5 ms·

> Cool story. Actually, "blacklists", "redlists" and many other "lists of undesirables" weren't cool at all. But every generation or so they unfortunately seem

by awb 5y ago

> Cool story. Actually, "blacklists", "redlists" and many other "lists of undesirables" weren't cool at all. But every generation or so they unfortunately seem appealing again. > the list that they're discussing has actually existed for 30 years Where is this list? Who maintains it? OC certainly didn't know about it: "We should probably start an open source sanction list of individuals who abuse trust to ship malware" > When you commit a crime "crime"? Please link me to the law you think they broke. Here's the license: https://github.com/Yaffle/EventSource/blob/master/LICENSE.md https://github.com/Yaffle/EventSource/blob/master/LICENSE.md > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED So, how is this a "crime"? > that knowledge never disappears in any country Not true in any country except maybe North Korea or some other authoritarian state. In any society with checks and balances, verdicts can be appealed, judgements reversed, records expunged and rights restored. This "undo" feature is pretty critical to any legitimate system of justice, as is "innocent until proven guilty". I didn't see any details about the rights of the accused in anyone's blacklisting proposals. > None of these address what happened in any way. Yes, it does. MIT licensed software is provided "AS IS, WITHOUT WARRANTY". If you don't like it you can fork it. If you're afraid of a bad commit, vendor it, which is a best practice anyway, for this exact use case. > Relatively easy for the rest of us to see. Our entire legal branch of government exists because these lines are not always easy. Judges judge things all the time, and not uniformly. If everything was easy to see, we wouldn't need judges or juries. The interpretation of language or of an act on a case by case basis is where things get tricky. > The rest of us will act without you At this point I have way more questions: * Would you blacklist this contributor if they documented the Russian timezone popup as a feature in the package as the issue creator suggested (https://github.com/Yaffle/EventSource/issues/202#issuecomment-1086717230 https://github.com/Yaffle/EventSource/issues/202#issuecommen...)? * What "test" would you apply to code to determine if the developer should be blacklisted or not? Would this blacklist only pertain to malware? Wikipedia (https://en.wikipedia.org/wiki/Malware https://en.wikipedia.org/wiki/Malware) defines a few different malware categories: "Many types of malware exist, including computer viruses, worms, Trojan horses, ransomware, spyware, adware, rogue software, wiper, and scareware." If the code doesn't fall into one of those categories (as is this case), under what circumstances might you still blacklist the developer? * If a maintainer stops maintaining their current library and says all future maintenance will be done on a new library, and that new library contains this Russian timezone popup code, would they be blacklisted? * Would it matter if the "bad code" was intentional or not? Or a joke or not? Or temporary or not? How would you determine the author's intent? Would they have a chance (or be obligated) to respond? Or would you only look at the impact of the code? If you look at the impact, under what conditions would a "bug" get you blacklisted? * Would you blacklist a developer for making a breaking change to a package? What if the breaking change was politically motivated? * Who runs and maintains the list? Does this list have an appeals process? What are the rights of the accused? * How will you disambiguate the list so as not to misconstrue "innocent" developers as blacklisted developers? Will you include their birth name? Social profiles? Emails? Addresses? How will you deal with name changes (someone gets married, or changes their name?), or new online handles? * What age and definition of a minor will you use? And will minors be given different treatment or excused from the blacklist? I could go on, but if you're serious about this idea, you'll probably want to communicate it in more detail because a "forever list of bad developers" sounds a lot like a "forever list of communists" or a "forever list of undesirables". If you're not going to make the same mistakes McCarthy (and others before him) did where this list turns into a biased weapon of control and intimidation, then these details will be really important.

