Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Faker.js is now a community controlled project

fakerjs.dev

Post reply on HN
Print view View original

111–120 of 357 posts

Re: Faker.js is now a community controlled project

#111

Post by exdsq »

jffry wrote: post #75
exdsq wrote: post #68

Why is this project so popular? I’ve built mini APIs to do this in several previous jobs - either for the purpose of fuzzing, anonymizing real user data for test environments, or readable testing. Each time it’s taken maybe two days of effort in total starting simple and growing for internal needs. How has this been funded so much, for something that’s as simple as dictionary.getRandom()? And why does it need eight c…

Because for some people, they don't want to spend the extra time to build and maintain a solution that they are now responsible for. `npm install --save faker` and boom you have access to a huge variety of random test data, across different locales. Doesn't stretch my imagination to see the appeal.

Sure but realistically most people only use a few of fakers features right? It’s not that time consuming to make in-house. And after those few hours of work you don’t have a dependency/new security vector to consider. I guess the JS ecosystem like to import everything (isOdd).

Re: Faker.js is now a community controlled project

#112

Post by kekkidy »

kemitchell wrote: post #34

This strikes me as hyper-defensive exercise in wrapping the lib thick with every cheap trapping of "community" to hand. I suspect because of the Open Collective handover. In the end, this thing spits out strings. Does it need eight maintainers, only a few of whom had commits, in low double digits? Does it need its own GitHub org, Twitter account, and Google .dev domain? Addressing open pull requests could be good, bu…

No post body was provided.

Re: Faker.js is now a community controlled project

#113

Post by hn_throwaway_99 »

torstenvl wrote: post #77
hn_throwaway_99 wrote: post #73

Earlier quoted context omitted.

That's BS. Mark didn't just remove it or make it "non-functional". He deliberately changed the code to run in a infinite loop and halt any code that pulled it in. That seems exactly like the definition of a Trojan to me.

> That seems exactly like the definition of a Trojan to me. Link to even one report of Marak getting inside someone else's system.

You seem to be misunderstanding what a Trojan is. From Wikipedia:

> In computing, a Trojan horse is any malware that misleads users of its true intent. The term is derived from the Ancient Greek story of the deceptive Trojan Horse that led to the fall of the city of Troy.

> Trojans generally spread by some form of social engineering; for example, where a user is duped into executing an email attachment disguised to appear not suspicious (e.g., a routine form to be filled in), or by clicking on some fake advertisement on social media or anywhere else.

Marak disguised his malicious DoS attack as previously released useful software. I am completely baffled why people are defending his actions, at all. He could have easily just pulled down his repo, that would have been totally within his rights. Releasing malicious software under the guise of something else is not.

And the fact that people are quoting the license of "no implied warranty" is irrelevant. The law does not look kindly on those that act with malicious intent, regardless of what a license agreement says. For example, if he changed the repo to instead encrypt your hard drive, I guarantee he'd be going to jail. While thankful this was just a DoS attack and not something more serious, it was attack all the same.

Re: Faker.js is now a community controlled project

#114

Post by Sebb767 »

chaostheory wrote: post #49
kemitchell wrote: post #34

This strikes me as hyper-defensive exercise in wrapping the lib thick with every cheap trapping of "community" to hand. I suspect because of the Open Collective handover. In the end, this thing spits out strings. Does it need eight maintainers, only a few of whom had commits, in low double digits? Does it need its own GitHub org, Twitter account, and Google .dev domain? Addressing open pull requests could be good, bu…

Marak isn’t the only one who snapped, but he’s the only one to my knowledge who has introduced malicious commits to this code to purposely hurt other people’s projects. (Even Hans Reiser didn’t do that.) It seems that this might have been a precursor to Marak attempting to hurt people in real life " Hospitalized Queens man charged with reckless endangerment after cops find bomb-making materials in his home " https://…

> What surprises me is the amount of support he’s garnered for his actions with a lot of people on HN.

Well, his motivations were somewhat understandable and his actions were still scratching the realm of acceptable (not cool, but no serious damage and nobody was hurt). It's actually hitting the pretty much perfect spot to generate lots of discussions, since it's very easy and understandable to argue for either side.

