Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Faker.js is now a community controlled project

fakerjs.dev

Post reply on HN
Print view View original

81–90 of 357 posts

Re: Faker.js is now a community controlled project

#81

Post by fault1 »

feupan wrote: post #47
scrollaway wrote: post #27

Earlier quoted context omitted.

This isn’t how it works at all. It’s not how copyright law works, it’s not how property law works, and it’s certainly not how cloud services work. What isn’t yours is your “right” to use the service.

Have you read the project’s license? That is literally how it works. It’s not even an original project by Marak, as it’s clearly shown in there. The only fault here is cutting the owner out of the repo, but given the security breach it’s strange that he isn’t permanently banned at all. And yeah, adding an infinite loop is a DoS attack. > not how cloud services work. Try placing a virus on S3 and let me know how that…

not to mention that in the case of colors.js he actually owned less copyright than other contributors. they had actually changed more of the code.

Re: Faker.js is now a community controlled project

#82

Post by labster »

encryptluks2 wrote: post #63
torstenvl wrote: post #57

Earlier quoted context omitted.

Quoted post unavailable.

Quoted post unavailable.

No one reads licenses lol. The intent is the same as a trojan: making software malfunction for the intent of either economic gain or geopolitical goals. Intent matters; there is a fundamental difference between shipping crappy code for fun, and making good code break without warning for thousands of users.

Re: Faker.js is now a community controlled project

#83

Post by floatingatoll »

nightpool wrote: post #25
PragmaticPulp wrote: post #13

Earlier quoted context omitted.

> It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. He's not banned: https://github.com/Marak You have to keep in mind that his changes were basically indistinguishable from a security breach of his account. Nobody really sabotages their own repos in a malicious manner like this. Suspending his account while they investigated doesn't seem like a st…

It was a malicious act to the users of his project, sure. But how was it a malicious act to GitHub? I'm glad to hear that they reversed the suspension, but without understanding why it was suspended in the first place, it leaves open the question of what GitHub's motives were in the whole situation. If DHH decided that Rails was contributing more harm to the world then good, and tried to remove it from GitHub, would…

If I ever get hacked someday and my repo gets defaced, I hope GitHub acts just as they did to Marek. GitHub can’t tell the difference between an authorized and an unauthorized defacement, and I’d rather they err on the side of caution in this regard. It protects me against attackers, and the only risk of false positives is having to reauth and verify to support that I’m an authorized user when I’m trying to deface my work.

Re: Faker.js is now a community controlled project

#85

Post by bawolff »

encryptluks2 wrote: post #60
shadowgovt wrote: post #38

Earlier quoted context omitted.

FWIW, GitHub's actions here have in no way damaged my trust in them. They interpreted a developer's attempt to harm the community via abuse of the trust the community had placed in him as damage and mitigated it in the short run. That's a value-add.

Value add in to who? It sounds like you believe open source developers owe something to someone which simply isn't the case. You should evaluate the license(s): THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIA…

IANAL but i highly doubt that that license would protect you if you were being intentionally malicious (as opposed to say grossly negligent).

Re: Faker.js is now a community controlled project

#86

Post by floatingatoll »

encryptluks2 wrote: post #55
judge2020 wrote: post #35

Earlier quoted context omitted.

Exactly - that really looks like malware. If the same sort of replacement happened with rails, I imagine the same course would happen there - but if there were some corresponding blog post or reasoning in the Readme, GitHub would leave it to the community to let the drama play out (maybe still investigating to see if the login was suspicious in any way).

Quoted post unavailable.

To an automated protection system that detects “repo deletion + index.html rant” commits, deleting the codebase and updating the README would red flag instantly except for the different filename, and catch lots of garden-variety intrusions.

The deletion here was more complex, and most likely a human was assigned to review user reports to GitHub Security, who accurately determined it was a defacement from someone claiming to be the author’s credentials.

Turns out the author was the attacker, and with that confirmed, it appears that their access was restored so they could proceed with it.

Re: Faker.js is now a community controlled project

#87

Post by torstenvl »

labster wrote: post #82
encryptluks2 wrote: post #63

Earlier quoted context omitted.

Quoted post unavailable.

No one reads licenses lol. The intent is the same as a trojan: making software malfunction for the intent of either economic gain or geopolitical goals. Intent matters; there is a fundamental difference between shipping crappy code for fun, and making good code break without warning for thousands of users.

> The intent is the same as a trojan

A Trojan is where the attacker gains direct access to a protected system. It is a back door disguised as an innocuous file. The whole point of the Trojan Horse was the Greeks hiding inside of it to get into Troy.

Where is your evidence that Marak Squires gained access to any of the systems that downloaded and used his packages?

Re: Faker.js is now a community controlled project

#88

Post by bogwog »

ricardobeat wrote: post #58
PragmaticPulp wrote: post #53

Earlier quoted context omitted.

> but you are relying on people (who were never aware of the switch and the new fork) being okay with this, without their consent. Open Collective makes it clear that the sponsorship is for the project, not for a specific person. It's not "without their consent". It's literally the terms of the Open Collective.

Does it matter what Open Collective thinks if most people believe this is immoral?

I don't see how it's immoral. If someone wants to sponsor Marak personally, they can do so easily. If people are donating to the project under the false belief that the money is exclusively going to Marak, then that's their problem for misreading the details of what they were donating to.

Re: Faker.js is now a community controlled project

#89

Post by bawolff »

Aerroon wrote: post #59
goodoldneon wrote: post #22

Earlier quoted context omitted.

Freedom of speech doesn’t mean you can do whatever you want on someone else’s server. The project was hosted on GitHub, so GitHub can take significant action to protect the community. He can host his project elsewhere if he doesn’t agree with GitHub’s actions

What about somebody else's internet connection? If we apply the same logic to ISPs then the future of the internet would look quite bleak.

If we applied your logic everywhere, moderation wouldn't be allowed. That also seems pretty bleak.

Re: Faker.js is now a community controlled project

#90

Post by bogwog »

trowawee wrote: post #79
exdsq wrote: post #68

Why is this project so popular? I’ve built mini APIs to do this in several previous jobs - either for the purpose of fuzzing, anonymizing real user data for test environments, or readable testing. Each time it’s taken maybe two days of effort in total starting simple and growing for internal needs. How has this been funded so much, for something that’s as simple as dictionary.getRandom()? And why does it need eight c…

> I’ve built mini APIs to do this in several previous jobs [...] Each time it’s taken maybe two days of effort So...just you, in your career, have spent between 1 and 2 total weeks of developer time building the exact same functionality, and you're curious why an open source project that cuts that time down to like an hour is popular? I'm also a little suspicious of the claim that it's the exact same, because Faker h…

I think you misread "days" as "weeks
Post reply on HN