Faker.js is now a community controlled project • Hacker News Board

Re: Faker.js is now a community controlled project

#261

Post by balls187 » Mon, Jan 17, 2022, 7:09 AM UTC

onion2k wrote: post #227

kemitchell wrote: post #34

This strikes me as hyper-defensive exercise in wrapping the lib thick with every cheap trapping of "community" to hand. I suspect because of the Open Collective handover. In the end, this thing spits out strings. Does it need eight maintainers, only a few of whom had commits, in low double digits? Does it need its own GitHub org, Twitter account, and Google .dev domain? Addressing open pull requests could be good, bu…

In the end, this thing spits out strings. That's not really a critism. 90% of web dev is string manipulation.

Not worrying about endian conversion or the format of your floating point is a very good thing (Yes, I'm old enough to have dealt with software developed on Intel machines having to be ported to run on VAX based machines).

Re: Faker.js is now a community controlled project

#262

Post by npn » Mon, Jan 17, 2022, 7:10 AM UTC

PradeetPatel wrote: post #179

hn_throwaway_99 wrote: post #126

Earlier quoted context omitted.

I am completely baffled by folks defending Marak, or putting any sort of blame on GitHub. What Marak did was not "political speech". If he wanted to, he could have easily done any of the following: 1. Pulled down his repo, or replace his repo by whatever message he wanted to send. 2. Output his political message during the build. 3. Heck, all faker.js does is output fake data for things like names and addresses. I th…

What he did was utterly unprofessional, hazardous, and outright dangerous to those who trusted and used his library. By putting it on Github, he surrendered a portion of his right to distribute to Microsoft, and Microsoft did the best course of action to protect their reputation and the interest of their stakeholders. I see nothing wrong with this.

> professional

then pay him? I'd admit that this person didn't really contribute anything really worthy. But please do not require someone to be "professional" when you did not pay him a dime.

Re: Faker.js is now a community controlled project

#263

Post by reilly3000 » Mon, Jan 17, 2022, 7:14 AM UTC

For what its worth, there were a lot of conversations this week around package security and compensation for open source projects among tech decision makers. Ultimately it wouldn't have happened if he had a generous sponsor and in that way I consider the act somewhat selfish. That said, I it both reaffirms that there is a vibrant community of individuals who are willing to volunteer their time for the benefit of the software ecosystem regardless of compensation, as well as a growing number of corporations who are understanding that open source projects deserve their patronage. Despite breaking some builds, it didn't break the internet but made for some good controversy. If nothing else, I think that makes this good art.

Re: Faker.js is now a community controlled project

#264

Post by anhner » Mon, Jan 17, 2022, 7:16 AM UTC

junon wrote: post #215

throwaway858 wrote: post #10

It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. This was his own corner of the internet for him to publish his own personal projects. I understand the decision for npm to take ownership of his packages, because npm is a community package repository owned by, and for, the community. All community package repositories have some sort of policy for p…

Chalk maintainer here. I said before I wouldn't comment on Marak but I don't want to stand by and watch him profit from this like he is, monetarily or otherwise, nor should GitHub receive ANY hate for their actions. He's not banned. It was most likely an initial response to a suspected compromised account situation. Once they determined the actions were carried out by the account holder, they reinstated it. There are…

Thank you for stepping up and commenting on this.

Re: Faker.js is now a community controlled project

#265

Post by nightpool » Mon, Jan 17, 2022, 7:16 AM UTC

blowski wrote: post #250

nightpool wrote: post #231

Earlier quoted context omitted.

This is an opinion you can have, but it's far from clear that it's an obvious or inherent one. What is the Github "community"? Who constitutes it? If I use Github for a personal project, and share the link with my friend, are we "part of the Github community"? How were we harmed by this incident? Did anyone say "We should shut Github down because they're irresponsibly hosting someone who would use his public JavaScri…

It sounds like you’re looking for very clear lines which can and can’t be crossed. Whereas others see a blurry grey area in which GitHub makes judgement calls, and then individuals decide whether or not to use GitHub.

Mm, not really. There are lots of cases much more blurry and questionable then this one. What I'm looking for is 1) a recognition that Github would be in the wrong to suspend Marak for doing whatever he wanted with his own open source project, and 2) an acknowledgement that it's important for Github to be transparent about why they took the actions they did and what motivated their actions.

