Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Faker.js is now a community controlled project

fakerjs.dev

Post reply on HN
Print view View original

91–100 of 357 posts

Re: Faker.js is now a community controlled project

#91

Post by PeterisP »

ren_engineer wrote: post #51
throwaway858 wrote: post #10

It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. This was his own corner of the internet for him to publish his own personal projects. I understand the decision for npm to take ownership of his packages, because npm is a community package repository owned by, and for, the community. All community package repositories have some sort of policy for p…

he did it to protest billion dollar tech companies making money off open source, which is Github's entire business model. His protest was an existential threat to them so of course they are going to crack down

I believe that none of the billion dollar tech companies were affected by this in any way as they tend to have proper process in place for managing dependencies, the only ones who suffered were small developers and other open source projects which have limited manpower and just pull in updated versions without verifying them. Saying that this is an "existential threat" is ridiculous - megacorps can and do have procedures that won't be bothered much even if you'd have a case like that every single day.

Whatever his intentions were, acts like this threaten the open source community, but do not actually threaten the big companies at all.

Re: Faker.js is now a community controlled project

#93

Post by thrdbndndn »

PragmaticPulp wrote: post #44
thrdbndndn wrote: post #36

Earlier quoted context omitted.

That's the sponsors' decision to make. As I said, I have no issue if Open Collective just cancels these sponsorships. What I don't agree is to transfer its sponsors to an account that has zero relationship with original account.

> That's the sponsors' decision to make. Marak's GitHub sponsors aren't changed. If people wanted to specifically sponsor Marak, they would have chosen to do it there. The Open Collective is very specifically about the project, not a specific person. > What I don't agree is to transfer its sponsors to an account that has zero relationship with original account. The current fakerjs has more of a relationships with the…

Do you also have no issue if GitHub just transfers Marak's repo to the new team? Or all the stars? Since obviously most of people are starring the "project" not him.

Re: Faker.js is now a community controlled project

#94

Post by kajaktum »

Faker.js is why software should move a lot slower. There's no other industry this unprofessional. "But....vetting every single dependencies (supply chain) is tough and we can't really know which one to trust (which is why we have certificates)!!". It will never happen tho, because software is too ephemeral for anyone to give a shit about, "leaking millions of personal info" doesn't feel as bad the thought of myself "falling off a faulty chair".

Re: Faker.js is now a community controlled project

#95

Post by Sebb767 »

kemitchell wrote: post #34

This strikes me as hyper-defensive exercise in wrapping the lib thick with every cheap trapping of "community" to hand. I suspect because of the Open Collective handover. In the end, this thing spits out strings. Does it need eight maintainers, only a few of whom had commits, in low double digits? Does it need its own GitHub org, Twitter account, and Google .dev domain? Addressing open pull requests could be good, bu…

> In the end, this thing spits out strings. Does it need eight maintainers, only a few of whom had commits, in low double digits? Does it need its own GitHub org, Twitter account, and Google .dev domain?

I'm pretty sure the org and multiple people are to avoid a single point of (mental) failure - quite reasonable given the project history.

Also, if we really want to go that way, Google Search is also just a product that spits out strings. And a few orders of magnitude more over-engineered ;)

> But in the end, I don't see anything here addressing root causes of what happened, or even speculating on what they might have been.

Well, they have a larger team now, which can reasonably prevent a single person from doing that kind of damage when set up correctly. What other root cause are you looking for? Mental checkups for open-source maintainers? Redefining the "free" in free software?

Re: Faker.js is now a community controlled project

#96

Post by PeterisP »

bogwog wrote: post #90
trowawee wrote: post #79

Earlier quoted context omitted.

> I’ve built mini APIs to do this in several previous jobs [...] Each time it’s taken maybe two days of effort So...just you, in your career, have spent between 1 and 2 total weeks of developer time building the exact same functionality, and you're curious why an open source project that cuts that time down to like an hour is popular? I'm also a little suspicious of the claim that it's the exact same, because Faker h…

I think you misread "days" as "weeks

No, "several previous jobs" and "each time, two days of effort" does come out to a week or two.

Re: Faker.js is now a community controlled project

#97

Post by TameAntelope »

exdsq wrote: post #68

Why is this project so popular? I’ve built mini APIs to do this in several previous jobs - either for the purpose of fuzzing, anonymizing real user data for test environments, or readable testing. Each time it’s taken maybe two days of effort in total starting simple and growing for internal needs. How has this been funded so much, for something that’s as simple as dictionary.getRandom()? And why does it need eight c…

It's really nice to have a project that someone's thought through about how to build sample data a lot more than I have time to think through.

Could I/anyone else build this? Of course. Could I do it so thoroughly, provide support for it, and still do my day job? Not easily, not as easily as I could install this project and use it.

Also keep in mind it's not like those 8 contributors are throwing a full 40 at this project every week.

Re: Faker.js is now a community controlled project

#98

Post by remram »

labrador wrote: post #14

I'm surprised the blockchain gang isn't coming up with a solution for trustless npm packages or is it that a blockchain can't solve the problem of a trusted developer suddenly becoming untrustworthy?

Packages are written by people not algorithms. People you have to explicitly trust to install the package.

Re: Faker.js is now a community controlled project

#100

Post by remram »

nrmitchi wrote: post #24
labrador wrote: post #14

I'm surprised the blockchain gang isn't coming up with a solution for trustless npm packages or is it that a blockchain can't solve the problem of a trusted developer suddenly becoming untrustworthy?

> solve the problem of a trusted developer suddenly becoming untrustworthy? This would be an exceptionally hard problem to solve, with-or-without blockchain. Could you develop a system where any new releases are required to be reviewed and "signed off" by a random assortment of users before becoming "active"? Sure. Is "blockchain" necessary for that? No.

This exists, it's called crev: https://github.com/crev-dev/crev

As you note, this doesn't require a blockchain. crev uses a web-of-trust model which is pretty well suited to the task.

Post reply on HN