Faker.js is now a community controlled project • Hacker News Board

Re: Faker.js is now a community controlled project

#301

Post by z3ncyberpunk » Mon, Jan 17, 2022, 2:51 PM UTC

tibiapejagala wrote: post #284

hn_throwaway_99 wrote: post #126

Earlier quoted context omitted.

I am completely baffled by folks defending Marak, or putting any sort of blame on GitHub. What Marak did was not "political speech". If he wanted to, he could have easily done any of the following: 1. Pulled down his repo, or replace his repo by whatever message he wanted to send. 2. Output his political message during the build. 3. Heck, all faker.js does is output fake data for things like names and addresses. I th…

Indeed, he definitely could do his protest in a way which wouldn’t inconvenience billion dollar companies or even anyone. Just like BLM could protest in a remote location or do an online petition. Except that no one would give a fuck about that. The same about a message during the build. You call it a DoS attack, I call it a brownout warning about unsustainable open source funding. After all old versions are unaffect…

Did you not read his message? The entire point was to inconvenience billion dollar companies not helping pay or foot the bill for all the software they use and steal unpunished and unscathed.

Re: Faker.js is now a community controlled project

#302

Post by z3ncyberpunk » Mon, Jan 17, 2022, 2:54 PM UTC

starwind wrote: post #139

hn_throwaway_99 wrote: post #126

Earlier quoted context omitted.

I am completely baffled by folks defending Marak, or putting any sort of blame on GitHub. What Marak did was not "political speech". If he wanted to, he could have easily done any of the following: 1. Pulled down his repo, or replace his repo by whatever message he wanted to send. 2. Output his political message during the build. 3. Heck, all faker.js does is output fake data for things like names and addresses. I th…

Correct. You basically never have the right to commit sabotage

Except that it was his code, and it's open source therefore the risk of using said code is your own. It's his project, He's under no obligation to maintain it in a functional state or at all just because you happen to use it. That's just egotistical and narcissistic on your part

Re: Faker.js is now a community controlled project

#303

Post by z3ncyberpunk » Mon, Jan 17, 2022, 2:58 PM UTC

Macha wrote: post #110

encryptluks2 wrote: post #60

Earlier quoted context omitted.

Value add in to who? It sounds like you believe open source developers owe something to someone which simply isn't the case. You should evaluate the license(s): THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIA…

I don't see where this license obligates github to distribute future versions. Also if we're expecting people to do the bare minimum specified in their license, github's license gives them all the leeway they needed for their actions too.

GitHub is under no obligation to distribute further versions. Neither is Marak under any obligation to maintain and upkeep the repository. While in bad faith of the community, you are the consumer who CHOSE to use his software, free and at no cost to yourself. You have no right to dictate how that repository is used, especially if you never donated or contributed to the project itself.

Re: Faker.js is now a community controlled project

#304

Post by encryptluks2 » Mon, Jan 17, 2022, 2:59 PM UTC

bawolff wrote: post #235

encryptluks2 wrote: post #226

Earlier quoted context omitted.

If someone hands out free food on the corner with a sign that says you aren't entitled to it and so you get used to getting free food there. In fact, you've found ways to save on your budget because of it. You also optimized your route home from work to get there at the most convenient time. One day, you show up and they have a sign up that says... No more free food, vote for Bernie. Are you really the type to compla…

But he didn't withdraw his offering he sabotaged it. I guess the metaphor would be if you gave out free food all the time with a sign saying people aren't entitled to it, and then one day decided to add laxatives to it because you felt the people were ungrateful. Which would land you in jail for a long time no matter what the sign said.

No, the person giving free free food here did not go up to people's houses saying here is free food still, eat it cause it is yummy and safe. The people getting the free food showed up cause they felt entitled, grabbed whatever they could find and said... oh, this isn't the free food that I'm used to getting here... oh, and I forgot to read the sign that has been there all along.

Re: Faker.js is now a community controlled project

#305

Post by encryptluks2 » Mon, Jan 17, 2022, 3:00 PM UTC

smt88 wrote: post #253

encryptluks2 wrote: post #232

Earlier quoted context omitted.

This would be like suing a food pantry because they stopped giving out free food.

Marak didn't stop giving out free food. He intentionally poisoned a food delivery without notifying the recipients. Using your food pantry analogy, it sounds more like he should go to jail.

He didn't deliver food. People picked up whatever they could find cause they felt entitled, and then said... oh look there was a sign here all along.

Re: Faker.js is now a community controlled project

#306

Post by Macha » Mon, Jan 17, 2022, 3:19 PM UTC

z3ncyberpunk wrote: post #303

Macha wrote: post #110

Earlier quoted context omitted.

