Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Faker.js is now a community controlled project

fakerjs.dev

Post reply on HN
Print view View original

31–40 of 357 posts

Re: Faker.js is now a community controlled project

#31

Post by zbrozek »

chillfox wrote: post #17
throwaway858 wrote: post #10

It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. This was his own corner of the internet for him to publish his own personal projects. I understand the decision for npm to take ownership of his packages, because npm is a community package repository owned by, and for, the community. All community package repositories have some sort of policy for p…

I get what you are saying, but I feel like this applies: Not your domain/site, not your corner of the internet.

Is domain enough? I doubt it. You probably also need your own server in your own rack in your own building with your own peering to other networks. Once you've done all of that, you can probably credibly keep your site up counter to corporate interests.

Re: Faker.js is now a community controlled project

#32

Post by PragmaticPulp »

nightpool wrote: post #25
PragmaticPulp wrote: post #13

Earlier quoted context omitted.

> It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. He's not banned: https://github.com/Marak You have to keep in mind that his changes were basically indistinguishable from a security breach of his account. Nobody really sabotages their own repos in a malicious manner like this. Suspending his account while they investigated doesn't seem like a st…

It was a malicious act to the users of his project, sure. But how was it a malicious act to GitHub? I'm glad to hear that they reversed the suspension, but without understanding why it was suspended in the first place, it leaves open the question of what GitHub's motives were in the whole situation. If DHH decided that Rails was contributing more harm to the world then good, and tried to remove it from GitHub, would…

> It was a malicious act to the users of his project, sure. But how was it a malicious act to GitHub?

You can't use GitHub to perform malicious acts, even if the victim isn't GitHub. GitHub isn't obligated to support anyone's malicious acts with their platform.

> If DHH decided that Rails was contributing more harm to the world then good, and tried to remove it from GitHub, would GitHub lock his account and restore his repos "on behalf of the community", to side with the smooth operation of the open source ecosystem over a user's personal decisions? To what extent has GitHub decided that they "know best" for the open source community?

GitHub hasn't done any of these things with faker.js.

Marak deleted the code and replaced it with a non-functional repo that has a README.md that just says "What really happened with Aaron Swartz?" (Reference to a conspiracy theory)

It's still here. You can still see it: https://github.com/Marak/faker.js

Re: Faker.js is now a community controlled project

#33

Post by PragmaticPulp »

thrdbndndn wrote: post #19
PragmaticPulp wrote: post #11

Earlier quoted context omitted.

The terms of the funding are attached to the project, not a specific maintainer: > During the conversation with Ben, he went over the terms and conditions of the Open Collective with me. > Ben said that simply, "The funding is attached to the project, not the current maintainer." None of Marak's personal GitHub sponsors were changed (obviously). To be clear: Marak deleted the original project as part of his protest.…

Saying "the funding is attached to the project" doesn't really answer anything. This new fakerjs isn't the old project, technically or practically speaking (technically being the important part here). So funding attached to the old project should be still attached to that now-abandoned fakerjs, or straightly up canceled if Open Collective considers it violates their terms, instead of transferring. The fact they can't…

> This new fakerjs isn't the old project, technically or practically speaking (technically being the important part here).

No, it's definitely a continuation of the old project.

Marak deleted the old project. It's now just a non-functional GitHub repo with a Readme that says "What really happened with Aaron Swartz?". Nobody would consider that to be more like the original fakerjs than this active fork that, literally, retains the original fakerjs.

> So funding attached to the old project should be still attached to that now-abandoned fakerjs

Not just abandoned. It's deleted. Or at least rendered useless, devoid of history, and non-functional.

Why would they continue funneling money to that? Why would they not give money to the actual project as it continues?

Re: Faker.js is now a community controlled project

#34

Post by kemitchell »

This strikes me as hyper-defensive exercise in wrapping the lib thick with every cheap trapping of "community" to hand. I suspect because of the Open Collective handover.

In the end, this thing spits out strings. Does it need eight maintainers, only a few of whom had commits, in low double digits? Does it need its own GitHub org, Twitter account, and Google .dev domain? Addressing open pull requests could be good, but the rest of the roadmap looks like packaging, doc, twiddling with test infra, and more "community" again. That is also work, I suppose, but API and function feel baked. Before he did "bad", Marak did good.

Overall, the vibe here is self-righteous hostile takeover. That's a pretty fraught concept I don't see a need to go near. Maybe it's not fair or accurate, for those better in the know. But from the outside looking in, seems to me a fork, a new name, and a quick tweak to package.json could fully address the issue of another 6.6.6-like release, cleanly. No special deals with the platforms. Name brainstorm, clone, fork, push, and publish of existing MIT code would have been intensely normal. Especially in JS land.

I get that "community" is supposed to make me happy and calm. But in the end, I don't see anything here addressing root causes of what happened, or even speculating on what they might have been. Marak isn't the only solo leading projects who's snapped, and he won't be the last. It's convenient, but ridiculous, to say that has nothing to do with the environment we've built up. Plus we've learned a new way to lose donors, it being no mean feat to get them in the first place.

Re: Faker.js is now a community controlled project

#35

Post by judge2020 »

PragmaticPulp wrote: post #32
nightpool wrote: post #25

Earlier quoted context omitted.

