Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Faker.js is now a community controlled project

fakerjs.dev

Post reply on HN
Print view View original

331–340 of 357 posts

Re: Faker.js is now a community controlled project

#331

Post by chaostheory »

Aeolun wrote: post #209
chaostheory wrote: post #123

Earlier quoted context omitted.

What he did was no where near acceptable. Instead of adding an infinite loop to purposely sabotage other projects, he should have either walked away or changed the license for future versions of faker into a much more restricted one. SugarCRM transitioned their software from open source to closed source, and they’re still here with paying customers. There are also many restrictive licenses that change depending on th…

> he should have either walked away or changed the license for future versions of faker He could have, and nobody would be talking about or remarking on it at all, which rather defeats the point.

Actually, when redis changed their license to get paid by cloud services like Amazon, there was a huge uproar. The people behind redis didn’t purposely break anything, had a lot of people talking about it, and had a clearer way towards getting paid. There are better ways to bring attention to an important issue.

Re: Faker.js is now a community controlled project

#332

Post by chaostheory »

runarberg wrote: post #254
chaostheory wrote: post #49

Earlier quoted context omitted.

Marak isn’t the only one who snapped, but he’s the only one to my knowledge who has introduced malicious commits to this code to purposely hurt other people’s projects. (Even Hans Reiser didn’t do that.) It seems that this might have been a precursor to Marak attempting to hurt people in real life " Hospitalized Queens man charged with reckless endangerment after cops find bomb-making materials in his home " https://…

A social scientist who has studied industrial sabotage might be able to correct me if I’m wrong: But I have read one (1) book on the subject—which frankly is one more then most—and I don’t think there is any evidence of correlation between industrial saboteurs and sociopathy. In fact, quite the contrary, saboteurs often go to quite a length to prevent people being physically harmed in the sabotage. A saboteur is more…

Most of what you’ve written is valid. The main issue I have is that you’re implying that software developers and engineers are “underpaid”. That doesn’t reflect reality. We are one of the highest paid professions in the US due to several factors. There is also a lot of career mobility ie If you’re not happy, change companies. The other issue is assuming that Marak is rational. I do not believe he is at the moment since he was involved with manufacturing homemade bombs at his apartment.

Re: Faker.js is now a community controlled project

#333

Post by cxr »

balls187 wrote: post #325
cxr wrote: post #321

Earlier quoted context omitted.

Nice bait-and-switch, but we can scroll back and see how relevant your defense of the comment I responded to really is. Declamations are fine; declarations about what is "acceptable" and what "they should have done" are more than mere criticism of poor judgement, etc., and are what the author of the comment I responded to actually wrote.

> Instead of adding an infinite loop to purposely sabotage other projects, he should have either walked away or changed the license for future versions of faker into a much more restricted one Then from the context, you can clearly read the comment you responded to did not mention that Makar needed to do anything for him specifically.

> he should have either [done this thing (that I deem would be "acceptable") or this other thing]

(This is my last response to you, since you were strawmanning from the beginning and this is obviously not going to go anywhere that doesn't involve intellectual dishonesty dressed up as a clever retort.)

Re: Faker.js is now a community controlled project

#334

Post by DonHopkins »

syshum wrote: post #316
DonHopkins wrote: post #311

Earlier quoted context omitted.

Lord forbid I make a typo. But of course you knew exactly what I meant, and despite your attempt to disown that behavior, those people now OWN your precious Libertarian party just as much as they now OWN the Republican party. When your leaders are kissing Trump's ring, and you refuse to renounce and continue to follow those same leaders, you're kissing Trump's ring, too. Do you support with the way your glorious Libe…

>>those people now OWN your precious Libertarian party I see you have confused the Libertarian party with libertarianism they are pretty different >>Do you support with the way your glorious Libertarian leader Rand Paul has attacked and endangered Anthony Fauci's Aside from the complete falsehood of this statement entirly, I do support elected officials grilling non-elected bureaucrats in the manner used by Rand. I a…

And just to be clear: by "grilling" you mean lying about and endangering the families of non-elected bureaucrats for the purposes of political fundraising. You're exhibiting and defending precisely the behavior I mean when I say Libertarians are "self-centered anti-social assholes".