JohnHaugeland 5y ago
> Actually, "blacklists", "redlists" and many other "lists of undesirables" weren't cool at all. That's nice. That isn't what's happening here. What's happening here is akin to the list of photos that every restaurant has to prevent people from bouncing bad checks. Go into the Post Office and you'll see another. Same one as at most grocery stores. I see that you are trying, as hard as you can, to equate keeping a list of bad actors with political suppression. I reject this. Society is fundamentally built on these things that you're extremifying. You have a credit score. Go learn about it. . > Where is this list? Who maintains it? Please stop asking me questions that have already been answered. . > > > When you commit a crime > > "crime"? Please link me to the law you think they broke. If you remove the surrounding context, you will edit what I said to remove that this was a comparative metaphor, in the effort to manufacture an error. This isn't very effective, however. People can just look at the previous comment to see that you've edited what was said in a fashion that significantly changes the intent, and are asking someone to justify something that clearly is not what they actually said, despite being a verbatim quote. . > > that knowledge never disappears in any country > > Not true in any country except maybe North Korea or some other authoritarian state. When you edit out that what I said was that a record of past crimes exists in every country, then you might be able to come to a facile conclusion of this form. In reality, in the United States, criminal records are public and can be looked up online except for minors, and this is true of most modern countries. . > In any society with checks and balances, verdicts can be appealed, judgements reversed, records expunged and rights restored. Though truthful, none of this is in any way related to what I said. . > This "undo" feature is pretty critical to any legitimate system of justice Keeping a text file on github is not an attempt to create a legitimate system of justice. You seem to be unable to differentiate between a text file and a court of law. . > Our entire legal branch of government exists because these lines are not always easy. Your attempts to turn a simple text file into a valid comparison tom the legal branch of a government of 330 million people are confusing to me. Do you believe that a person found in such a list has been tried by a court and is incarcerated? The metaphor you're making seems absurd to me . > At this point I have way more questions They aren't really interesting to me, is the problem . > Would you blacklist this contributor if they documented the Russian timezone popup as a feature in the package as the issue creator suggested Of course not. This person hasn't caused intentional harm. What a weird question. . > What "test" would you apply to code to determine if the developer should be blacklisted or not? My own personal judgement. I'm not really interested if you find that unacceptable. I am not keeping this list for you. My approximate rule of thumb is "did they attempt to cause harm?" If you try to frame this differently, by injecting politics or wild hand waving about your fictional oppressive society, or keep insisting that only North Korea has public court records (it's actually the oppressive regeimes that hide them,) I guess I kind of won't really care I'm sure that, over time, such a definition might become more nuanced, but your attempt to cast someone keeping a list of "this person tried to harm users" as a form of government overreach just ... just seems silly, to me I cannot name a business that doesn't have a list of banned bad customers. Maybe in tiny towns or something? . > If a maintainer stops maintaining their current library and says all future maintenance will be done on a new library, and that new library contains this Russian timezone popup code, would they be blacklisted? I have no idea why you're obsessing about a "russian timezone popup code." These questions are silly. Nobody's blacklisting anyone over a timezone. It's not clear to me if you just misunderstood what actually happened here, or what . > Would you blacklist a developer for making a breaking change to a package? Please stop asking aggressively inappropriate questions. I make breaking changes to packages all the time. Sometimes it's the right thing to do. Sometimes people disagree. More often than not I do it by accident. If you are not able to understand the difference between an intentional bad actor and the vague process of software, you are not equipped to be a participant in this discussion. . > Who runs and maintains the list? I'm aware of about 40 of them. One of them is me. You don't seem to grasp that these lists are common, and are not centralized. This is not a government court body. Please stop pretending that it is. As long as you act this way, you will fail to understand what's actually being discussed here. . > How will you disambiguate the list so as not to misconstrue "innocent" developers as blacklisted developers? By whatever identity mechanism is appropriate for the given package system. Using the example of feross, github and npm username, as well as email. This will vary system to system, of course, but whatever common sense equivalent is appropriate would be used. I have less than zero interest in watching you attempt to deep think about how this could go wrong. These lists are not complicated, and if it actually does go wrong, that person can just say "hey, i'm not that guy, can you fix it," and people will. You're being deeply unreasonable. These things are common. . > I could go on, but if you're serious about this idea, you'll probably want to communicate it in more detail No thanks. I don't have any interest in these opinions you're attempting to put in front of me. These systems are extremely common, and have been for decades. They've been thought through by tens of thousands of people, and the objections you're making are trivially easily solved. . > sounds a lot like Your often repeated opinion is noted. . > "forever list of communists" No. . > or a "forever list of undesirables" Yes. . > If you're not going to make the same mistakes McCarthy (and others before him) did Imagine thinking this was a reasonable thing to say. Unlike McCarthy, if we make mistakes and are told, we fix them. Unlike McCarthy, we aren't ruining lives, ending careers, disbanding university participation, censoring, jailing, or murdering. I have a hard time understanding why you're reacting so severely to systems that are decades old and have never actually had any of the problems you describe. If you're unable to tell the difference between a text file on github that lists people who have intentionally caused harm through package managers, and someone who manipulated world government to jail tens of thousands of people, some for decades? Then I guess I just don't really trust your judgment. We're not the TSA. Nobody's getting banned from any flights. We're just a list that says "oh, if your package manager installs something and the owner key or the author keys include this email address, pop a warning and get user confirmation before anything gets executed" Just so you know, if you're in the United States, and are an adult citizen, you're on dozens of these lists no matter what. Have a good day.

