Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Faker.js is now a community controlled project

fakerjs.dev

Post reply on HN
Print view View original

11–20 of 357 posts

Re: Faker.js is now a community controlled project

#11

Post by PragmaticPulp »

throwawayay02 wrote: post #6

You can spin it however you like, but renaming the real one "fakerjs-legacy" and appropriating all sponsors is a scumbag move.

The terms of the funding are attached to the project, not a specific maintainer:

> During the conversation with Ben, he went over the terms and conditions of the Open Collective with me.

> Ben said that simply, "The funding is attached to the project, not the current maintainer."

None of Marak's personal GitHub sponsors were changed (obviously).

To be clear: Marak deleted the original project as part of his protest. The sponsors in question are donating money to sponsor the project, not a single person. It wouldn't make sense to send their money to someone who deleted the project.

Re: Faker.js is now a community controlled project

#13

Post by PragmaticPulp »

throwaway858 wrote: post #10

It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. This was his own corner of the internet for him to publish his own personal projects. I understand the decision for npm to take ownership of his packages, because npm is a community package repository owned by, and for, the community. All community package repositories have some sort of policy for p…

> It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors.

He's not banned: https://github.com/Marak

You have to keep in mind that his changes were basically indistinguishable from a security breach of his account. Nobody really sabotages their own repos in a malicious manner like this. Suspending his account while they investigated doesn't seem like a stretch.

> This was his own corner of the internet for him to publish his own personal projects.

Which he's still free to do. But the actions in question had nothing to do with his "personal projects". It was specifically about his actions to intentionally break popular Node.js packages and do so with a version number that would disguise the change as a non-breaking update. It was a malicious act, and there's no way to paint it as anything else.

Re: Faker.js is now a community controlled project

#15

Post by ABeeSea »

pawelmurias wrote: post #9
throwawayay02 wrote: post #6

You can spin it however you like, but renaming the real one "fakerjs-legacy" and appropriating all sponsors is a scumbag move.

I assume nobody in their right would sponsor the orginal author who instead of maintaining the project distributes malware and builds bombs.

The bomb building arrest is not getting enough attention in all this. He is clearly mentally unwell.

Re: Faker.js is now a community controlled project

#16

Post by nightpool »

throwaway858 wrote: post #10

It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. This was his own corner of the internet for him to publish his own personal projects. I understand the decision for npm to take ownership of his packages, because npm is a community package repository owned by, and for, the community. All community package repositories have some sort of policy for p…

Yes, I'm also curious about GitHub's justification for this. It feels like they should have made some sort of statement about why the account was suspended, for the sake of transparency in such a large controversy. It's perfectly imaginable that Marak used his GitHub account to spam/harass other projects, or engage in some other type of speech that went against GitHub's guidelines, but there needs to be more clarity so that this doesn't seem like a case of "You annoyed me, so you're gone". As you said, it really can give the appearance of GitHub siding with the commercial use of open source for their own self-interest, even if I have enough trust in GitHub to know that that's probably not what they intended to do.

EDIT: I'm glad to hear from a sibling comment that GitHub has since unsuspended his account, since TFA and this comment made me think he was still suspended. Still, it feels like a misstep for GitHub not to have made some sort of comment here.

Re: Faker.js is now a community controlled project

#17

Post by chillfox »

throwaway858 wrote: post #10

It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. This was his own corner of the internet for him to publish his own personal projects. I understand the decision for npm to take ownership of his packages, because npm is a community package repository owned by, and for, the community. All community package repositories have some sort of policy for p…

I get what you are saying, but I feel like this applies:

Not your domain/site, not your corner of the internet.

Re: Faker.js is now a community controlled project

#18

Post by throwawayay02 »

afavour wrote: post #12
throwawayay02 wrote: post #6

You can spin it however you like, but renaming the real one "fakerjs-legacy" and appropriating all sponsors is a scumbag move.

Serious question: why? What would you say those sponsors were sponsoring?

No post body was provided.

Re: Faker.js is now a community controlled project

#19

Post by thrdbndndn »

PragmaticPulp wrote: post #11
throwawayay02 wrote: post #6

You can spin it however you like, but renaming the real one "fakerjs-legacy" and appropriating all sponsors is a scumbag move.

The terms of the funding are attached to the project, not a specific maintainer: > During the conversation with Ben, he went over the terms and conditions of the Open Collective with me. > Ben said that simply, "The funding is attached to the project, not the current maintainer." None of Marak's personal GitHub sponsors were changed (obviously). To be clear: Marak deleted the original project as part of his protest.…

Saying "the funding is attached to the project" doesn't really answer anything.

This new fakerjs isn't the old project, technically or practically speaking (technically being the important part here).

So funding attached to the old project should be still attached to that now-abandoned fakerjs, or straightly up canceled if Open Collective considers it violates their terms, instead of transferring.

The fact they can't do it themselves and asked Open Collective's exclusive director to do it "manually" basically self-confirmed it shouldn't be done.

Re: Faker.js is now a community controlled project

#20

Post by mbreese »

PragmaticPulp wrote: post #11
throwawayay02 wrote: post #6

You can spin it however you like, but renaming the real one "fakerjs-legacy" and appropriating all sponsors is a scumbag move.

The terms of the funding are attached to the project, not a specific maintainer: > During the conversation with Ben, he went over the terms and conditions of the Open Collective with me. > Ben said that simply, "The funding is attached to the project, not the current maintainer." None of Marak's personal GitHub sponsors were changed (obviously). To be clear: Marak deleted the original project as part of his protest.…

Then you cancel the sponsorships to the project and notify the supporters. When the maintainer effectively cancels the project, this makes sense. But you don’t migrate supporters automatically over to a brand new project (even if it is the most stable fork of the original).

> We came to the determination that users unfamiliar with the whole Faker situation wouldn't know that the repository's sponsorship links aren't funding the continued development of the project.

If the intent of the supporters was to support the project, then you can ask them to continue funding the new fork. But you don’t just move funding by default. Cancelling the ongoing support would be fine, but you are relying on people (who were never aware of the switch and the new fork) being okay with this, without their consent.

This is a messy situation, but you can’t make these decisions unilaterally. Inform the supporters and let them decide.

Post reply on HN