Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
bleepingcomputer.com
Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
1–10 of 1001 posts
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#2GitHub suspended access to their account for a commit to their own software, because it caused a problem for all these companies. For one it shouldn't have, like pinning a dependency and auditing all changes should be done ideally. These libraries are always licensed in a way that excludes warranty of any kind.
But I honestly don't care if companies "exploit" open-source software by making money using them and not donating to the developer. That may be unhealthy for the ecosystem, but neither side is entitled to anything. I would donate, but not expect a donation, and poisoning the well the way these developers did is not going to help any of us.
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#3I don’t understand the mindset of open source developers who dedicate significant time energy and life to free software, unless there’s a tangible, quantifiable advantage to doing so.
That advantage may well be indirect such as reputational or learning. I just don’t grasp why people do it for nothing, to the advantage of large companies.
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#4GitHub suspended access to their account for a commit to their own software, because it caused a problem for all these companies. For one it shouldn't have, like pinning a dependency and auditing all changes should be done ideally. These libraries are always licensed in a way that excludes warranty of any kind. But I honestly don't care if companies "exploit" open-source software by making money using them and not do…
GitHub ToS allow terminating accounts for malicious behaviour, which I'd argue that purposefully breaking downstream code is.
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#5> This trains people not to update, 'coz stuff might break.
What it should be training you to do is test updates first rather than blindly applying them in a production environment...
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#6I don’t understand the mindset of open source developers who dedicate significant time energy and life to free software, unless there’s a tangible, quantifiable advantage to doing so. That advantage may well be indirect such as reputational or learning. I just don’t grasp why people do it for nothing, to the advantage of large companies.
It's quite simple: there IS a "tangible, quantifiable advantage to doing so". The problem is that you imply "...to the person writing the code". That's where your confusion lies.
I am getting huge value from the people who built stuff before me. When I build stuff I can (hopefully) make the world better in the future. That's a "tangible, quantifiable advantage" to doing open source. It's just not an advantage to me personally. But lift your gaze an inch off the ground and you'll see we don't need to be ego centric sociopaths. We can build together. For the species. Everyone wins.
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#7GitHub suspended access to their account for a commit to their own software, because it caused a problem for all these companies. For one it shouldn't have, like pinning a dependency and auditing all changes should be done ideally. These libraries are always licensed in a way that excludes warranty of any kind. But I honestly don't care if companies "exploit" open-source software by making money using them and not do…
GitHub ToS allow terminating accounts for malicious behaviour, which I'd argue that purposefully breaking downstream code is.
That seems like a bit of a shaky ground to stand on for GH.
If someone publishes code for themselves, and at no time asks anyone to take it as a dependency, then at a later date they change that code in a way that breaks other people's use of it, do GH then take over the account?
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#8> This trains people not to update, 'coz stuff might break. What it should be training you to do is test updates first rather than blindly applying them in a production environment...
Testing ? Even MS lets the users test its SW. Testing is expensive and takes a lot of time and we know for sure that our SW works. /s
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#9It's his software and he can do with it as he pleases. It's an MIT license, so there's no warranty whatsoever.
I'm not convinced that GitHub has any business suspending his account.
Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
#10GitHub suspended access to their account for a commit to their own software, because it caused a problem for all these companies. For one it shouldn't have, like pinning a dependency and auditing all changes should be done ideally. These libraries are always licensed in a way that excludes warranty of any kind. But I honestly don't care if companies "exploit" open-source software by making money using them and not do…
GitHub ToS allow terminating accounts for malicious behaviour, which I'd argue that purposefully breaking downstream code is.
Why would the developer of any software that comes explicitly without warranty be hold responsible for downstream breakages? It's not as if one could force people to upgrade to newer versions and they can always keep depending on the old releases.