by awb 5y ago

JohnHaugeland 5y ago

> Actually, "blacklists", "redlists" and many other "lists of undesirables" weren't cool at all. That's nice. That isn't what's happening here. What's happening here is akin to the list of photos that every restaurant has to prevent people from bouncing bad checks. Go into the Post Office and you'll see another. Same one as at most grocery stores. I see that you are trying, as hard as you can, to equate keeping a list of bad actors with political suppression. I reject this. Society is fundamentally built on these things that you're extremifying. You have a credit score. Go learn about it. . > Where is this list? Who maintains it? Please stop asking me questions that have already been answered. . > > > When you commit a crime > > "crime"? Please link me to the law you think they broke. If you remove the surrounding context, you will edit what I said to remove that this was a comparative metaphor, in the effort to manufacture an error. This isn't very effective, however. People can just look at the previous comment to see that you've edited what was said in a fashion that significantly changes the intent, and are asking someone to justify something that clearly is not what they actually said, despite being a verbatim quote. . > > that knowledge never disappears in any country > > Not true in any country except maybe North Korea or some other authoritarian state. When you edit out that what I said was that a record of past crimes exists in every country, then you might be able to come to a facile conclusion of this form. In reality, in the United States, criminal records are public and can be looked up online except for minors, and this is true of most modern countries. . > In any society with checks and balances, verdicts can be appealed, judgements reversed, records expunged and rights restored. Though truthful, none of this is in any way related to what I said. . > This "undo" feature is pretty critical to any legitimate system of justice Keeping a text file on github is not an attempt to create a legitimate system of justice. You seem to be unable to differentiate between a text file and a court of law. . > Our entire legal branch of government exists because these lines are not always easy. Your attempts to turn a simple text file into a valid comparison tom the legal branch of a government of 330 million people are confusing to me. Do you believe that a person found in such a list has been tried by a court and is incarcerated? The metaphor you're making seems absurd to me . > At this point I have way more questions They aren't really interesting to me, is the problem . > Would you blacklist this contributor if they documented the Russian timezone popup as a feature in the package as the issue creator suggested Of course not. This person hasn't caused intentional harm. What a weird question. . > What "test" would you apply to code to determine if the developer should be blacklisted or not? My own personal judgement. I'm not really interested if you find that unacceptable. I am not keeping this list for you. My approximate rule of thumb is "did they attempt to cause harm?" If you try to frame this differently, by injecting politics or wild hand waving about your fictional oppressive society, or keep insisting that only North Korea has public court records (it's actually the oppressive regeimes that hide them,) I guess I kind of won't really care I'm sure that, over time, such a definition might become more nuanced, but your attempt to cast someone keeping a list of "this person tried to harm users" as a form of government overreach just ... just seems silly, to me I cannot name a business that doesn't have a list of banned bad customers. Maybe in tiny towns or something? . > If a maintainer stops maintaining their current library and says all future maintenance will be done on a new library, and that new library contains this Russian timezone popup code, would they be blacklisted? I have no idea why you're obsessing about a "russian timezone popup code." These questions are silly. Nobody's blacklisting anyone over a timezone. It's not clear to me if you just misunderstood what actually happened here, or what . > Would you blacklist a developer for making a breaking change to a package? Please stop asking aggressively inappropriate questions. I make breaking changes to packages all the time. Sometimes it's the right thing to do. Sometimes people disagree. More often than not I do it by accident. If you are not able to understand the difference between an intentional bad actor and the vague process of software, you are not equipped to be a participant in this discussion. . > Who runs and maintains the list? I'm aware of about 40 of them. One of them is me. You don't seem to grasp that these lists are common, and are not centralized. This is not a government court body. Please stop pretending that it is. As long as you act this way, you will fail to understand what's actually being discussed here. . > How will you disambiguate the list so as not to misconstrue "innocent" developers as blacklisted developers? By whatever identity mechanism is appropriate for the given package system. Using the example of feross, github and npm username, as well as email. This will vary system to system, of course, but whatever common sense equivalent is appropriate would be used. I have less than zero interest in watching you attempt to deep think about how this could go wrong. These lists are not complicated, and if it actually does go wrong, that person can just say "hey, i'm not that guy, can you fix it," and people will. You're being deeply unreasonable. These things are common. . > I could go on, but if you're serious about this idea, you'll probably want to communicate it in more detail No thanks. I don't have any interest in these opinions you're attempting to put in front of me. These systems are extremely common, and have been for decades. They've been thought through by tens of thousands of people, and the objections you're making are trivially easily solved. . > sounds a lot like Your often repeated opinion is noted. . > "forever list of communists" No. . > or a "forever list of undesirables" Yes. . > If you're not going to make the same mistakes McCarthy (and others before him) did Imagine thinking this was a reasonable thing to say. Unlike McCarthy, if we make mistakes and are told, we fix them. Unlike McCarthy, we aren't ruining lives, ending careers, disbanding university participation, censoring, jailing, or murdering. I have a hard time understanding why you're reacting so severely to systems that are decades old and have never actually had any of the problems you describe. If you're unable to tell the difference between a text file on github that lists people who have intentionally caused harm through package managers, and someone who manipulated world government to jail tens of thousands of people, some for decades? Then I guess I just don't really trust your judgment. We're not the TSA. Nobody's getting banned from any flights. We're just a list that says "oh, if your package manager installs something and the owner key or the author keys include this email address, pop a warning and get user confirmation before anything gets executed" Just so you know, if you're in the United States, and are an adult citizen, you're on dozens of these lists no matter what. Have a good day.