Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Faker.js is now a community controlled project

fakerjs.dev

Post reply on HN
Print view View original

201–210 of 357 posts

Re: Faker.js is now a community controlled project

#201

Post by tedunangst »

viraptor wrote: post #40
manquer wrote: post #30

Earlier quoted context omitted.

It was malicious act to Github's users. Github first responsibility comes to the community of users it supports, then to any individual user. Free speech/ personal choice / Freedom of expression come secondary to the welfare of its users. Is it a slippery slope ? Yes, but Github does not have a choice if it cared about the interest its community

> It was malicious act to Github's users. I'm not sure why it matters they are Github users. The packages were hosted on npm through Cloudflare - does that allow Cloudflare to take over the packages too? And NS1 since they host the fakerjs domain?

If the attack had been conducted by retargeting cloudflare at a hostile upstream, maybe so. But the attack originated at GitHub, so they're the ones to take action in response.

Re: Faker.js is now a community controlled project

#202

Post by shadowgovt »

Waterluvian wrote: post #146
hn_throwaway_99 wrote: post #126

Earlier quoted context omitted.

I am completely baffled by folks defending Marak, or putting any sort of blame on GitHub. What Marak did was not "political speech". If he wanted to, he could have easily done any of the following: 1. Pulled down his repo, or replace his repo by whatever message he wanted to send. 2. Output his political message during the build. 3. Heck, all faker.js does is output fake data for things like names and addresses. I th…

Be careful not to confuse defense of the individual with criticism of how Microsoft behaved.

Microsoft behaved as a good steward of both a code-hosting service and a package-hosting service in the face of an attempt to exploit both to harm users.

Re: Faker.js is now a community controlled project

#203

Post by shadowgovt »

cxr wrote: post #191
syshum wrote: post #78

Earlier quoted context omitted.

What you are going to get is people separating out into 2 camps, those that believe in individuality, and those that believe in more collectivism. This is a divide that extends well beyond programming and this topic. People that support GitHub actions believe in the concept of "greater good" and believe the actions of GitHub are ethical because it prevented harm to the community People that oppose GitHub actions reje…

> What you are going to get is people separating out into 2 camps, those that believe in individuality, and those that believe in more collectivism. I agree wholeheartedly with this statement, but we're diametrically opposed on how these two groups are allocated. I.e., the people you're labelling as collectivists I are in the other group, and vice versa. People who think GitHub did right are a real me-first bunch, no…

I'm not sure how we get to me-first when the story is one actor using the wide-cast popularity of packages he had admin rights to to intentionally cause harm.

It's a "the needs of the many outweigh the needs of the few" situation.

Re: Faker.js is now a community controlled project

#204

Post by shadowgovt »

encryptluks2 wrote: post #196
hn_throwaway_99 wrote: post #116

Earlier quoted context omitted.

It's a DoS attack disguised as other, useful software. That's exactly what a Trojan is.

It isn't disguised as anything. If you included a random module in your application package manager, and allowed it to update itself and run scripts then liability is on you for not verifying it and checking the license to see if they provided any warranty.

Funny how well that has worked until one person comes along and uses it to break people's software intentionally.

At the very least, Marak is an example of why we can't have nice things. None of us are obligated to applaud him for that.

Re: Faker.js is now a community controlled project

#205

Post by outsomnia »

shadowgovt wrote: post #203
cxr wrote: post #191

Earlier quoted context omitted.

> What you are going to get is people separating out into 2 camps, those that believe in individuality, and those that believe in more collectivism. I agree wholeheartedly with this statement, but we're diametrically opposed on how these two groups are allocated. I.e., the people you're labelling as collectivists I are in the other group, and vice versa. People who think GitHub did right are a real me-first bunch, no…

I'm not sure how we get to me-first when the story is one actor using the wide-cast popularity of packages he had admin rights to to intentionally cause harm. It's a "the needs of the many outweigh the needs of the few" situation.

It's a bit mind-boggling that FOSS authors who give their work away for free are the selfish baddies, and Microsoft of all people, are the communistic heroes in your telling.

Re: Faker.js is now a community controlled project

#206

Post by Gigachad »

WarChortle wrote: post #181
Gigachad wrote: post #158

Earlier quoted context omitted.

