141–150 of 357 posts
It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. This was his own corner of the internet for him to publish his own personal projects. I understand the decision for npm to take ownership of his packages, because npm is a community package repository owned by, and for, the community. All community package repositories have some sort of policy for p…
Earlier quoted context omitted.
> It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. HN, at least, had a ton of discussion on this[1]. People advocated both ways. > This was his own corner of the internet for him to publish his own personal projects. No, it wasn't. It was Github's corner of the internet and then it was Microsoft's. If he just wanted a place to publish his personal…
Quoted post unavailable.
I encourage you to find out the definition of Trojan[1] and then find out what Marak did to sabotage his code.
To qualify as a Trojan, Faker.js needed to be:
- advertised as being for a certain purpose
- coded to do something to damage the person who installs it (even if it still does the thing it advertises that it does)
In this case, Marak allowed people who thought they were installed Faker.js and tricked them into installing something that ran an infinite loop, which would break a lot of CI/CD servers and build processes.
In some circumstances, this could easily lead to economic harm. In the worst circumstances, it could take down a vital service (like a health app) and cause people to be seriously harmed.
1. https://en.wikipedia.org/wiki/Trojan_horse_(computing)
2. https://www.theverge.com/2022/1/9/22874949/developer-corrupt...
Earlier quoted context omitted.
It was a malicious act to the users of his project, sure. But how was it a malicious act to GitHub? I'm glad to hear that they reversed the suspension, but without understanding why it was suspended in the first place, it leaves open the question of what GitHub's motives were in the whole situation. If DHH decided that Rails was contributing more harm to the world then good, and tried to remove it from GitHub, would…
I completely agree with this take.
It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. This was his own corner of the internet for him to publish his own personal projects. I understand the decision for npm to take ownership of his packages, because npm is a community package repository owned by, and for, the community. All community package repositories have some sort of policy for p…
But certainly not beyond repair (as injecting adware in your package).
Also it is certainly a reminder for everyone that GitHub should not be treated as an archive of your code, and more like a collaboration space.
This strikes me as hyper-defensive exercise in wrapping the lib thick with every cheap trapping of "community" to hand. I suspect because of the Open Collective handover. In the end, this thing spits out strings. Does it need eight maintainers, only a few of whom had commits, in low double digits? Does it need its own GitHub org, Twitter account, and Google .dev domain? Addressing open pull requests could be good, bu…
> In the end, this thing spits out strings. Does it need eight maintainers, only a few of whom had commits, in low double digits? Does it need its own GitHub org, Twitter account, and Google .dev domain? I'm pretty sure the org and multiple people are to avoid a single point of (mental) failure - quite reasonable given the project history. Also, if we really want to go that way, Google Search is also just a product t…
In any event, the median count of contributors to an open source project remains one. This team-up doesn't help projects != faker.js.
As for scope, I haven't looked at this source in a while. But it seems the strings are still static, in the package: https://github.com/faker-js/faker/tree/29234378807c414158886...>.
It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. This was his own corner of the internet for him to publish his own personal projects. I understand the decision for npm to take ownership of his packages, because npm is a community package repository owned by, and for, the community. All community package repositories have some sort of policy for p…
I am completely baffled by folks defending Marak, or putting any sort of blame on GitHub. What Marak did was not "political speech". If he wanted to, he could have easily done any of the following: 1. Pulled down his repo, or replace his repo by whatever message he wanted to send. 2. Output his political message during the build. 3. Heck, all faker.js does is output fake data for things like names and addresses. I th…
Earlier quoted context omitted.
> It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. He's not banned: https://github.com/Marak You have to keep in mind that his changes were basically indistinguishable from a security breach of his account. Nobody really sabotages their own repos in a malicious manner like this. Suspending his account while they investigated doesn't seem like a st…
It was a malicious act to the users of his project, sure. But how was it a malicious act to GitHub? I'm glad to hear that they reversed the suspension, but without understanding why it was suspended in the first place, it leaves open the question of what GitHub's motives were in the whole situation. If DHH decided that Rails was contributing more harm to the world then good, and tried to remove it from GitHub, would…
Earlier quoted context omitted.
Packages are written by people not algorithms. People you have to explicitly trust to install the package.
Ethereum scripts are written by people too
Ethereum provides trust in the results given trust in the code, nothing more.
Earlier quoted context omitted.
It’s cool that you’re internet rules-lawyering and all but ultimately he used his free account with intent to harm others, just as surely as if he backdoored his code. Freedom of speech is good, and protest is fine, but why would GitHub amplify the speech of a nutso who abused his position of trust?
They don't have to amplify anything. This is why open source is valuable; if the current maintainer is considered to be unfit or unreliable in some way, the community that disagrees with their rhetoric/leadership can fork the package and keep going like nothing happened. If you don't care/the package is still usable, then ideally no further action has to be taken. At no point down the road should that involve revokin…
No one took away his ownership.
Marak:
https://github.com/marak/Faker.js/
https://www.npmjs.com/package/faker
Post:
https://github.com/faker-js/faker
https://www.npmjs.com/package/@faker-js/faker
Faker.js is not a trademarked term, so someone made a new Faker.js.
In fact multiple people did, and one emerged as the preferred fork: https://twitter.com/faker_js/status/1481918305669627905
-
And to be clear, even if NPM goes and replaces his package with this new fork, it wouldn't take away his ownership.
Github could do the same... doesn't take away his ownership.
His ownership of a Github page is not his ownership of the code.
I don't like this rules-lawyering stuff either, yet this is one time where even if you decide to be purposely inflexible with your understanding of laws/licensing/contracts etc... there's still no issue with how this has been handled.