Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Faker.js is now a community controlled project

fakerjs.dev

Post reply on HN
Print view View original

221–230 of 357 posts

Re: Faker.js is now a community controlled project

#221

Post by udbhavs »

jeroenhd wrote: post #64
CrimsonCape wrote: post #46

I'm not understanding this situation from the perspective of intellectual property. This new project probably doesn't have the copyright of the author??

I doubt the original author had a trademark on the name "Faker" [0] and the MIT license the project was published under allows anyone to re-upload the source code to the internet and subsequently modify it. The copyright to the original code still belongs to the original author, of course, but the author has chosen to license his code in such a way that this is a perfectly fine thing to do. This is the power (and, fo…

From the linked article:

> Faker was first implemented in Perl in 2004 by Jason Kohles

Re: Faker.js is now a community controlled project

#222

Post by runarberg »

brongondwana wrote: post #148
nightpool wrote: post #25

Earlier quoted context omitted.

It was a malicious act to the users of his project, sure. But how was it a malicious act to GitHub? I'm glad to hear that they reversed the suspension, but without understanding why it was suspended in the first place, it leaves open the question of what GitHub's motives were in the whole situation. If DHH decided that Rails was contributing more harm to the world then good, and tried to remove it from GitHub, would…

If I set up a nice shopfront and invite customers in, and then start kneecapping everybody who walks through the door, you gonna bet the city will have something to say about it. I'm not kneecapping the city, just its citizens, so why should they care - and I'm doing it on my own property which they voluntarily entered after seeing my "dollar store" sign out the front - so it's their own damn fault for believing my s…

There is a fundamental difference between physical violence like kneecapping and industrial sabotage which causes a minor temporary disruption in production, which is why the former is punishable by most national laws, while the latter isn’t.

Re: Faker.js is now a community controlled project

#223

Post by butlerm »

epolanski wrote: post #171
PragmaticPulp wrote: post #56

Earlier quoted context omitted.

> The new project taking over the name and URL of the old project doesn't make it "the same" project. Do you really think the sponsors and the people using this code actually care that one person (of many contributors to the project) who wanted to break the project is no longer part of the project? It's a technicality, but in practice nobody actually cares. If they wanted to sponsor Marak they would have done it thro…

Ok, but the question is, what entitles these people, rather than other to claim a fork as "community successor"?

Nothing. People vote with their feet or their checkbooks.

Re: Faker.js is now a community controlled project

#224

Post by porlune »

salawat wrote: post #207
labster wrote: post #69

Earlier quoted context omitted.

It’s cool that you’re internet rules-lawyering and all but ultimately he used his free account with intent to harm others, just as surely as if he backdoored his code. Freedom of speech is good, and protest is fine, but why would GitHub amplify the speech of a nutso who abused his position of trust?

I see only one of those alleged "nutso's", and that was GitHub. Everyone else should have been responsibly consuming the dependency. You don't get to call foul when you knowingly use something for something important and don't check to make sure it is okay.

Setting your package version to allow for minor updates _is_ responsibly consuming the dependency.

Re: Faker.js is now a community controlled project

#225

Post by smt88 »

outsomnia wrote: post #205
shadowgovt wrote: post #203

Earlier quoted context omitted.

I'm not sure how we get to me-first when the story is one actor using the wide-cast popularity of packages he had admin rights to to intentionally cause harm. It's a "the needs of the many outweigh the needs of the few" situation.

It's a bit mind-boggling that FOSS authors who give their work away for free are the selfish baddies, and Microsoft of all people, are the communistic heroes in your telling.

> It's a bit mind-boggling that FOSS authors who give their work away for free are the selfish baddies

This is a straw man. No one made this generalization.

Marak, specifically, is a "selfish baddy", and it has nothing to do with FOSS. It has to do with his abuse of Github, npm, and Faker.js (which other people also contributed to) to distribute malware.

None of that can be generalized to a position about FOSS, Microsoft, or any other nonsense you're trying to extrapolate. It's specifically about a bad actor who was removed from a platform.

