Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Faker.js is now a community controlled project

fakerjs.dev

Post reply on HN
Print view View original

171–180 of 357 posts

Re: Faker.js is now a community controlled project

#171

Post by epolanski »

PragmaticPulp wrote: post #56
young_unixer wrote: post #48

Earlier quoted context omitted.

> Only sponsorships tied to the project itself will continue to be tied to the project Yeah, but the project is not actually the same anymore. The new project taking over the name and URL of the old project doesn't make it "the same" project.

> The new project taking over the name and URL of the old project doesn't make it "the same" project. Do you really think the sponsors and the people using this code actually care that one person (of many contributors to the project) who wanted to break the project is no longer part of the project? It's a technicality, but in practice nobody actually cares. If they wanted to sponsor Marak they would have done it thro…

Ok, but the question is, what entitles these people, rather than other to claim a fork as "community successor"?

Re: Faker.js is now a community controlled project

#172

Post by exdsq »

jffry wrote: post #120
exdsq wrote: post #111

Earlier quoted context omitted.

Sure but realistically most people only use a few of fakers features right? It’s not that time consuming to make in-house. And after those few hours of work you don’t have a dependency/new security vector to consider. I guess the JS ecosystem like to import everything (isOdd).

Building something in-house comes with its own sets of pros and cons, which can be compared against the pros and cons of taking a new dependency. The balance and the "correct" decision will vary by team/project/org.

Of course! That's good engineering. However I argue that the default is far too often to use something 'off-the-shelf' and trusting it A) works, B) is secure, C) is supported, and D) will remain so for the lifetime of your project.

I wonder if those who say "2 days?! Just npm install!" answered those questions, or if they googled "nodejs fake data generator" and installed it onto their businesses main product in the next 5 minutes.

Re: Faker.js is now a community controlled project

#173

Post by epolanski »

joshxyz wrote: post #170
throwawayay02 wrote: post #6

You can spin it however you like, but renaming the real one "fakerjs-legacy" and appropriating all sponsors is a scumbag move.

Okay, so how are they supposed to do it then?

Who's they and why they, whoever they are.

Re: Faker.js is now a community controlled project

#174

Post by exdsq »

abraham wrote: post #127
jffry wrote: post #75

Earlier quoted context omitted.

Because for some people, they don't want to spend the extra time to build and maintain a solution that they are now responsible for. `npm install --save faker` and boom you have access to a huge variety of random test data, across different locales. Doesn't stretch my imagination to see the appeal.

Note that for this new community version its: `npm install @faker-js/faker --save-dev`

This just helps my point, I believe. Someone is going to google how to import fake data, find the npm repo with loads of downloads, import it, read a stackoverflow issue on how to use it, and not understand why it's broken for a while (because it's now a dead project). All so they can get a dictionary of first names and strings that look like addresses in a unit test somewhere, probably.

Re: Faker.js is now a community controlled project

#175

Post by tptacek »

nightpool wrote: post #25
PragmaticPulp wrote: post #13

Earlier quoted context omitted.

> It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. He's not banned: https://github.com/Marak You have to keep in mind that his changes were basically indistinguishable from a security breach of his account. Nobody really sabotages their own repos in a malicious manner like this. Suspending his account while they investigated doesn't seem like a st…

It was a malicious act to the users of his project, sure. But how was it a malicious act to GitHub? I'm glad to hear that they reversed the suspension, but without understanding why it was suspended in the first place, it leaves open the question of what GitHub's motives were in the whole situation. If DHH decided that Rails was contributing more harm to the world then good, and tried to remove it from GitHub, would…

Github will not allow you to use your personal corner of the platform to propagate malware, and hasn't allowed it for many years.

Re: Faker.js is now a community controlled project

#176

Post by bee_rider »

Gigachad wrote: post #158
chaostheory wrote: post #49

Earlier quoted context omitted.

Marak isn’t the only one who snapped, but he’s the only one to my knowledge who has introduced malicious commits to this code to purposely hurt other people’s projects. (Even Hans Reiser didn’t do that.) It seems that this might have been a precursor to Marak attempting to hurt people in real life " Hospitalized Queens man charged with reckless endangerment after cops find bomb-making materials in his home " https://…

I don't think what he did was particularly good but I think he was entitled to do it. And the blame falls on the system we have which relies on random people to do work for free with no contract or obligation. It's like if a business delivered packages by asking some random homeless person on the street to walk it to its destination. And then one day the person just chucks your package in the river instead of deliver…

Most of the companies that got hit by this (and any paying attention) will probably just change their deployment strategy to slightly slow down their updates. I guess this is equivalent to... I dunno, checking if the random homeless person had at least made one successful delivery? Except the analogy breaks down because code doesn't randomly begin to pick up different behaviors without any intervention (Well, hopefully!).

Re: Faker.js is now a community controlled project

#178

Post by DeepYogurt »

viraptor wrote: post #40
manquer wrote: post #30

Earlier quoted context omitted.

It was malicious act to Github's users. Github first responsibility comes to the community of users it supports, then to any individual user. Free speech/ personal choice / Freedom of expression come secondary to the welfare of its users. Is it a slippery slope ? Yes, but Github does not have a choice if it cared about the interest its community

> It was malicious act to Github's users. I'm not sure why it matters they are Github users. The packages were hosted on npm through Cloudflare - does that allow Cloudflare to take over the packages too? And NS1 since they host the fakerjs domain?

> does that allow Cloudflare to take over the packages too?

Fundamentally cloudflare can do that if they so chose. If your threat model doesn't account for that sort of action then you should reassess.

Re: Faker.js is now a community controlled project

#179

Post by PradeetPatel »

hn_throwaway_99 wrote: post #126
throwaway858 wrote: post #10

It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. This was his own corner of the internet for him to publish his own personal projects. I understand the decision for npm to take ownership of his packages, because npm is a community package repository owned by, and for, the community. All community package repositories have some sort of policy for p…

I am completely baffled by folks defending Marak, or putting any sort of blame on GitHub. What Marak did was not "political speech". If he wanted to, he could have easily done any of the following: 1. Pulled down his repo, or replace his repo by whatever message he wanted to send. 2. Output his political message during the build. 3. Heck, all faker.js does is output fake data for things like names and addresses. I th…

What he did was utterly unprofessional, hazardous, and outright dangerous to those who trusted and used his library.

By putting it on Github, he surrendered a portion of his right to distribute to Microsoft, and Microsoft did the best course of action to protect their reputation and the interest of their stakeholders.

I see nothing wrong with this.

Re: Faker.js is now a community controlled project

#180

Post by DonHopkins »

torstenvl wrote: post #77
hn_throwaway_99 wrote: post #73

Earlier quoted context omitted.

That's BS. Mark didn't just remove it or make it "non-functional". He deliberately changed the code to run in a infinite loop and halt any code that pulled it in. That seems exactly like the definition of a Trojan to me.

> That seems exactly like the definition of a Trojan to me. Link to even one report of Marak getting inside someone else's system.

No post body was provided.
Post reply on HN