Live data from Hacker News

A notable JavaScript developer shamelessly copied one of my most downloaded nod

twitter.com

151–160 of 309 posts

Re: A notable JavaScript developer shamelessly copied one of my most downloaded nod

#151
post #147
post #73

I keep thinking about this event and it seems like a fractal of bizarre phenomena. The act of stripping git history and attribution while forking is itself malicious, but then aggressively creating pull requests across major projects to use the new version and rack up your download count (???), then picking petty fights with the creator of the original over attribution (????), and the fanbase (?????) of the forker do…

> The act of stripping git history and attribution while forking is itself malicious, Well, okay, the forking could have been more politely, but author is a bit fast to pull the pirate card. It's a free/libre fork of a free/libre project after all. > nanocolors implementation and API are the same as Colorette. You essentially pirated my work.[0] [0]: https://twitter.com/jorgebucaran/status/1441728642711572486

free/libre does not equate to unlicensed.

Fork has violated the license of original by stripping the attribution and history.

Re: A notable JavaScript developer shamelessly copied one of my most downloaded nod

#152
post #57

Earlier quoted context omitted.

He does seem very aggressive in his attempts to get this into as many popular packages (and/or onto as many machines) as he can in the shortest amount of time. According to the original project's author, he even silently removed loads of edge case handlers until he was called out on it [0]. That seems to have been a really quick and dirty tactic to get his performance numbers up. My spidey senses are tingling too. [0…

Wouldnt be surprised if the package then gets sold to some shady people. Desperate people do desperate things and this surely looks desperate.

This is a massive leap and really shouldn't be on HN.

Re: A notable JavaScript developer shamelessly copied one of my most downloaded nod

#153
The JS Open Source Community is filled with people grifting things like this. Quite notably, there's a linter called JS Standard Style, which actually has nothing to do with JS Standards.

It's marketed as if it was a standard, the fact that it isn't is tucked away in the readme, and also -- the entire project is just a wrapper around someones .eslintrc file, yet barely any credit is given to the ESLint devs who do all the work.

Go ahead and read the readme here, https://github.com/standard/standard. Could you genuinely tell this wasn't really a JS Standard at a glance? Could you tell this was just a config file for someone elses work? None of the donations go upstream to eslint by the way.

Hell, the actual config file is hidden inside a sub repo:

https://github.com/standard/eslint-config-standard

which has the audacity to claim

> This module is for advanced users. You probably want to use standard instead :)

It's a config file for someone elses program! Why does this library go through so much effort to hide that it's just someones config file? Why on earth is it called JS Standard Style?

The whole community is filled with slimy nonsense like this.

EDIT: also, this was the project that displayed ads in a million terminals on installs[1]. It's 100% clear to me that this package is misleadingly marketed for personal gain.

[1]: https://github.com/standard/standard/issues/1381

Re: A notable JavaScript developer shamelessly copied one of my most downloaded nod

#154
post #102

Earlier quoted context omitted.

> I think because JS is such a large tent, there are folks not familiar with licenses and general norms in this space. It's worth pointing out that this is all about a bunch of packages that decorate strings with ANSI colour escape sequences... I'm not saying it's worthless, or that there is nothing wrong in principle - but it's a lot of noise over something easily replicable from scratch - something simple enough th…

I don't think this is a fair framing. This isn't left-pad - it's a library that abstracts something people find annoying, and finding the right abstraction can be difficult even if the final code doesn't seem complicated. Add in a few years of bug fixes and whatnot, and it seems pretty rude to dismiss the result as "easily replicable from scratch".

I think it's worth pointing out that these pull requests replace a totally unrelated package with either one of these two packages that claim to be copying each other.

The way it was framed was that someone forked a packaged and started replacing all users; not what happened.

Also: I don't even use JS, so, I have no idea who these people or libraries are.

Re: A notable JavaScript developer shamelessly copied one of my most downloaded nod

#155

Earlier quoted context omitted.

I clarified the comment a bit -- I considered that attribution-stripping, but I think you're right that it's more than just that. Tangentially: it's somewhat interesting that we don't consider the source code history in our OSS licenses...

> Tangentially: it's somewhat interesting that we don't consider the source code history in our OSS licenses... IIUC, IANAL, we don't have to worry about it. Versions of software can have different licenses, and the license for each version is the license that the repo was under when that version was committed. As far as I know, if you replace every instance of "version" in the previous paragraph with "commit", it st…

> Versions of software can have different licenses, and the license for each version is the license that the repo was under when that version was committed.

Not particularly wrong, just adding: There can even be additional licensing terms that aren't documented in the git history so they wouldn't be visible there.

And there is another sticky detail:

So if the original copy would have violated any of the licensing terms of the revision/release being copied (e.g. by removing copyright/authoring information), any more of these copies may become tainted if that resulted in a broken license chain. At this stage it is already regardless which licensing is announced in the new repository (and at which commit).

This poses some problems on very public systems like Github as it may not be directly visible any longer.

One way to deal with it is to block the violating user on Github. It's not perfect but can help with bookkeeping.

And in general you normally should just do Github forks to file pull requests, not to actually fork projects. Not saying that you can't - you can perfectly - but more on the level of day to day operations. For a full fork, you should have actual reasons. Otherwise its ruining the benefits of copying code.

Re: A notable JavaScript developer shamelessly copied one of my most downloaded nod

#157
This is JavaScript package-culture at work.

Many packages attempt to be those “as seen on Tv” gadgets which fix weirdly specific issues in a functionally-fixed way. Single-function goods are frequently given cutesy branding names in hopes of making their way into your home/package.json. Now we even have the product-level copycats.

Computer code is not an appliance, and no one cares how many people play with your little gadget.

Re: A notable JavaScript developer shamelessly copied one of my most downloaded nod

#158
post #40

What is even going on here? https://github.com/jorgebucaran/colorette/issues/78 . They're arguing about who should have attribution for adding a single "!s &&" to improve performance? What happened with the world where open-source was about creating cool projects together , not about who has the most stars on GitHub? To be honest, this is the general feeling I get from the JavaScript community: Instead of working tog…

GitHub should remove stars, it has become a petty metric.

Re: A notable JavaScript developer shamelessly copied one of my most downloaded nod

#160

Isn't Jorge Bucaran the guy who contributed code to Oh My Fish and then tried to DMCA it for copyright violation (for the code that he had contributed) in order to get more traffic to his competitor project Fisherman? I'd not trust anything this guy says

Yes, same guy. was discussed here https://news.ycombinator.com/item?id=10271304
Post reply on HN