughout history. Lists expand in scope and purpose and can be used for mob justice. How will your list safeguard against this? This is one of the more bizarre proposals I’ve seen entertained on HN. Where is the line? If I commit a political dissertation in the comments or README? If I change all my unit tests to use political phrases? If I name all my functions with political connotations? If I pass extra politically motivated data back with every response? And how long does your name stay on the list? Any way to get it removed faster? Any way that it gets extended? And this is in response to using free software? We already have mechanisms for dealing with poor OSS decisions: raise an issue, fork it, unstar it. Maybe we should focus on building up the better OSS projects than trying to create a blacklist of maintainers that don’t adhere to some standards they never agreed to, but we imposed on them.
- JohnHaugeland 5y ago
  Cool story. Anyway, the list that they're discussing has actually existed for 30 years, and your hair pulling about what might happen hasn't. . "Where is the line?" Relatively easy for the rest of us to see. . "If I commit a political dissertation in the comments or README? If I change all my unit tests to use political phrases?" Nobody suggested this should be penalized. This is common. . "And how long does your name stay on the list?" Forever. When you commit a crime, that knowledge never disappears in any country. . "Any way to get it removed faster?" No. . "And this is in response to using free software?" No. . "We already have mechanisms for dealing with poor OSS decisions: raise an issue, fork it, unstar it." None of these address what happened in any way. . "Maybe we should focus on building up the better OSS projects" You go ahead. The rest of us will act without you. Your agreement is not required.
  - awb 5y ago
    > Cool story. Actually, "blacklists", "redlists" and many other "lists of undesirables" weren't cool at all. But every generation or so they unfortunately seem appealing again. > the list that they're discussing has actually existed for 30 years Where is this list? Who maintains it? OC certainly didn't know about it: "We should probably start an open source sanction list of individuals who abuse trust to ship malware" > When you commit a crime "crime"? Please link me to the law you think they broke. Here's the license: https://github.com/Yaffle/EventSource/blob/master/LICENSE.md https://github.com/Yaffle/EventSource/blob/master/LICENSE.md > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED So, how is this a "crime"? > that knowledge never disappears in any country Not true in any country except maybe North Korea or some other authoritarian state. In any society with checks and balances, verdicts can be appealed, judgements reversed, records expunged and rights restored. This "undo" feature is pretty critical to any legitimate system of justice, as is "innocent until proven guilty". I didn't see any details about the rights of the accused in anyone's blacklisting proposals. > None of these address what happened in any way. Yes, it does. MIT licensed software is provided "AS IS, WITHOUT WARRANTY". If you don't like it you can fork it. If you're afraid of a bad commit, vendor it, which is a best practice anyway, for this exact use case. > Relatively easy for the rest of us to see. Our entire legal branch of government exists because these lines are not always easy. Judges judge things all the time, and not uniformly. If everything was easy to see, we wouldn't need judges or juries. The interpretation of language or of an act on a case by case basis is where things get tricky. > The rest of us will act without you At this point I have way more questions: * Would you blacklist this contributor if they documented the Russian timezone popup as a feature in the package as the issue creator suggested (https://github.com/Yaffle/EventSource/issues/202#issuecomment-1086717230 https://github.com/Yaffle/EventSource/issues/202#issuecommen...)? * What "test" would you apply to code to determine if the developer should be blacklisted or not? Would this blacklist only pertain to malware? Wikipedia (https://en.wikipedia.org/wiki/Malware https://en.wikipedia.org/wiki/Malware) defines a few different malware categories: "Many types of malware exist, including computer viruses, worms, Trojan horses, ransomware, spyware, adware, rogue software, wiper, and scareware." If the code doesn't fall into one of those categories (as is this case), under what circumstances might you still blacklist the developer? * If a maintainer stops maintaining their current library and says all future maintenance will be done on a new library, and that new library contains this Russian timezone popup code, would they be blacklisted? * Would it matter if the "bad code" was intentional or not? Or a joke or not? Or temporary or not? How would you determine the author's intent? Would they have a chance (or be obligated) to respond? Or would you only look at the impact of the code? If you look at the impact, under what conditions would a "bug" get you blacklisted? * Would you blacklist a developer for making a breaking change to a package? What if the breaking change was politically motivated? * Who runs and maintains the list? Does this list have an appeals process? What are the rights of the accused? * How will you disambiguate the list so as not to misconstrue "innocent" developers as blacklisted developers? Will you include their birth name? Social profiles? Emails? Addresses? How will you deal with name changes (someone gets married, or changes their name?), or new online handles? * What age and definition of a minor will you use? And will minors be given different treatment or excused from the blacklist? I could go on, but if you're serious about this idea, you'll probably want to communicate it in more detail because a "forever list of bad developers" sounds a lot like a "forever list of communists" or a "forever list of undesirables". If you're not going to make the same mistakes McCarthy (and others before him) did where this list turns into a biased weapon of control and intimidation, then these details will be really important.

awb 5y ago

Lists have been used as far more than documentation throughout history. Lists expand in scope and purpose and can be used for mob justice. How will your list safeguard against this? This is one of the more bizarre proposals I’ve seen entertained on HN. Where is the line? If I commit a political dissertation in the comments or README? If I change all my unit tests to use political phrases? If I name all my functions with political connotations? If I pass extra politically motivated data back with every response? And how long does your name stay on the list? Any way to get it removed faster? Any way that it gets extended? And this is in response to using free software? We already have mechanisms for dealing with poor OSS decisions: raise an issue, fork it, unstar it. Maybe we should focus on building up the better OSS projects than trying to create a blacklist of maintainers that don’t adhere to some standards they never agreed to, but we imposed on them.

