Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Faker.js is now a community controlled project

fakerjs.dev

Post reply on HN
Print view View original

251–260 of 357 posts

Re: Faker.js is now a community controlled project

#251

Post by seba_dos1 »

smt88 wrote: post #142
torstenvl wrote: post #57

Earlier quoted context omitted.

Quoted post unavailable.

> I strongly encourage you to stop making false allegations. I encourage you to find out the definition of Trojan[1] and then find out what Marak did to sabotage his code. To qualify as a Trojan, Faker.js needed to be: - advertised as being for a certain purpose - coded to do something to damage the person who installs it (even if it still does the thing it advertises that it does) In this case, Marak allowed people…

> Marak allowed people who thought they were installed Faker.js and tricked them into installing something that ran an infinite loop

They were installing a legitimate new version of Faker.js though - which just happened to be running an infinite loop. It's users who trusted Faker.js author to not pull this kind of stuff off and it turned out they were wrong to do that.

Re: Faker.js is now a community controlled project

#252

Post by runarberg »

PradeetPatel wrote: post #179
hn_throwaway_99 wrote: post #126

Earlier quoted context omitted.

I am completely baffled by folks defending Marak, or putting any sort of blame on GitHub. What Marak did was not "political speech". If he wanted to, he could have easily done any of the following: 1. Pulled down his repo, or replace his repo by whatever message he wanted to send. 2. Output his political message during the build. 3. Heck, all faker.js does is output fake data for things like names and addresses. I th…

What he did was utterly unprofessional, hazardous, and outright dangerous to those who trusted and used his library. By putting it on Github, he surrendered a portion of his right to distribute to Microsoft, and Microsoft did the best course of action to protect their reputation and the interest of their stakeholders. I see nothing wrong with this.

There is a little bit of dissonance here. Microsoft, a multi billion dollar company who works with organizations such as ICE which routinely engages in human right abuses and causes sever suffering and harm to thousands of people who are already pretty vulnerable.

vs. an open source developer who’s work benefits companies like Microsoft who have no obligation to pay for that labor. And engages in a single industrial sabotage which causes minor disruptions, and harm which at most costs other developer some time and temporary frustrations.

I feel like we need some sense of relativity when we attribute nouns such as hazardous and dangerous here. Especially when we are talking about Microsoft.

Re: Faker.js is now a community controlled project

#253

Post by smt88 »

encryptluks2 wrote: post #232
ziml77 wrote: post #193

Earlier quoted context omitted.

I am also not a lawyer, but this is what I found for NY and would be surprised if it doesn't apply in most states and many other countries too: > Under New York law, a party can waive ordinary negligence, but not gross negligence, reckless conduct, willful/wanton conduct, or intentional acts. See Kalisch-Jarcho v. City of New York, 58 N.Y.2d 377 (1983); See also Restatement (Second) of Contracts § 195 (1981) (“A term…

This would be like suing a food pantry because they stopped giving out free food.

Marak didn't stop giving out free food. He intentionally poisoned a food delivery without notifying the recipients.

Using your food pantry analogy, it sounds more like he should go to jail.

Re: Faker.js is now a community controlled project

#254

Post by runarberg »

chaostheory wrote: post #49
kemitchell wrote: post #34

This strikes me as hyper-defensive exercise in wrapping the lib thick with every cheap trapping of "community" to hand. I suspect because of the Open Collective handover. In the end, this thing spits out strings. Does it need eight maintainers, only a few of whom had commits, in low double digits? Does it need its own GitHub org, Twitter account, and Google .dev domain? Addressing open pull requests could be good, bu…

Marak isn’t the only one who snapped, but he’s the only one to my knowledge who has introduced malicious commits to this code to purposely hurt other people’s projects. (Even Hans Reiser didn’t do that.) It seems that this might have been a precursor to Marak attempting to hurt people in real life " Hospitalized Queens man charged with reckless endangerment after cops find bomb-making materials in his home " https://…

A social scientist who has studied industrial sabotage might be able to correct me if I’m wrong: But I have read one (1) book on the subject—which frankly is one more then most—and I don’t think there is any evidence of correlation between industrial saboteurs and sociopathy. In fact, quite the contrary, saboteurs often go to quite a length to prevent people being physically harmed in the sabotage.

A saboteur is more often then not mostly frustrated at their employer, or the industry, and try to maximize harm to those entities, not innocent bystanders. However given that saboteurs are often quite angry and have often been in a prolonged state of stress, and most often act alone—keeping their plans secret until they are executed—they are often not in the best position to correctly estimate who will receive the most harm.

In our industry there are plenty of frustrated workers, some are underpaid, others are overworked, some work for entities they morally object to, etc. When a colleague engages in this kind of sabotage which causes disruption on some scale we might see it as an act of solidarity from a shared frustration. This is certainly the case in other industries, and I don’t think tech is any different. In fact this incident reviles that our industry might even be more vulnerable to industrial sabotage then other industries.

Re: Faker.js is now a community controlled project

#255

Post by bastardoperator »

cookiengineer wrote: post #234
manquer wrote: post #30

Earlier quoted context omitted.

