Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Faker.js is now a community controlled project

fakerjs.dev

Post reply on HN
Print view View original

181–190 of 357 posts

Re: Faker.js is now a community controlled project

#181

Post by WarChortle »

Gigachad wrote: post #158
chaostheory wrote: post #49

Earlier quoted context omitted.

Marak isn’t the only one who snapped, but he’s the only one to my knowledge who has introduced malicious commits to this code to purposely hurt other people’s projects. (Even Hans Reiser didn’t do that.) It seems that this might have been a precursor to Marak attempting to hurt people in real life " Hospitalized Queens man charged with reckless endangerment after cops find bomb-making materials in his home " https://…

I don't think what he did was particularly good but I think he was entitled to do it. And the blame falls on the system we have which relies on random people to do work for free with no contract or obligation. It's like if a business delivered packages by asking some random homeless person on the street to walk it to its destination. And then one day the person just chucks your package in the river instead of deliver…

Open source works because we can trust authors to not maliciously harm other people. If it was a bug that's one thing it happens, you move on. But when you purposely do something that you know will cause harm to people that is where I draw the line.

Your analogy isn't even close. No one forced him to write faker.js. He chose to do it and he chose to make it open source under a license allowing people to use it. He also chose to maintain it and help people with issues. If he didn't want to maintain it anymore, It is his right to stop. No company could force him to continue. But he nor anyone is not entitled to add malicious code. Full stop that is where I draw the line. I can't believe anyone is defending that.

Re: Faker.js is now a community controlled project

#182

Post by DonHopkins »

syshum wrote: post #78
young_unixer wrote: post #37

Earlier quoted context omitted.

> By putting them on a social network, like Github, he is submitting to their whims. He doesn't have any legal right to stay on that site if they want to kick him off of it. Of course, legally speaking, Github can do whatever they want with their website, but we're not talking about the legal aspect. The developer community has put some trust on Github not to do whatever they want. It's an implicit, non-legal, non-en…

What you are going to get is people separating out into 2 camps, those that believe in individuality, and those that believe in more collectivism. This is a divide that extends well beyond programming and this topic. People that support GitHub actions believe in the concept of "greater good" and believe the actions of GitHub are ethical because it prevented harm to the community People that oppose GitHub actions reje…

Yeah, but most vocal proponents of so-called "individuality" are simply self-centered anti-social assholes who haven't thought through the Libertarian ideologies they parrot deeply enough to realize how extremely dependent on and beneficial from collectivism they actually are, and they continue bitching about "socialism" while sucking the government's tit with their social security and disability benefits and medicare, and driving on the roads in their trucks while "rolling goal" and waving their guns at pedestrians and bicyclists and electric cars, and calling the fire department when their house catches on fire, and calling an ambulance when they accidentally shoot themselves in the dick while "cleaning their gun", and foaming at the mouth and railing against Obamacare for no better reason than the person THEY renamed the ACA after is black, then refusing to self isolate and wear masks and take vaccines, and finally overcrowding the hospitals and cursing at health care workers when they get sick, then running GoFundMe campaigns to pay for their "unexpected" self inflicted illness and funeral, and some even go as far as using projects hosted on github and hosting their own projects on github for free, and then complaining when github takes down the malicious repo of another mentally ill person whose apartment the police had to break into and remove his bomb making supplies.

Re: Faker.js is now a community controlled project

#183

Post by ZephyrBlu »

DrFell wrote: post #163
jffry wrote: post #75

Earlier quoted context omitted.

Because for some people, they don't want to spend the extra time to build and maintain a solution that they are now responsible for. `npm install --save faker` and boom you have access to a huge variety of random test data, across different locales. Doesn't stretch my imagination to see the appeal.

A lot of webdev is just pre-built stuff. When webdevs say "don't reinvent the wheel" it means "I'm too scared of doing it wrong to program it myself."

More like "I don't want to waste time building something low impact when I could pull in a dependency and be working on something high impact".

Re: Faker.js is now a community controlled project

#184

Post by thrdbndndn »

wonnage wrote: post #159
thrdbndndn wrote: post #93

Earlier quoted context omitted.

Do you also have no issue if GitHub just transfers Marak's repo to the new team? Or all the stars? Since obviously most of people are starring the "project" not him.

Kinda pointless to argue about this because it didn't happen.

I'm trying to use analogy to show the ridiculousness of transferring followers (sponsors) around without agreement of two parties. Hell, I think it makes even less sense in OC's case since there is real money involved.

Re: Faker.js is now a community controlled project

#185

Post by [deleted] »

fault1 wrote: post #70
ricardobeat wrote: post #58

Earlier quoted context omitted.

Does it matter what Open Collective thinks if most people believe this is immoral?

