Earlier quoted context omitted.
Quoted post unavailable.
Quoted post unavailable.
[deleted]
Faker.js is now a community controlled project
71–80 of 357 posts
Re: Faker.js is now a community controlled project
#72Earlier quoted context omitted.
Exactly - that really looks like malware. If the same sort of replacement happened with rails, I imagine the same course would happen there - but if there were some corresponding blog post or reasoning in the Readme, GitHub would leave it to the community to let the drama play out (maybe still investigating to see if the login was suspicious in any way).
Quoted post unavailable.
I would say colors.js definitely can be considered malware. He in effect intentionally spinlocked a lot of packages either directly or indirectly via transitive dependencies, and also intentionally bypassed common semvar rules to maximize the damage.
whether or not those packages should have been affected is another discussion, but it appear it probably had more of an effect on other open source packages and perhaps the work of small mom and pop companies rather than huge corporations.
Re: Faker.js is now a community controlled project
#73Earlier quoted context omitted.
Quoted post unavailable.
Quoted post unavailable.
That's BS. Mark didn't just remove it or make it "non-functional". He deliberately changed the code to run in a infinite loop and halt any code that pulled it in. That seems exactly like the definition of a Trojan to me.
Re: Faker.js is now a community controlled project
#74I should’ve put this at the top of the update itself, but the Twitter account is the main form of comms from the team. https://twitter.com/faker_js Thanks everyone.
[deleted]
Re: Faker.js is now a community controlled project
#75Why is this project so popular? I’ve built mini APIs to do this in several previous jobs - either for the purpose of fuzzing, anonymizing real user data for test environments, or readable testing. Each time it’s taken maybe two days of effort in total starting simple and growing for internal needs. How has this been funded so much, for something that’s as simple as dictionary.getRandom()? And why does it need eight c…
Because for some people, they don't want to spend the extra time to build and maintain a solution that they are now responsible for.
`npm install --save faker` and boom you have access to a huge variety of random test data, across different locales. Doesn't stretch my imagination to see the appeal.
Re: Faker.js is now a community controlled project
#76Earlier quoted context omitted.
> It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. HN, at least, had a ton of discussion on this[1]. People advocated both ways. > This was his own corner of the internet for him to publish his own personal projects. No, it wasn't. It was Github's corner of the internet and then it was Microsoft's. If he just wanted a place to publish his personal…
> By putting them on a social network, like Github, he is submitting to their whims. He doesn't have any legal right to stay on that site if they want to kick him off of it. Of course, legally speaking, Github can do whatever they want with their website, but we're not talking about the legal aspect. The developer community has put some trust on Github not to do whatever they want. It's an implicit, non-legal, non-en…
Github is still in theory a place to collaborate on code - its not a blogging platform. I think a reasonable argument could be made that he violated the "spirit" of github.
Re: Faker.js is now a community controlled project
#77Earlier quoted context omitted.
Quoted post unavailable.
That's BS. Mark didn't just remove it or make it "non-functional". He deliberately changed the code to run in a infinite loop and halt any code that pulled it in. That seems exactly like the definition of a Trojan to me.
> That seems exactly like the definition of a Trojan to me.
Link to even one report of Marak getting inside someone else's system.
Re: Faker.js is now a community controlled project
#78Earlier quoted context omitted.
> It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. HN, at least, had a ton of discussion on this[1]. People advocated both ways. > This was his own corner of the internet for him to publish his own personal projects. No, it wasn't. It was Github's corner of the internet and then it was Microsoft's. If he just wanted a place to publish his personal…
> By putting them on a social network, like Github, he is submitting to their whims. He doesn't have any legal right to stay on that site if they want to kick him off of it. Of course, legally speaking, Github can do whatever they want with their website, but we're not talking about the legal aspect. The developer community has put some trust on Github not to do whatever they want. It's an implicit, non-legal, non-en…
What you are going to get is people separating out into 2 camps, those that believe in individuality, and those that believe in more collectivism.
This is a divide that extends well beyond programming and this topic.
People that support GitHub actions believe in the concept of "greater good" and believe the actions of GitHub are ethical because it prevented harm to the community
People that oppose GitHub actions reject the idea of "the greater good" and believe this individual should have had the right to do with their property (i,e their code) anything they wanted and the responsibility was upon the people consuming / using that code to vet it before use.
Re: Faker.js is now a community controlled project
#79Why is this project so popular? I’ve built mini APIs to do this in several previous jobs - either for the purpose of fuzzing, anonymizing real user data for test environments, or readable testing. Each time it’s taken maybe two days of effort in total starting simple and growing for internal needs. How has this been funded so much, for something that’s as simple as dictionary.getRandom()? And why does it need eight c…
> I’ve built mini APIs to do this in several previous jobs [...] Each time it’s taken maybe two days of effort
So...just you, in your career, have spent between 1 and 2 total weeks of developer time building the exact same functionality, and you're curious why an open source project that cuts that time down to like an hour is popular?
I'm also a little suspicious of the claim that it's the exact same, because Faker has a lot of functionality under the hood, but you've more or less demonstrated why it's useful in this comment.
Re: Faker.js is now a community controlled project
#80Earlier quoted context omitted.
Quoted post unavailable.
That's BS. Mark didn't just remove it or make it "non-functional". He deliberately changed the code to run in a infinite loop and halt any code that pulled it in. That seems exactly like the definition of a Trojan to me.
I wouldn't call that a trojan. It is being an asshole though.