Re: Faker.js is now a community controlled project

#226

Post by encryptluks2 »

shadowgovt wrote: post #204
encryptluks2 wrote: post #196

Earlier quoted context omitted.

It isn't disguised as anything. If you included a random module in your application package manager, and allowed it to update itself and run scripts then liability is on you for not verifying it and checking the license to see if they provided any warranty.

Funny how well that has worked until one person comes along and uses it to break people's software intentionally. At the very least, Marak is an example of why we can't have nice things. None of us are obligated to applaud him for that.

If someone hands out free food on the corner with a sign that says you aren't entitled to it and so you get used to getting free food there. In fact, you've found ways to save on your budget because of it. You also optimized your route home from work to get there at the most convenient time.

One day, you show up and they have a sign up that says... No more free food, vote for Bernie. Are you really the type to complain that now you have to pay for food again or find someone else to give you free food, and throw a fit that their vote for Bernie sign is a trojan?

Re: Faker.js is now a community controlled project

#227

Post by onion2k »

kemitchell wrote: post #34

This strikes me as hyper-defensive exercise in wrapping the lib thick with every cheap trapping of "community" to hand. I suspect because of the Open Collective handover. In the end, this thing spits out strings. Does it need eight maintainers, only a few of whom had commits, in low double digits? Does it need its own GitHub org, Twitter account, and Google .dev domain? Addressing open pull requests could be good, bu…

In the end, this thing spits out strings.

That's not really a critism. 90% of web dev is string manipulation.

Re: Faker.js is now a community controlled project

#228

Post by encryptluks2 »

hn_throwaway_99 wrote: post #113
torstenvl wrote: post #77

Earlier quoted context omitted.

> That seems exactly like the definition of a Trojan to me. Link to even one report of Marak getting inside someone else's system.

You seem to be misunderstanding what a Trojan is. From Wikipedia: > In computing, a Trojan horse is any malware that misleads users of its true intent. The term is derived from the Ancient Greek story of the deceptive Trojan Horse that led to the fall of the city of Troy. > Trojans generally spread by some form of social engineering; for example, where a user is duped into executing an email attachment disguised to a…

They didn't disguise anything. It was MIT licensed, so you could have forked it long ago. You got used to the source you were using being useful, and so you felt entitled that they would maintain it in a way that was appropriate for your standards based on what you felt entitled to. The thing is with open source projects like this, no one owes you anything but it is too hard to admit that for many people.

Re: Faker.js is now a community controlled project

#229

Post by mithr »

encryptluks2 wrote: post #60
shadowgovt wrote: post #38

Earlier quoted context omitted.

FWIW, GitHub's actions here have in no way damaged my trust in them. They interpreted a developer's attempt to harm the community via abuse of the trust the community had placed in him as damage and mitigated it in the short run. That's a value-add.

Value add in to who? It sounds like you believe open source developers owe something to someone which simply isn't the case. You should evaluate the license(s): THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIA…

Value-add to the people who actually use github to build software, of course. It's fine to discuss license terms and what you should or shouldn't expect when you use github/npm/etc, but in the real-world JS landscape, many projects (commercial and otherwise) use many open-source packages through complex dependency hierarchies.

Your can think what you want about whether that's good or bad, but it's unquestionably our current reality. Protecting JS projects from malicious updates, regardless of whether or not the project license technically permits this by the author, is clearly in the best interest of users of this ecosystem.

Re: Faker.js is now a community controlled project

#230

Post by butlerm »

holografix wrote: post #122

Isn’t calling this “malicious” a bit of a stretch? It’s not like he is mining crypto on your machine. It’s a (however misguided) act of protest and demand for attention. Fine GitHub put the breaks on in case it was an account takeover but they should allow him to do whatever he wants with his repos once it confirms it’s really him. Also npm just removes his access…? If I was the author of a popular npm package and de…

He intended to cause harm, and that is enough to make it a malicious act.
Post reply on HN