I don't see where this license obligates github to distribute future versions. Also if we're expecting people to do the bare minimum specified in their license, github's license gives them all the leeway they needed for their actions too.

GitHub is under no obligation to distribute further versions. Neither is Marak under any obligation to maintain and upkeep the repository. While in bad faith of the community, you are the consumer who CHOSE to use his software, free and at no cost to yourself. You have no right to dictate how that repository is used, especially if you never donated or contributed to the project itself.

> While in bad faith of the community, you are the consumer who CHOSE to use his software, free and at no cost to yourself. You have no right to dictate how that repository is used, especially if you never donated or contributed to the project itself.

Either we're going by a legalistic interpretation of the terms in which case Marak was free to fuck up his project and github was free to kick him off npm for it, or we're agreeing that people can be held to moral standards apart from legal ones.

If we agree that moral standards about bad faith should prevent npm/github/microsoft from taking control of something that Marak has put work into, then we should also be able to agree that moral standards should prevent Marak from releasing a deliberately broken version of a package as a fuck you to corporate users. Even that action of Marak's I think is wrong, but the backlash also landed on many open source projects.

Re: Faker.js is now a community controlled project

#307

Post by Macha » Mon, Jan 17, 2022, 3:25 PM UTC

encryptluks2 wrote: post #305

smt88 wrote: post #253

Earlier quoted context omitted.

Marak didn't stop giving out free food. He intentionally poisoned a food delivery without notifying the recipients. Using your food pantry analogy, it sounds more like he should go to jail.

He didn't deliver food. People picked up whatever they could find cause they felt entitled, and then said... oh look there was a sign here all along.

If we're stressing the analogy, Marak put food out in a park with a sign "Take the food, just tell everyone you got it from Marak, quality not guaranteed".

Then one day the food had laxatives because he felt not enough people put money in the tip jar.

I think that would still be actionable. Most people wouldn't bother, just like I don't think anyone is seriously thinking of taking Marak to court over what is mostly broken CI builds, but maybe the park staff won't let him offer food there anymore.

Re: Faker.js is now a community controlled project

#308

Post by runarberg » Mon, Jan 17, 2022, 3:33 PM UTC

anhner wrote: post #260

runarberg wrote: post #222

Earlier quoted context omitted.

There is a fundamental difference between physical violence like kneecapping and industrial sabotage which causes a minor temporary disruption in production, which is why the former is punishable by most national laws, while the latter isn’t.

> industrial sabotage > causes a minor temporary disruption in production pick one ETA: if someone created a virus that would just display the text "you've been hacked!" and then that virus infected thousands of computers around the world, that someone would have a visit from the FBI with very serious charges. I don't see how this is different.

> Pick one

I don’t understand. Industrial sabotage is an act of vandalism with the intended purpose of causing disruption in productivity. This incident in particular only caused a relatively minor disruption not much bigger then e.g. a partial github outage.

> I don't see how this is different.

The difference is in 1) the intended targets. This incident was targeted against particular industry. The worm you are describing would be indiscriminate and would have the potential to be 2) much larger scale and therefor you could deduce the 3) intention of your hypothetical attacker would not be to cause disruptions of productivity withing a particular industry, but rather to prank random strangers. The difference is rather obvious.

Re: Faker.js is now a community controlled project

#309

Post by tptacek » Mon, Jan 17, 2022, 3:35 PM UTC

pydry wrote: post #274

tptacek wrote: post #175

Earlier quoted context omitted.

Github will not allow you to use your personal corner of the platform to propagate malware, and hasn't allowed it for many years.

Breaking a build in a way that is trivially rolled back is not in the same league as pushing code that harvests email addresses, CCs and mines bitcoin. I'm disappointed to see this kind of comparison made.

Deliberately breaking people's applications? It's malware.

Re: Faker.js is now a community controlled project

#310

Post by starwind » Mon, Jan 17, 2022, 3:48 PM UTC

z3ncyberpunk wrote: post #302

starwind wrote: post #139

Earlier quoted context omitted.

Correct. You basically never have the right to commit sabotage

Except that it was his code, and it's open source therefore the risk of using said code is your own. It's his project, He's under no obligation to maintain it in a functional state or at all just because you happen to use it. That's just egotistical and narcissistic on your part

You're wrong. If I routinely share my lunch with someone at work, I don't get to poison it because "It's my sandwich, I'm under no obligation to make sure it's safe just because you happen to eat it." Hell, I can't poison it even if someone's stealing my lunch.

I can't create code with malware. I can't modify my code to make it malware. That's a crime. You're wrong