Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Faker.js is now a community controlled project

fakerjs.dev

Post reply on HN
Print view View original

101–110 of 357 posts

Re: Faker.js is now a community controlled project

#101

Post by sam0x17 »

nightpool wrote: post #25
PragmaticPulp wrote: post #13

Earlier quoted context omitted.

> It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. He's not banned: https://github.com/Marak You have to keep in mind that his changes were basically indistinguishable from a security breach of his account. Nobody really sabotages their own repos in a malicious manner like this. Suspending his account while they investigated doesn't seem like a st…

It was a malicious act to the users of his project, sure. But how was it a malicious act to GitHub? I'm glad to hear that they reversed the suspension, but without understanding why it was suspended in the first place, it leaves open the question of what GitHub's motives were in the whole situation. If DHH decided that Rails was contributing more harm to the world then good, and tried to remove it from GitHub, would…

I completely agree with this take.

Re: Faker.js is now a community controlled project

#102

Post by perihelions »

throwaway858 wrote: post #10

It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. This was his own corner of the internet for him to publish his own personal projects. I understand the decision for npm to take ownership of his packages, because npm is a community package repository owned by, and for, the community. All community package repositories have some sort of policy for p…

>"The really outrageous thing is that the developer going "rogue" was actually him expressing his freedom of speech, again on his own personal GitHub account, in his own personal (not organization) repositories. He spoke about his thoughts about open source, businesses, and economics. Defending this type of political speech is especially important and GitHub banning his account and censoring this type of speech(whether you agree with it or not) is especially shameful."

This Tuesday is the 10-year anniversary of the SOPA/PIPA blackout [0,1]. Half of the tech internet crippled their own functionality for a day, in an act of political speech. (Was GitHub part of that?)

Tech culture has surely changed since then!

[0] https://en.wikipedia.org/wiki/Protests_against_SOPA_and_PIPA

[1] https://hn.algolia.com/?q=sopa

Re: Faker.js is now a community controlled project

#103

Post by TameAntelope »

OrangeMonkey wrote: post #28
labrador wrote: post #14

I'm surprised the blockchain gang isn't coming up with a solution for trustless npm packages or is it that a blockchain can't solve the problem of a trusted developer suddenly becoming untrustworthy?

Blockchain is a solution to a problem that doesn't exist in the real world in any appreciable sense.

Oh it definitely exists, and this might be one place where it could help, but it's not sexy, and it won't make you rich, so nobody is bothering.

A lot easier to pretend NFTs are more important than collecting stamps.

Re: Faker.js is now a community controlled project

#104

Post by scrollaway »

feupan wrote: post #47
scrollaway wrote: post #27

Earlier quoted context omitted.

This isn’t how it works at all. It’s not how copyright law works, it’s not how property law works, and it’s certainly not how cloud services work. What isn’t yours is your “right” to use the service.

Have you read the project’s license? That is literally how it works. It’s not even an original project by Marak, as it’s clearly shown in there. The only fault here is cutting the owner out of the repo, but given the security breach it’s strange that he isn’t permanently banned at all. And yeah, adding an infinite loop is a DoS attack. > not how cloud services work. Try placing a virus on S3 and let me know how that…

I’m not defending the author. GitHub is in their right to do what they did. But certainly not because of the nonsense GP claims. And yes you can host viruses on S3. What you can’t do is use Amazon’s network to do illegal shit (such as distribute viruses without consent).

Re: Faker.js is now a community controlled project

#105

Post by [deleted] »

jffry wrote: post #75
exdsq wrote: post #68

Why is this project so popular? I’ve built mini APIs to do this in several previous jobs - either for the purpose of fuzzing, anonymizing real user data for test environments, or readable testing. Each time it’s taken maybe two days of effort in total starting simple and growing for internal needs. How has this been funded so much, for something that’s as simple as dictionary.getRandom()? And why does it need eight c…

Because for some people, they don't want to spend the extra time to build and maintain a solution that they are now responsible for. `npm install --save faker` and boom you have access to a huge variety of random test data, across different locales. Doesn't stretch my imagination to see the appeal.

[deleted]

Re: Faker.js is now a community controlled project

#106

Post by fault1 »

floatingatoll wrote: post #86
encryptluks2 wrote: post #55

Earlier quoted context omitted.

Quoted post unavailable.

To an automated protection system that detects “repo deletion + index.html rant” commits, deleting the codebase and updating the README would red flag instantly except for the different filename, and catch lots of garden-variety intrusions. The deletion here was more complex, and most likely a human was assigned to review user reports to GitHub Security, who accurately determined it was a defacement from someone clai…

> Turns out the author was the attacker, and with that confirmed, it appears that their access was restored so they could proceed with it.

I suspect this is how it played out as well. In fact, there was a lot of people on Twitter who were questioning whether the author really got suspended since he was posting to github a day or two after he posted his suspension picture.

Re: Faker.js is now a community controlled project

#107

Post by exdsq »

trowawee wrote: post #79
exdsq wrote: post #68

Why is this project so popular? I’ve built mini APIs to do this in several previous jobs - either for the purpose of fuzzing, anonymizing real user data for test environments, or readable testing. Each time it’s taken maybe two days of effort in total starting simple and growing for internal needs. How has this been funded so much, for something that’s as simple as dictionary.getRandom()? And why does it need eight c…

> I’ve built mini APIs to do this in several previous jobs [...] Each time it’s taken maybe two days of effort So...just you, in your career, have spent between 1 and 2 total weeks of developer time building the exact same functionality, and you're curious why an open source project that cuts that time down to like an hour is popular? I'm also a little suspicious of the claim that it's the exact same, because Faker h…

Yes but for the sake of a few hours you now have 22 dependencies and a new security vector to consider :)

And of course the reason this new version exists is because the previous version was deliberately broken.

Why add significant dependencies for the sake of a few hours (maybe a day or two in the long run if you need to add functionality)?

Re: Faker.js is now a community controlled project

#109

Post by cortesoft »

nightpool wrote: post #25
PragmaticPulp wrote: post #13

Earlier quoted context omitted.

> It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. He's not banned: https://github.com/Marak You have to keep in mind that his changes were basically indistinguishable from a security breach of his account. Nobody really sabotages their own repos in a malicious manner like this. Suspending his account while they investigated doesn't seem like a st…

It was a malicious act to the users of his project, sure. But how was it a malicious act to GitHub? I'm glad to hear that they reversed the suspension, but without understanding why it was suspended in the first place, it leaves open the question of what GitHub's motives were in the whole situation. If DHH decided that Rails was contributing more harm to the world then good, and tried to remove it from GitHub, would…

GitHub's market is developers. They want to do everything they can to protect that community, and if a developer uses their service to damage other developers, they aren't going to stand for it.

Re: Faker.js is now a community controlled project

#110

Post by Macha »

encryptluks2 wrote: post #60
shadowgovt wrote: post #38

Earlier quoted context omitted.

FWIW, GitHub's actions here have in no way damaged my trust in them. They interpreted a developer's attempt to harm the community via abuse of the trust the community had placed in him as damage and mitigated it in the short run. That's a value-add.

Value add in to who? It sounds like you believe open source developers owe something to someone which simply isn't the case. You should evaluate the license(s): THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIA…

I don't see where this license obligates github to distribute future versions.

Also if we're expecting people to do the bare minimum specified in their license, github's license gives them all the leeway they needed for their actions too.

Post reply on HN