JohnHaugeland 5y ago
Cool story. Anyway, the list that they're discussing has actually existed for 30 years, and your hair pulling about what might happen hasn't. . "Where is the line?" Relatively easy for the rest of us to see. . "If I commit a political dissertation in the comments or README? If I change all my unit tests to use political phrases?" Nobody suggested this should be penalized. This is common. . "And how long does your name stay on the list?" Forever. When you commit a crime, that knowledge never disappears in any country. . "Any way to get it removed faster?" No. . "And this is in response to using free software?" No. . "We already have mechanisms for dealing with poor OSS decisions: raise an issue, fork it, unstar it." None of these address what happened in any way. . "Maybe we should focus on building up the better OSS projects" You go ahead. The rest of us will act without you. Your agreement is not required.
- awb 5y ago
  > Cool story. Actually, "blacklists", "redlists" and many other "lists of undesirables" weren't cool at all. But every generation or so they unfortunately seem appealing again. > the list that they're discussing has actually existed for 30 years Where is this list? Who maintains it? OC certainly didn't know about it: "We should probably start an open source sanction list of individuals who abuse trust to ship malware" > When you commit a crime "crime"? Please link me to the law you think they broke. Here's the license: https://github.com/Yaffle/EventSource/blob/master/LICENSE.md https://github.com/Yaffle/EventSource/blob/master/LICENSE.md > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED So, how is this a "crime"? > that knowledge never disappears in any country Not true in any country except maybe North Korea or some other authoritarian state. In any society with checks and balances, verdicts can be appealed, judgements reversed, records expunged and rights restored. This "undo" feature is pretty critical to any legitimate system of justice, as is "innocent until proven guilty". I didn't see any details about the rights of the accused in anyone's blacklisting proposals. > None of these address what happened in any way. Yes, it does. MIT licensed software is provided "AS IS, WITHOUT WARRANTY". If you don't like it you can fork it. If you're afraid of a bad commit, vendor it, which is a best practice anyway, for this exact use case. > Relatively easy for the rest of us to see. Our entire legal branch of government exists because these lines are not always easy. Judges judge things all the time, and not uniformly. If everything was easy to see, we wouldn't need judges or juries. The interpretation of language or of an act on a case by case basis is where things get tricky. > The rest of us will act without you At this point I have way more questions: * Would you blacklist this contributor if they documented the Russian timezone popup as a feature in the package as the issue creator suggested (https://github.com/Yaffle/EventSource/issues/202#issuecomment-1086717230 https://github.com/Yaffle/EventSource/issues/202#issuecommen...)? * What "test" would you apply to code to determine if the developer should be blacklisted or not? Would this blacklist only pertain to malware? Wikipedia (https://en.wikipedia.org/wiki/Malware https://en.wikipedia.org/wiki/Malware) defines a few different malware categories: "Many types of malware exist, including computer viruses, worms, Trojan horses, ransomware, spyware, adware, rogue software, wiper, and scareware." If the code doesn't fall into one of those categories (as is this case), under what circumstances might you still blacklist the developer? * If a maintainer stops maintaining their current library and says all future maintenance will be done on a new library, and that new library contains this Russian timezone popup code, would they be blacklisted? * Would it matter if the "bad code" was intentional or not? Or a joke or not? Or temporary or not? How would you determine the author's intent? Would they have a chance (or be obligated) to respond? Or would you only look at the impact of the code? If you look at the impact, under what conditions would a "bug" get you blacklisted? * Would you blacklist a developer for making a breaking change to a package? What if the breaking change was politically motivated? * Who runs and maintains the list? Does this list have an appeals process? What are the rights of the accused? * How will you disambiguate the list so as not to misconstrue "innocent" developers as blacklisted developers? Will you include their birth name? Social profiles? Emails? Addresses? How will you deal with name changes (someone gets married, or changes their name?), or new online handles? * What age and definition of a minor will you use? And will minors be given different treatment or excused from the blacklist? I could go on, but if you're serious about this idea, you'll probably want to communicate it in more detail because a "forever list of bad developers" sounds a lot like a "forever list of communists" or a "forever list of undesirables". If you're not going to make the same mistakes McCarthy (and others before him) did where this list turns into a biased weapon of control and intimidation, then these details will be really important.