Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Faker.js is now a community controlled project

fakerjs.dev

Post reply on HN
Print view View original

191–200 of 357 posts

Re: Faker.js is now a community controlled project

#191

Post by cxr »

syshum wrote: post #78
young_unixer wrote: post #37

Earlier quoted context omitted.

> By putting them on a social network, like Github, he is submitting to their whims. He doesn't have any legal right to stay on that site if they want to kick him off of it. Of course, legally speaking, Github can do whatever they want with their website, but we're not talking about the legal aspect. The developer community has put some trust on Github not to do whatever they want. It's an implicit, non-legal, non-en…

What you are going to get is people separating out into 2 camps, those that believe in individuality, and those that believe in more collectivism. This is a divide that extends well beyond programming and this topic. People that support GitHub actions believe in the concept of "greater good" and believe the actions of GitHub are ethical because it prevented harm to the community People that oppose GitHub actions reje…

> What you are going to get is people separating out into 2 camps, those that believe in individuality, and those that believe in more collectivism.

I agree wholeheartedly with this statement, but we're diametrically opposed on how these two groups are allocated. I.e., the people you're labelling as collectivists I are in the other group, and vice versa. People who think GitHub did right are a real me-first bunch, not collectivists.

Re: Faker.js is now a community controlled project

#192

Post by slenk »

DrFell wrote: post #163
jffry wrote: post #75

Earlier quoted context omitted.

Because for some people, they don't want to spend the extra time to build and maintain a solution that they are now responsible for. `npm install --save faker` and boom you have access to a huge variety of random test data, across different locales. Doesn't stretch my imagination to see the appeal.

A lot of webdev is just pre-built stuff. When webdevs say "don't reinvent the wheel" it means "I'm too scared of doing it wrong to program it myself."

No, they value their time more than re-writing a known algorithm/pattern.

Re: Faker.js is now a community controlled project

#193

Post by ziml77 »

ThrowawayR2 wrote: post #157
encryptluks2 wrote: post #60

Earlier quoted context omitted.

Value add in to who? It sounds like you believe open source developers owe something to someone which simply isn't the case. You should evaluate the license(s): THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIA…

I'm just as much an armchair lawyer as the most of the rest of HN but my understanding is that liability waivers aren't considered enforceable if malicious intent or gross negligence is involved. Anybody with more legal expertise want to clarify?

I am also not a lawyer, but this is what I found for NY and would be surprised if it doesn't apply in most states and many other countries too:

> Under New York law, a party can waive ordinary negligence, but not gross negligence, reckless conduct, willful/wanton conduct, or intentional acts. See Kalisch-Jarcho v. City of New York, 58 N.Y.2d 377 (1983); See also Restatement (Second) of Contracts § 195 (1981) (“A term exempting a party from tort liability for harm caused intentionally or recklessly is unenforceable on grounds of public policy.”).

Re: Faker.js is now a community controlled project

#194

Post by cxr »

chaostheory wrote: post #123
Sebb767 wrote: post #114

Earlier quoted context omitted.

> What surprises me is the amount of support he’s garnered for his actions with a lot of people on HN. Well, his motivations were somewhat understandable and his actions were still scratching the realm of acceptable (not cool, but no serious damage and nobody was hurt). It's actually hitting the pretty much perfect spot to generate lots of discussions, since it's very easy and understandable to argue for either side.

What he did was no where near acceptable. Instead of adding an infinite loop to purposely sabotage other projects, he should have either walked away or changed the license for future versions of faker into a much more restricted one. SugarCRM transitioned their software from open source to closed source, and they’re still here with paying customers. There are also many restrictive licenses that change depending on th…

You don't get to tell other people what they should do for you.

Re: Faker.js is now a community controlled project

#195

Post by lolinder »

smt88 wrote: post #23
throwaway858 wrote: post #10

It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. This was his own corner of the internet for him to publish his own personal projects. I understand the decision for npm to take ownership of his packages, because npm is a community package repository owned by, and for, the community. All community package repositories have some sort of policy for p…

> It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. HN, at least, had a ton of discussion on this[1]. People advocated both ways. > This was his own corner of the internet for him to publish his own personal projects. No, it wasn't. It was Github's corner of the internet and then it was Microsoft's. If he just wanted a place to publish his personal…

> No, it wasn't. It was Github's corner of the internet and then it was Microsoft's. If he just wanted a place to publish his personal projects, he could have put them on a personal, self-hosted website.

Exactly. Marak's defenders are quick to argue that he had every right to do what he did based on the repo's license. It's inconsistent to then blame GitHub for suspending him from their platform.

Re: Faker.js is now a community controlled project

#196

Post by encryptluks2 »

hn_throwaway_99 wrote: post #116
bawolff wrote: post #80

Earlier quoted context omitted.

I wouldn't call that a trojan. It is being an asshole though.

It's a DoS attack disguised as other, useful software. That's exactly what a Trojan is.