It was malicious act to Github's users. Github first responsibility comes to the community of users it supports, then to any individual user. Free speech/ personal choice / Freedom of expression come secondary to the welfare of its users. Is it a slippery slope ? Yes, but Github does not have a choice if it cared about the interest its community

> malicious act to Github's users Usually if I modify my car in my own backyard (aka my property) it is nobody's business to intervene, as long as it's on my property. Legally speaking, fakerjs was Marak's property and GitHub has no right to intervene with a legitimate user action. I can see that they "tried their best" but we also have to uphold the law here. If GitHub, say, called him on his phone whether or not hi…

This code has never belonged to Marak. This code is ported from other existing projects which had been acknowledged by Marak.

I see it like this. I can't buy a Harry Potter book, translate it to a different language, maybe change some of the character names and then claim ownership while not acknowledging the original work even if I publish it for free.

It's like you and your friends building a Mustang in your backyard, all of you put time, energy, and even money into the project only for you to turn around and claim you invented a new car model built entirely by yourself. No, it's a ford and most of the upgrades were done by others. People that helped you might feel that you are in fact being malicious.

Since we're using analogies, this wasn't his backyard, this is the GitHub's yard.

Re: Faker.js is now a community controlled project

#256

Post by anhner »

cookiengineer wrote: post #234
manquer wrote: post #30

Earlier quoted context omitted.

It was malicious act to Github's users. Github first responsibility comes to the community of users it supports, then to any individual user. Free speech/ personal choice / Freedom of expression come secondary to the welfare of its users. Is it a slippery slope ? Yes, but Github does not have a choice if it cared about the interest its community

> malicious act to Github's users Usually if I modify my car in my own backyard (aka my property) it is nobody's business to intervene, as long as it's on my property. Legally speaking, fakerjs was Marak's property and GitHub has no right to intervene with a legitimate user action. I can see that they "tried their best" but we also have to uphold the law here. If GitHub, say, called him on his phone whether or not hi…

If you modify your car in your backyard sure, but it wasn't his backyard, it was the public roads, and it wasn't (just) his car, it was his car that he shared with his neighbours. And then he decided to tamper with the brakes as a "prank", knowing full well that others would then use the car.

Re: Faker.js is now a community controlled project

#257

Post by balls187 »

Gigachad wrote: post #158
chaostheory wrote: post #49

Earlier quoted context omitted.

Marak isn’t the only one who snapped, but he’s the only one to my knowledge who has introduced malicious commits to this code to purposely hurt other people’s projects. (Even Hans Reiser didn’t do that.) It seems that this might have been a precursor to Marak attempting to hurt people in real life " Hospitalized Queens man charged with reckless endangerment after cops find bomb-making materials in his home " https://…

I don't think what he did was particularly good but I think he was entitled to do it. And the blame falls on the system we have which relies on random people to do work for free with no contract or obligation. It's like if a business delivered packages by asking some random homeless person on the street to walk it to its destination. And then one day the person just chucks your package in the river instead of deliver…

> And then one day the person just chucks your package in the river instead of delivering it.

That analogy makes little sense.

In my county, what you described is malicious mischief, and is a crime. A homeless person is not entitled to act in such a manner.

Re: Faker.js is now a community controlled project

#258

Post by balls187 »

cxr wrote: post #194
chaostheory wrote: post #123

Earlier quoted context omitted.

What he did was no where near acceptable. Instead of adding an infinite loop to purposely sabotage other projects, he should have either walked away or changed the license for future versions of faker into a much more restricted one. SugarCRM transitioned their software from open source to closed source, and they’re still here with paying customers. There are also many restrictive licenses that change depending on th…

You don't get to tell other people what they should do for you.

But you do get to criticize poor judgement and provide reasonable alternative courses of action.

Re: Faker.js is now a community controlled project

#259

Post by anhner »

Firehawke wrote: post #239
tptacek wrote: post #175

Earlier quoted context omitted.

Github will not allow you to use your personal corner of the platform to propagate malware, and hasn't allowed it for many years.

Exactly this. The changes were intentional malware, designed to break the usage of these two modules. GitHub is under no obligation to assist you in hosting malware. The fact that these changes were intended by the original author has no bearing in this situation.

I don't get how people don't understand this.

Re: Faker.js is now a community controlled project

#260

Post by anhner »

runarberg wrote: post #222
brongondwana wrote: post #148

Earlier quoted context omitted.

If I set up a nice shopfront and invite customers in, and then start kneecapping everybody who walks through the door, you gonna bet the city will have something to say about it. I'm not kneecapping the city, just its citizens, so why should they care - and I'm doing it on my own property which they voluntarily entered after seeing my "dollar store" sign out the front - so it's their own damn fault for believing my s…

There is a fundamental difference between physical violence like kneecapping and industrial sabotage which causes a minor temporary disruption in production, which is why the former is punishable by most national laws, while the latter isn’t.

> industrial sabotage

> causes a minor temporary disruption in production

pick one

ETA: if someone created a virus that would just display the text "you've been hacked!" and then that virus infected thousands of computers around the world, that someone would have a visit from the FBI with very serious charges. I don't see how this is different.

Post reply on HN