Re: Faker.js is now a community controlled project

#115

Post by kekkidy »

PragmaticPulp wrote: post #56
young_unixer wrote: post #48

Earlier quoted context omitted.

> Only sponsorships tied to the project itself will continue to be tied to the project Yeah, but the project is not actually the same anymore. The new project taking over the name and URL of the old project doesn't make it "the same" project.

> The new project taking over the name and URL of the old project doesn't make it "the same" project. Do you really think the sponsors and the people using this code actually care that one person (of many contributors to the project) who wanted to break the project is no longer part of the project? It's a technicality, but in practice nobody actually cares. If they wanted to sponsor Marak they would have done it thro…

No post body was provided.

Re: Faker.js is now a community controlled project

#116

Post by hn_throwaway_99 »

bawolff wrote: post #80
hn_throwaway_99 wrote: post #73

Earlier quoted context omitted.

That's BS. Mark didn't just remove it or make it "non-functional". He deliberately changed the code to run in a infinite loop and halt any code that pulled it in. That seems exactly like the definition of a Trojan to me.

I wouldn't call that a trojan. It is being an asshole though.

It's a DoS attack disguised as other, useful software. That's exactly what a Trojan is.

Re: Faker.js is now a community controlled project

#117

Post by kemitchell »

chaostheory wrote: post #49
kemitchell wrote: post #34

This strikes me as hyper-defensive exercise in wrapping the lib thick with every cheap trapping of "community" to hand. I suspect because of the Open Collective handover. In the end, this thing spits out strings. Does it need eight maintainers, only a few of whom had commits, in low double digits? Does it need its own GitHub org, Twitter account, and Google .dev domain? Addressing open pull requests could be good, bu…

Marak isn’t the only one who snapped, but he’s the only one to my knowledge who has introduced malicious commits to this code to purposely hurt other people’s projects. (Even Hans Reiser didn’t do that.) It seems that this might have been a precursor to Marak attempting to hurt people in real life " Hospitalized Queens man charged with reckless endangerment after cops find bomb-making materials in his home " https://…

I'm sure 6.6.6 threw a spanner in the works for folks who didn't lock deps. Not great. But Marak's one of us. This feels a lot bigger than that.

I don't have a direct line on what happened to him, or where it took him, mentally or otherwise. But the hints so far aren't great. To one of us.

I think the responses from the platforms---GitHub, OpenCollective---get folks thinking, whether they feel it that way or not.

Re: Faker.js is now a community controlled project

#118

Post by young_unixer »

PragmaticPulp wrote: post #56
young_unixer wrote: post #48

Earlier quoted context omitted.

> Only sponsorships tied to the project itself will continue to be tied to the project Yeah, but the project is not actually the same anymore. The new project taking over the name and URL of the old project doesn't make it "the same" project.

> The new project taking over the name and URL of the old project doesn't make it "the same" project. Do you really think the sponsors and the people using this code actually care that one person (of many contributors to the project) who wanted to break the project is no longer part of the project? It's a technicality, but in practice nobody actually cares. If they wanted to sponsor Marak they would have done it thro…

> Do you really think the sponsors and the people using this code actually care that one person (of many contributors to the project) who wanted to break the project is no longer part of the project?

Some of them probably do. And some probably don't like the way in which the takeover was done, or don't like the new guys, even if they don't really like what the old guy did either.

Re: Faker.js is now a community controlled project

#120

Post by jffry »

exdsq wrote: post #111
jffry wrote: post #75

Earlier quoted context omitted.

Because for some people, they don't want to spend the extra time to build and maintain a solution that they are now responsible for. `npm install --save faker` and boom you have access to a huge variety of random test data, across different locales. Doesn't stretch my imagination to see the appeal.

Sure but realistically most people only use a few of fakers features right? It’s not that time consuming to make in-house. And after those few hours of work you don’t have a dependency/new security vector to consider. I guess the JS ecosystem like to import everything (isOdd).

Building something in-house comes with its own sets of pros and cons, which can be compared against the pros and cons of taking a new dependency. The balance and the "correct" decision will vary by team/project/org.
Post reply on HN