4 ms·

This is definitely going a bit too crazy. I sympathized with Wordpress a lot in the initial drama, but this is going downhill fast. Blocking somebody's access

This is definitely going a bit too crazy. I sympathized with Wordpress a lot in the initial drama, but this is going downhill fast. Blocking somebody's access to the plugin repository, not accepting their patches, and then 'releasing' your own 'secure' version is just abuse, period.

sangnoir 2y ago
It's not inherently abusive, consider NPM resurrecting an earlier version of leftpad against author's wish. Who should provide security updates to an open source package when author no longer has access to the repository - voluntarily or otherwise?
- wongogue 2y ago
  > updates to an open source package when author no longer has access to the repository Give them the access. It's not like they forgot the password or are AWOL.
- 0cf8612b2e1e 2y ago
  That would be more compelling if the only change was the security patch itself. Maybe a link to the “only supported” fork.
- lolinder 2y ago
  > voluntarily or otherwise? You say this like there's not much difference between the two, but there's a world of difference. One is someone yanking a repo and breaking millions of builds across the world and the maintainers of npm stepping in to fix things (in a move that is still controversial, mind you). The other is the maintainers of the WordPress plugin repository starting a self-described "nuclear war" with the plugin maintainers, banning them from the repo, publicly disclosing a security vulnerability in the plugin, then hijacking it to save the day. One is a potentially misguided step to solve a real problem. What Matt is doing here is just cosplaying Syndrome from The Incredibles.
  - thanksgiving 2y ago
    > One is someone yanking a repo and breaking millions of builds across the world and the maintainers of npm stepping in to fix things (in a move that is still controversial, mind you). Thank you for stating the move is still controversial. The root issue people always forget was NOT left pad. It was kik. It was not npm’s to take away from the package maintainer and give to someone else. That was the abuse of trust that caused the maintainer to also yank left pad. I am not this maintainer. I don’t know this maintainer. However, if someone went to my email provider for example Gmail and said I can’t use kik at Gmail dot com anymore and this email address would be given to kik now, I would be furious. Imagine if Toyota came to New York Times and said the New York Times can’t have a page like nytimes.com/toyota The lawyers at the times would tell them to pound sand and or see you in court. NPM has never acknowledged its grave error of judgment. In fact, its website doubles down saying it stands by its decision. If you told me Wordpress dot org would manage to outclown the clowns at npm, I would not believe you and yet here we are.
- jakelazaroff 2y ago
  “voluntary or otherwise” is doing a ton of lifting there. Why does the original author no longer have access to the repository?
- deleted 2y ago
  [deleted]
sgdfhijfgsdfgds 2y ago
Yeah. I'm a long-time WP site developer. I actually really like Gutenberg (which a lot of critics seem to be suggesting is the first thing that should go in a fork). I'm broadly supportive of e.g. bringing WP-GraphQL and its developer in-house, of adding ACF-type functionality to the core, and even of working to persuade WP Engine to be slightly better citizens. But I can't shake the feeling that to a lot of observers, this latest thing is going to look rather like a kidnapping. It's not right.
- woleium 2y ago
  indeed, as a teenager we are all supposed to learn that just because we can does not mean we should.

sangnoir 2y ago

It's not inherently abusive, consider NPM resurrecting an earlier version of leftpad against author's wish. Who should provide security updates to an open source package when author no longer has access to the repository - voluntarily or otherwise?

wongogue 2y ago
> updates to an open source package when author no longer has access to the repository Give them the access. It's not like they forgot the password or are AWOL.
0cf8612b2e1e 2y ago
That would be more compelling if the only change was the security patch itself. Maybe a link to the “only supported” fork.
lolinder 2y ago
> voluntarily or otherwise? You say this like there's not much difference between the two, but there's a world of difference. One is someone yanking a repo and breaking millions of builds across the world and the maintainers of npm stepping in to fix things (in a move that is still controversial, mind you). The other is the maintainers of the WordPress plugin repository starting a self-described "nuclear war" with the plugin maintainers, banning them from the repo, publicly disclosing a security vulnerability in the plugin, then hijacking it to save the day. One is a potentially misguided step to solve a real problem. What Matt is doing here is just cosplaying Syndrome from The Incredibles.
- thanksgiving 2y ago
  > One is someone yanking a repo and breaking millions of builds across the world and the maintainers of npm stepping in to fix things (in a move that is still controversial, mind you). Thank you for stating the move is still controversial. The root issue people always forget was NOT left pad. It was kik. It was not npm’s to take away from the package maintainer and give to someone else. That was the abuse of trust that caused the maintainer to also yank left pad. I am not this maintainer. I don’t know this maintainer. However, if someone went to my email provider for example Gmail and said I can’t use kik at Gmail dot com anymore and this email address would be given to kik now, I would be furious. Imagine if Toyota came to New York Times and said the New York Times can’t have a page like nytimes.com/toyota The lawyers at the times would tell them to pound sand and or see you in court. NPM has never acknowledged its grave error of judgment. In fact, its website doubles down saying it stands by its decision. If you told me Wordpress dot org would manage to outclown the clowns at npm, I would not believe you and yet here we are.
jakelazaroff 2y ago
“voluntary or otherwise” is doing a ton of lifting there. Why does the original author no longer have access to the repository?
deleted 2y ago
[deleted]

sgdfhijfgsdfgds 2y ago

Yeah. I'm a long-time WP site developer. I actually really like Gutenberg (which a lot of critics seem to be suggesting is the first thing that should go in a fork). I'm broadly supportive of e.g. bringing WP-GraphQL and its developer in-house, of adding ACF-type functionality to the core, and even of working to persuade WP Engine to be slightly better citizens. But I can't shake the feeling that to a lot of observers, this latest thing is going to look rather like a kidnapping. It's not right.

woleium 2y ago
indeed, as a teenager we are all supposed to learn that just because we can does not mean we should.