4 ms·
In my opinion, things like scanners should not need to exist if npm's parent company, GitHub, were to take responsibility for what was published to npm. If Wal
by summarybot 2mo ago
In my opinion, things like scanners should not need to exist if npm's parent company, GitHub, were to take responsibility for what was published to npm. If Walmart sells you an item that ends up being a handgrenade there would be hell to pay. In this example, Walmart cannot simply say that Walmart is not in charge of what goes into the item and therefore "buyer beware." Yet, this is precisely what GitHub does with every npm package.
One reasonable approach is to increase the scrutiny for new releases based on how many active downloads of the package there are. So for new packages, maybe there will be not a ton of scrutiny, but for things that are downloaded by millions of users, like Axios, there would be significantly more scrutiny per release.
The epidemic of "not my job" and "[we] don't get paid to do that" is a large contributor to why the world is so messed up. I don't know what to call this phenomenon. In the Hawaiian language there is a word Kuleana which means "sacred responsibility" or "sacred task." If more people took on their Kuleana joyfully we would be inviting the ideal [realm] more rapidly.
- insanitybit 2mo agoWalmart and Github are so different. Walmart doesn't let anyone come in and set up a booth to sell things, Github does. Thinking that Github should take responsibility for what's hosted on it is... well, radical, to say the least. What you're suggesting is a radical departure from how free software has been distributed historically. That goes well beyond Github and NPM.
- doubled112 2mo agoWould the metaphor have worked better if it was Amazon? Walmart does allow other stores to sell through their website.
- insanitybit 2mo agoI would just drop the metaphor entirely since I don't think they're helpful. If you want to advocate for liability, I'd do so directly
- summarybot 2mo agoYou say "free software" but npm is no longer a small open-source project with a federated rulership, it is owned and operated by a for-profit technological giant. There was a radical departure already, when Github acquired npm. It sounds like your stance is "if something is given away for free, consumer protections are not necessary." But if I get poisoned by free samples given away at a grocery store, who is on the hook? Buyer beware? The onus is on the organization that distributes the food, in the case of the grocery store. It is unreasonable for every person to become a food chemist to be able to ascertain the safety of every single food product. Rather, we as a society agree to put that onus on the distribution. This is no different.
- insanitybit 2mo agoThis isn't about npm, it's about who publishes to npm. This isn't a grocery story.
- summarybot 2mo agoI don't appreciate a pedantic interpretation of the analogy; consider any marketplace where the sellers are not the platform: Amazon, FB Marketplace, Etsy, eBay, and so forth. When a consumer gets burned, who gets in trouble?
- insanitybit 2mo agoI don't appreciate analogies at all. If you want to make a point about Github, talk about Github.
- summarybot 2mo agoAlready did. Github owns and controls NPM, npm is no longer a community-controlled project. Therefore, Github should [happily] take on the duties, responsibilities, and obligations of a software publisher to provide either: trust ratings on packages and code, or literally and not figuratively scan every single package-and-version on npm for appropriateness. But obviously you already got that point and just wanted to exert some modicum of bossiness and control by having me regurgitate my well-formulated thoughts for a third time while painting inside the lines you insist are relevant.
- inigyou 2mo agoYou're suggesting that only stuff billionaires like should be allowed on GitHub or npm. No Monero libraries, for example, or YouTube downloaders.