Define "most" people.... To me, this is like the left-pad incident and npm. There was a vocal minority who denounced npm for looking after the greater good, maintaining continuity and transferring the project to someone else. In this case, since the author also deleted the project, the proper way to maintain continuity for the sponsors seems to transfer it to the new community of folks who are interested in maintaini…

[deleted]

Re: Faker.js is now a community controlled project

#186

Post by mpyne »

throwaway858 wrote: post #10

It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. This was his own corner of the internet for him to publish his own personal projects. I understand the decision for npm to take ownership of his packages, because npm is a community package repository owned by, and for, the community. All community package repositories have some sort of policy for p…

> But GitHub claims to be your home for public hosting of your own personal code.

Github claims to be a home for developers to publicly host code of public use. Any benefit to an individual developer is incident to that overriding purpose and they are clear about that in their use policies.

> What GitHub policy did he violate?

https://docs.github.com/en/github/site-policy/github-accepta... gives their acceptable use policies.

I think they could easily make claims on any or all of sections 2, 3, 4 and 10.

Section 10 in particular notes that Github is a service run for a mass of users and will favor users as a whole over individual privileges.

> expressing his freedom of speech, again on his own personal GitHub account, in his own personal (not organization) repositories.

Was he running his own Github server instance and I missed it somehow? The flipside to Github paying to run your git repo, issue tracker, etc. is that you agree to abide by their terms of use, and these terms are written for Github's benefit.

If a million Github users are impacted by this package breaking their code then why are you surprised that Github took action to protect their users?

Marak could have hosted his own git repo if he wanted to ensure his malicious code couldn't be intercepted by others. That's the tradeoff you have to choose.

> He spoke about his thoughts about open source, businesses, and economics. Defending this type of political speech [snip]

Inserting infinite loops into packages isn't "political speech" and trying to claim as such just waters down the entire argument...

Re: Faker.js is now a community controlled project

#187

Post by goodoldneon »

Aerroon wrote: post #59
goodoldneon wrote: post #22

Earlier quoted context omitted.

Freedom of speech doesn’t mean you can do whatever you want on someone else’s server. The project was hosted on GitHub, so GitHub can take significant action to protect the community. He can host his project elsewhere if he doesn’t agree with GitHub’s actions

What about somebody else's internet connection? If we apply the same logic to ISPs then the future of the internet would look quite bleak.

I think ISPs should be a utility, but I don’t think git websites should

Re: Faker.js is now a community controlled project

#188

Post by remram »

labrador wrote: post #130
remram wrote: post #100

Earlier quoted context omitted.

This exists, it's called crev: https://github.com/crev-dev/crev As you note, this doesn't require a blockchain. crev uses a web-of-trust model which is pretty well suited to the task.

Oh wow, this is cool. I refuse to use npm because these issues keep cropping up and no solution gets implemented, but this looks good. I was just looking at an interesting static site generator today until I saw it used nodejs and noped out of there. In contrast, Powershell on Windows won't even let you use scriipts you've written yourself on your local hard drive unless you call them in a way the lets PS know you ap…

crev is so neat, I have really been expecting npm/pypa/... to pick it up any day, for years. It solves those problems without taking power away from the package repository, and with minimal changes needed to the repository itself. With a spec already complete, I would expect an organization with the resources of npm could implement it in a few days, and I am really confused (and disappointed) that it is still not taking off.

Signatures from the author doesn't solve much unfortunately. You would still need a mechanism to build trust (or review the script manually) and once you put that trust in the author, all that a cryptographic signature gets you is automatic trust in the next version... so the Faker attack slips through.

Re: Faker.js is now a community controlled project

#189

Post by zomglings »

exdsq wrote: post #68

Why is this project so popular? I’ve built mini APIs to do this in several previous jobs - either for the purpose of fuzzing, anonymizing real user data for test environments, or readable testing. Each time it’s taken maybe two days of effort in total starting simple and growing for internal needs. How has this been funded so much, for something that’s as simple as dictionary.getRandom()? And why does it need eight c…

This is the modern JS philosophy - don't reinvent the wheel taken to an extreme e.g. left-pad (https://www.npmjs.com/package/left-pad) which had its own very public fiasco around the developer deleting the npm package.

I don't think it's a bad philosophy, just different perhaps from yours (and mine).

Re: Faker.js is now a community controlled project

#190

Post by [deleted] »

brongondwana wrote: post #148
nightpool wrote: post #25

Earlier quoted context omitted.

It was a malicious act to the users of his project, sure. But how was it a malicious act to GitHub? I'm glad to hear that they reversed the suspension, but without understanding why it was suspended in the first place, it leaves open the question of what GitHub's motives were in the whole situation. If DHH decided that Rails was contributing more harm to the world then good, and tried to remove it from GitHub, would…

If I set up a nice shopfront and invite customers in, and then start kneecapping everybody who walks through the door, you gonna bet the city will have something to say about it. I'm not kneecapping the city, just its citizens, so why should they care - and I'm doing it on my own property which they voluntarily entered after seeing my "dollar store" sign out the front - so it's their own damn fault for believing my s…

[deleted]
Post reply on HN