Re: Faker.js is now a community controlled project

#266

Post by npn » Mon, Jan 17, 2022, 7:19 AM UTC

chaostheory wrote: post #61

przemelek wrote: post #26

Hmm, but as I understand original developer was rather pissed off by situation when devs are working on projects in theirs own time, and those projects sometimes become important tools to lower costs of creating software for big companies, and authors are not getting a dime and are forced to use some kinds of sponsorship and so on.... In such case making one of tools "community" owned smells like some kind of dick mo…

I've already posted this before, but what Marak has done is anything but reasonable. If anyone was being a "dick", it was him. If he just wanted corporations to pay, there are plenty of other alternatives like changing the license for future versions like SugarCRM did. It's been years since they've done that and they have plenty of customers. https://sugarclub.sugarcrm.com/engage/b/sugar-news/posts/sug... Since the d…

> he must do this, he must do that.

how about you do it for him? like forking and maintaining your own copy of faker.js and all the nodejs packages you are actively using in the first place?

ad hominem does not help your argument.

Re: Faker.js is now a community controlled project

#267

Post by anhner » Mon, Jan 17, 2022, 7:35 AM UTC

holografix wrote: post #122

Isn’t calling this “malicious” a bit of a stretch? It’s not like he is mining crypto on your machine. It’s a (however misguided) act of protest and demand for attention. Fine GitHub put the breaks on in case it was an account takeover but they should allow him to do whatever he wants with his repos once it confirms it’s really him. Also npm just removes his access…? If I was the author of a popular npm package and de…

"It's just a prank, bro"

Re: Faker.js is now a community controlled project

#268

Post by ohgodplsno » Mon, Jan 17, 2022, 7:49 AM UTC

PragmaticPulp wrote: post #13

throwaway858 wrote: post #10

It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. This was his own corner of the internet for him to publish his own personal projects. I understand the decision for npm to take ownership of his packages, because npm is a community package repository owned by, and for, the community. All community package repositories have some sort of policy for p…

> It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors. He's not banned: https://github.com/Marak You have to keep in mind that his changes were basically indistinguishable from a security breach of his account. Nobody really sabotages their own repos in a malicious manner like this. Suspending his account while they investigated doesn't seem like a st…

No post body was provided.

Re: Faker.js is now a community controlled project

#269

Post by EMM_386 » Mon, Jan 17, 2022, 8:05 AM UTC

Gigachad wrote: post #158

chaostheory wrote: post #49

Earlier quoted context omitted.

Marak isn’t the only one who snapped, but he’s the only one to my knowledge who has introduced malicious commits to this code to purposely hurt other people’s projects. (Even Hans Reiser didn’t do that.) It seems that this might have been a precursor to Marak attempting to hurt people in real life " Hospitalized Queens man charged with reckless endangerment after cops find bomb-making materials in his home " https://…

I don't think what he did was particularly good but I think he was entitled to do it. And the blame falls on the system we have which relies on random people to do work for free with no contract or obligation. It's like if a business delivered packages by asking some random homeless person on the street to walk it to its destination. And then one day the person just chucks your package in the river instead of deliver…

> I don't think what he did was particularly good but I think he was entitled to do it. And the blame falls on the system we have which relies on random people to do work for free with no contract or obligation.

Utter nonsense.

You don't put out code under open-source MIT and then want to take it back when you realize other people are using it exactly as you instructed them to use it, which in this case is "anyway they please".

You have to think about this stuff before hand if you want to be compensated if it "takes off", there are other licenses you could use.

Re: Faker.js is now a community controlled project

#270

Post by cookiengineer » Mon, Jan 17, 2022, 8:22 AM UTC

bastardoperator wrote: post #255

cookiengineer wrote: post #234

Earlier quoted context omitted.

> malicious act to Github's users Usually if I modify my car in my own backyard (aka my property) it is nobody's business to intervene, as long as it's on my property. Legally speaking, fakerjs was Marak's property and GitHub has no right to intervene with a legitimate user action. I can see that they "tried their best" but we also have to uphold the law here. If GitHub, say, called him on his phone whether or not hi…

This code has never belonged to Marak. This code is ported from other existing projects which had been acknowledged by Marak. I see it like this. I can't buy a Harry Potter book, translate it to a different language, maybe change some of the character names and then claim ownership while not acknowledging the original work even if I publish it for free. It's like you and your friends building a Mustang in your backya…

The ToS of GitHub state that it's not their property, they only claim the license for redistribution. If it would be their property, legal cases (e.g. DMCA) would be against GitHub, not the owners of the repositories. So from their point of view they do not want to be legally responsible for the code they're hosting.

So I'd argue that it wasn't GitHubs backyard. They might be the landlord but they can't take ownership of the things that you build in your (rented?) flat.

Don't get me wrong, I also agree with you. For me this whole situation is kind of a paradox where there's no easy moral (or legal) answer on what to do, and on what society already has agreed upon.