It isn't disguised as anything. If you included a random module in your application package manager, and allowed it to update itself and run scripts then liability is on you for not verifying it and checking the license to see if they provided any warranty.

Re: Faker.js is now a community controlled project

#197

Post by diogenesjunior »

labster wrote: post #69
viraptor wrote: post #40

Earlier quoted context omitted.

> It was malicious act to Github's users. I'm not sure why it matters they are Github users. The packages were hosted on npm through Cloudflare - does that allow Cloudflare to take over the packages too? And NS1 since they host the fakerjs domain?

It’s cool that you’re internet rules-lawyering and all but ultimately he used his free account with intent to harm others, just as surely as if he backdoored his code. Freedom of speech is good, and protest is fine, but why would GitHub amplify the speech of a nutso who abused his position of trust?

>he used his free account

actually, marak has github pro, so it is not a free account

Re: Faker.js is now a community controlled project

#198

Post by exdsq »

ZephyrBlu wrote: post #183
DrFell wrote: post #163

Earlier quoted context omitted.

A lot of webdev is just pre-built stuff. When webdevs say "don't reinvent the wheel" it means "I'm too scared of doing it wrong to program it myself."

More like "I don't want to waste time building something low impact when I could pull in a dependency and be working on something high impact".

It's a combination of both. You're weighing up the time to build the right thing for yourself vs picking something up from the shelf. Specifically you have to factor in:

1) Is the project built correctly

2) Is it the correct project for your issue

3) Is the project maintained

4) Is the project going to be maintained for the lifetime of your project

5) Is the project secure, and how risky is including it to your project?

And if these are all good then sure, it makes sense to include it in your project. And this is good engineering. But what people seem to do is go "Oh hey, I need to get a random name from a dictionary of names. Let's google that. Oooh faker!" without even thinking these questions through.

Re: Faker.js is now a community controlled project

#199

Post by viraptor »

labster wrote: post #69
viraptor wrote: post #40

Earlier quoted context omitted.

> It was malicious act to Github's users. I'm not sure why it matters they are Github users. The packages were hosted on npm through Cloudflare - does that allow Cloudflare to take over the packages too? And NS1 since they host the fakerjs domain?

It’s cool that you’re internet rules-lawyering and all but ultimately he used his free account with intent to harm others, just as surely as if he backdoored his code. Freedom of speech is good, and protest is fine, but why would GitHub amplify the speech of a nutso who abused his position of trust?

> used his free account with intent to harm others, just as surely as if he backdoored his code

There's a huge difference between displaying a message and going in an endless loop and backdooring as in providing an alternative access to control a system you're not supposed to have access to. Words have meaning. This wasn't a backdoor.

Re: Faker.js is now a community controlled project

#200

Post by trowawee »

exdsq wrote: post #107
trowawee wrote: post #79

Earlier quoted context omitted.

> I’ve built mini APIs to do this in several previous jobs [...] Each time it’s taken maybe two days of effort So...just you, in your career, have spent between 1 and 2 total weeks of developer time building the exact same functionality, and you're curious why an open source project that cuts that time down to like an hour is popular? I'm also a little suspicious of the claim that it's the exact same, because Faker h…

Yes but for the sake of a few hours you now have 22 dependencies and a new security vector to consider :) And of course the reason this new version exists is because the previous version was deliberately broken. Why add significant dependencies for the sake of a few hours (maybe a day or two in the long run if you need to add functionality)?

So, a few answers.

A) most of the dependencies that Faker has are common with lots of JS projects that I work/have worked on in the last few years. Looking at that dep list[0], I'm familiar with most of them. They're mostly common packages. To some degree, I'm relying on the thousand eyes here.

B) In terms of security risk, Faker runs in test suites to generate data and locally on dev machines, sometimes, to populate sample DBs. It lives and runs in managed environments and doesn't get packaged into prod anywhere. The risk profile isn't nonexistent, but it's also not a massive risk.

C) I really think we're underrating the amount of work that would required to recreate this project (not uncommon here). Faker can spit out 205 different types of random data in 46 different languages/dialects. Building that is not a two day project (evidenced in the fact that people have been working on this for years now); making sure you can generate all that data correctly in all those different languages is a non-trivial task; building and maintaining it internally will take dev time and energy and will continue to require that time and energy on an ongoing basis.

You're talking about this choice here and in other comments with an air of "silly JS devs, just build this easy thing!". I don't know if it's your intention, but you're coming off dismissive and ignorant. People think about these tradeoffs all the time, and sometimes decide to use packages like this. I think it might behoove you, if you find someone's decision confusing, to start from the position that they are also reasonably competent professionals and see if you can understand why a competent professional might make a different decision than the one that seems obvious to you, rather than assuming that if someone makes a different decision they're stupid and/or incompetent.

[0]: https://github.com/faker-js/faker/blob/main/package.json

Post reply on HN