I don't think what he did was particularly good but I think he was entitled to do it. And the blame falls on the system we have which relies on random people to do work for free with no contract or obligation. It's like if a business delivered packages by asking some random homeless person on the street to walk it to its destination. And then one day the person just chucks your package in the river instead of deliver…

Open source works because we can trust authors to not maliciously harm other people. If it was a bug that's one thing it happens, you move on. But when you purposely do something that you know will cause harm to people that is where I draw the line. Your analogy isn't even close. No one forced him to write faker.js. He chose to do it and he chose to make it open source under a license allowing people to use it. He al…

He chose to put a package online. He didn't sign any contract stating the package would meet some kind of quality obligations. He had no obligation to do anything.

Yes, it is particularly shitty to intentionally screw it up. But the system that put so much value on something not happening without any safeguards or obligations is the real problem.

The move fast and break things attitude of web development is the cause. A single rogue dev is just an example of the worst happening. In the future I imagine we will have package managers which do not give random individuals so much power. And we will rely on packages from trusted names, Google for example has a very very low risk of sabotaging a package compared to a no name individual. If companies had paid for this package, they could take legal action against the author. But they paid nothing and had no assurances of anything other than a vague hope it would continue to work.

Re: Faker.js is now a community controlled project

#207

Post by salawat »

labster wrote: post #69
viraptor wrote: post #40

Earlier quoted context omitted.

> It was malicious act to Github's users. I'm not sure why it matters they are Github users. The packages were hosted on npm through Cloudflare - does that allow Cloudflare to take over the packages too? And NS1 since they host the fakerjs domain?

It’s cool that you’re internet rules-lawyering and all but ultimately he used his free account with intent to harm others, just as surely as if he backdoored his code. Freedom of speech is good, and protest is fine, but why would GitHub amplify the speech of a nutso who abused his position of trust?

I see only one of those alleged "nutso's", and that was GitHub.

Everyone else should have been responsibly consuming the dependency. You don't get to call foul when you knowingly use something for something important and don't check to make sure it is okay.

Re: Faker.js is now a community controlled project

#208

Post by leshenka »

viraptor wrote: post #199
labster wrote: post #69

Earlier quoted context omitted.

It’s cool that you’re internet rules-lawyering and all but ultimately he used his free account with intent to harm others, just as surely as if he backdoored his code. Freedom of speech is good, and protest is fine, but why would GitHub amplify the speech of a nutso who abused his position of trust?

> used his free account with intent to harm others, just as surely as if he backdoored his code There's a huge difference between displaying a message and going in an endless loop and backdooring as in providing an alternative access to control a system you're not supposed to have access to. Words have meaning. This wasn't a backdoor.

There is a difference between robbery and burglary.

Re: Faker.js is now a community controlled project

#209

Post by Aeolun »

chaostheory wrote: post #123
Sebb767 wrote: post #114

Earlier quoted context omitted.

> What surprises me is the amount of support he’s garnered for his actions with a lot of people on HN. Well, his motivations were somewhat understandable and his actions were still scratching the realm of acceptable (not cool, but no serious damage and nobody was hurt). It's actually hitting the pretty much perfect spot to generate lots of discussions, since it's very easy and understandable to argue for either side.

What he did was no where near acceptable. Instead of adding an infinite loop to purposely sabotage other projects, he should have either walked away or changed the license for future versions of faker into a much more restricted one. SugarCRM transitioned their software from open source to closed source, and they’re still here with paying customers. There are also many restrictive licenses that change depending on th…

> he should have either walked away or changed the license for future versions of faker

He could have, and nobody would be talking about or remarking on it at all, which rather defeats the point.

Re: Faker.js is now a community controlled project

#210

Post by leshenka »

salawat wrote: post #207
labster wrote: post #69

Earlier quoted context omitted.

It’s cool that you’re internet rules-lawyering and all but ultimately he used his free account with intent to harm others, just as surely as if he backdoored his code. Freedom of speech is good, and protest is fine, but why would GitHub amplify the speech of a nutso who abused his position of trust?

I see only one of those alleged "nutso's", and that was GitHub. Everyone else should have been responsibly consuming the dependency. You don't get to call foul when you knowingly use something for something important and don't check to make sure it is okay.

Now that’s just plain victim blaming
Post reply on HN