You are not pretty different yourself, since you believe and spread the same conspiracy theories, and support Rand Paul's attack of complete falsehoods against Fauci and his family. Rand Paul's statements were mendacious lies, yet you support him and his lies and threats against Fauci for the sole purpose of fundraising.

I'm glad you don't incorrectly disagree with the fact that most of the arguments proffered against ACA are just lies and racist dog whistles, but I certainly don't agree with you that it's a valid tactic, the ends justify the means, or that using racism and lies and threats and spreading misinformation against people's families to grab power and raise money is in any way ethical or justified, or a "great tactic" and that "misinformation works", as Rand Paul himself says.

https://www.insider.com/old-video-resurfaces-rand-paul-telli...

>An old video has surfaced of Sen. Rand Paul telling students that spreading misinformation is a 'great tactic'.

https://boingboing.net/2022/01/13/watch-rand-paul-tells-stud...

>Watch: Rand Paul tells students "misinformation works" in resurfaced 2013 video

Re: Faker.js is now a community controlled project

#335

Post by encryptluks2 »

mithr wrote: post #229
encryptluks2 wrote: post #60

Earlier quoted context omitted.

Value add in to who? It sounds like you believe open source developers owe something to someone which simply isn't the case. You should evaluate the license(s): THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIA…

Value-add to the people who actually use github to build software, of course. It's fine to discuss license terms and what you should or shouldn't expect when you use github/npm/etc, but in the real-world JS landscape, many projects (commercial and otherwise) use many open-source packages through complex dependency hierarchies. Your can think what you want about whether that's good or bad, but it's unquestionably our…

No one took steps to protect JS projects from malicious updates. They took action in this one case but did not fix the underlying issue which is with package managers.

Re: Faker.js is now a community controlled project

#336

Post by balls187 »

cxr wrote: post #333
balls187 wrote: post #325

Earlier quoted context omitted.

> Instead of adding an infinite loop to purposely sabotage other projects, he should have either walked away or changed the license for future versions of faker into a much more restricted one Then from the context, you can clearly read the comment you responded to did not mention that Makar needed to do anything for him specifically.

> he should have either [done this thing (that I deem would be "acceptable") or this other thing] (This is my last response to you, since you were strawmanning from the beginning and this is obviously not going to go anywhere that doesn't involve intellectual dishonesty dressed up as a clever retort.)

Or ad hominem attacks.

Re: Faker.js is now a community controlled project

#337

Post by syshum »

DonHopkins wrote: post #334
syshum wrote: post #316

Earlier quoted context omitted.

>>those people now OWN your precious Libertarian party I see you have confused the Libertarian party with libertarianism they are pretty different >>Do you support with the way your glorious Libertarian leader Rand Paul has attacked and endangered Anthony Fauci's Aside from the complete falsehood of this statement entirly, I do support elected officials grilling non-elected bureaucrats in the manner used by Rand. I a…

And just to be clear: by "grilling" you mean lying about and endangering the families of non-elected bureaucrats for the purposes of political fundraising. You're exhibiting and defending precisely the behavior I mean when I say Libertarians are "self-centered anti-social assholes". You are not pretty different yourself, since you believe and spread the same conspiracy theories, and support Rand Paul's attack of comp…

>>I'm glad you don't incorrectly disagree with the fact that most of the arguments proffered against ACA

Just because I choose not to respond to all of our unhinged conspiracy laced non-sense claims that everything you disagree with is a dog whistle to racism does not in anyway imply I support said statements. '

I choose not argue with crazy people on the internet, and clearly President Trump broke your mind and I hope for your sake you get professional help.

>> since you believe and spread the same conspiracy theories,

Sorry information released from government records pursuant to a FOIA request is not "conspiracy", I am sure you so biased in favor of your lord and savior (Dr Fauci) that you probably have one of those candles or figurines on your desk devoted to him so you will never believe anything negative however reality does not require your faith.