It was a malicious act to the users of his project, sure. But how was it a malicious act to GitHub? I'm glad to hear that they reversed the suspension, but without understanding why it was suspended in the first place, it leaves open the question of what GitHub's motives were in the whole situation. If DHH decided that Rails was contributing more harm to the world then good, and tried to remove it from GitHub, would…

> It was a malicious act to the users of his project, sure. But how was it a malicious act to GitHub? You can't use GitHub to perform malicious acts, even if the victim isn't GitHub. GitHub isn't obligated to support anyone's malicious acts with their platform. > If DHH decided that Rails was contributing more harm to the world then good, and tried to remove it from GitHub, would GitHub lock his account and restore h…

Exactly - that really looks like malware. If the same sort of replacement happened with rails, I imagine the same course would happen there - but if there were some corresponding blog post or reasoning in the Readme, GitHub would leave it to the community to let the drama play out (maybe still investigating to see if the login was suspicious in any way).

Re: Faker.js is now a community controlled project

#36

Post by thrdbndndn »

PragmaticPulp wrote: post #33
thrdbndndn wrote: post #19

Earlier quoted context omitted.

Saying "the funding is attached to the project" doesn't really answer anything. This new fakerjs isn't the old project, technically or practically speaking (technically being the important part here). So funding attached to the old project should be still attached to that now-abandoned fakerjs, or straightly up canceled if Open Collective considers it violates their terms, instead of transferring. The fact they can't…

> This new fakerjs isn't the old project, technically or practically speaking (technically being the important part here). No, it's definitely a continuation of the old project. Marak deleted the old project. It's now just a non-functional GitHub repo with a Readme that says "What really happened with Aaron Swartz?". Nobody would consider that to be more like the original fakerjs than this active fork that, literally…

That's the sponsors' decision to make. As I said, I have no issue if Open Collective just cancels these sponsorships.

What I don't agree is to transfer its sponsors to an account that has zero relationship with original account.

Re: Faker.js is now a community controlled project

#37

Post by young_unixer »

smt88 wrote: post #23
throwaway858 wrote: post #10

It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. This was his own corner of the internet for him to publish his own personal projects. I understand the decision for npm to take ownership of his packages, because npm is a community package repository owned by, and for, the community. All community package repositories have some sort of policy for p…

> It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. HN, at least, had a ton of discussion on this[1]. People advocated both ways. > This was his own corner of the internet for him to publish his own personal projects. No, it wasn't. It was Github's corner of the internet and then it was Microsoft's. If he just wanted a place to publish his personal…

> By putting them on a social network, like Github, he is submitting to their whims. He doesn't have any legal right to stay on that site if they want to kick him off of it.

Of course, legally speaking, Github can do whatever they want with their website, but we're not talking about the legal aspect.

The developer community has put some trust on Github not to do whatever they want. It's an implicit, non-legal, non-enforceable, social agreement that Github is going to "respect" our user accounts on their platform as long as we don't break the TOS.

They could delete all existing repositories tomorrow, and replace them with pornographic images, and they would probably be in their legal right, but that doesn't mean that we can't critizice them for it.

Re: Faker.js is now a community controlled project

#38

Post by shadowgovt »

young_unixer wrote: post #37
smt88 wrote: post #23

Earlier quoted context omitted.

> It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. HN, at least, had a ton of discussion on this[1]. People advocated both ways. > This was his own corner of the internet for him to publish his own personal projects. No, it wasn't. It was Github's corner of the internet and then it was Microsoft's. If he just wanted a place to publish his personal…

> By putting them on a social network, like Github, he is submitting to their whims. He doesn't have any legal right to stay on that site if they want to kick him off of it. Of course, legally speaking, Github can do whatever they want with their website, but we're not talking about the legal aspect. The developer community has put some trust on Github not to do whatever they want. It's an implicit, non-legal, non-en…

FWIW, GitHub's actions here have in no way damaged my trust in them.

They interpreted a developer's attempt to harm the community via abuse of the trust the community had placed in him as damage and mitigated it in the short run. That's a value-add.

Re: Faker.js is now a community controlled project

#39

Post by chaostheory »

young_unixer wrote: post #37
smt88 wrote: post #23

Earlier quoted context omitted.

> It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. HN, at least, had a ton of discussion on this[1]. People advocated both ways. > This was his own corner of the internet for him to publish his own personal projects. No, it wasn't. It was Github's corner of the internet and then it was Microsoft's. If he just wanted a place to publish his personal…

> By putting them on a social network, like Github, he is submitting to their whims. He doesn't have any legal right to stay on that site if they want to kick him off of it. Of course, legally speaking, Github can do whatever they want with their website, but we're not talking about the legal aspect. The developer community has put some trust on Github not to do whatever they want. It's an implicit, non-legal, non-en…

GitHub acted reasonably to mitigate harm. They didn’t delete his older commits or “replace it with porn”. They acted reasonably unlike Marak.

Re: Faker.js is now a community controlled project

#40

Post by viraptor »

manquer wrote: post #30
nightpool wrote: post #25

Earlier quoted context omitted.

It was a malicious act to the users of his project, sure. But how was it a malicious act to GitHub? I'm glad to hear that they reversed the suspension, but without understanding why it was suspended in the first place, it leaves open the question of what GitHub's motives were in the whole situation. If DHH decided that Rails was contributing more harm to the world then good, and tried to remove it from GitHub, would…

It was malicious act to Github's users. Github first responsibility comes to the community of users it supports, then to any individual user. Free speech/ personal choice / Freedom of expression come secondary to the welfare of its users. Is it a slippery slope ? Yes, but Github does not have a choice if it cared about the interest its community

> It was malicious act to Github's users.

I'm not sure why it matters they are Github users. The packages were hosted on npm through Cloudflare - does that allow Cloudflare to take over the packages too? And NS1 since they host the fakerjs domain?

Post reply on HN