He is mid rate bureaucrat thrust in the lime light by circumstance and this hero worship of him is insane.

Further at no point did Rand threaten him or his family. The attempt to shift any real or imaged danger there is due to public backlash is a very dangerous game, tell me do you apply the same standard to Democrats who inflame AntiFa and other violent groups? Are these democrat politics to blame for all the violence, riots, etc they "cause" (and to be clear I do not believe they cause it, but you world view dictates we place this violence at their feet, i am judging you by your own standard)

Somehow I bet you will be hypocritical

Re: Faker.js is now a community controlled project

#338

Post by shadowgovt »

encryptluks2 wrote: post #335
mithr wrote: post #229

Earlier quoted context omitted.

Value-add to the people who actually use github to build software, of course. It's fine to discuss license terms and what you should or shouldn't expect when you use github/npm/etc, but in the real-world JS landscape, many projects (commercial and otherwise) use many open-source packages through complex dependency hierarchies. Your can think what you want about whether that's good or bad, but it's unquestionably our…

No one took steps to protect JS projects from malicious updates. They took action in this one case but did not fix the underlying issue which is with package managers.

It is true that there are some vulnerabilities in the standard design for npm package management. Packages are designed to assume by default sources can be trusted and to pull aggressively. That's a system that's very convenient for developers... Assuming somebody doesn't use it in an extremely malicious way by building our trust with a working package and then pushing a change designed to screw users.

Fortunately, it appears the system has been stress tested now and we can see how that damage can be mitigated. If this kind of attack can be minimized by what is essentially moderation and curation, everything's good.

Re: Faker.js is now a community controlled project

#339

Post by feupan »

scrollaway wrote: post #104
feupan wrote: post #47

Earlier quoted context omitted.

Have you read the project’s license? That is literally how it works. It’s not even an original project by Marak, as it’s clearly shown in there. The only fault here is cutting the owner out of the repo, but given the security breach it’s strange that he isn’t permanently banned at all. And yeah, adding an infinite loop is a DoS attack. > not how cloud services work. Try placing a virus on S3 and let me know how that…

I’m not defending the author. GitHub is in their right to do what they did. But certainly not because of the nonsense GP claims. And yes you can host viruses on S3. What you can’t do is use Amazon’s network to do illegal shit (such as distribute viruses without consent).

Obviously I mean to distribute viruses via S3, which is what’s happening here. Your account is guaranteed to be flagged as soon as they find out. The update here was distributed to every subscriber.

Re: Faker.js is now a community controlled project

#340

Post by przemelek »

chaostheory wrote: post #61
przemelek wrote: post #26

Hmm, but as I understand original developer was rather pissed off by situation when devs are working on projects in theirs own time, and those projects sometimes become important tools to lower costs of creating software for big companies, and authors are not getting a dime and are forced to use some kinds of sponsorship and so on.... In such case making one of tools "community" owned smells like some kind of dick mo…

I've already posted this before, but what Marak has done is anything but reasonable. If anyone was being a "dick", it was him. If he just wanted corporations to pay, there are plenty of other alternatives like changing the license for future versions like SugarCRM did. It's been years since they've done that and they have plenty of customers. https://sugarclub.sugarcrm.com/engage/b/sugar-news/posts/sug... Since the d…

To be honest I'm commenting only part with "f.. it I'm not longer working on it", I have ambivalent feelings to "lets change code in such way that builds will go into infinite loop or fail", ambivalent because as it is not nice, but somebody who was a victim of such situation should learn not to add dependencies to newest version, because here was only some small "joke", but it might be something much worse like poisoning whole code with some malicious thing.

Problem is in this that default behavior is "we are not paying for tools", people are looking for free tools to avoid fighting with procurement and everyone seems happy. Only really big companies are giving something back, most is simply leeching from OpenSource community. You are mentioning several ways how this guy was able to collect money, yep, but again changing license would mean that somebody else will fork previous version and thats all.

I'm not saying that this action was super, but for me it is result of problem deep in whole idea of "free libraries" and "free tools", often this all base on some poor guy or gal spending weekends on some project, which at the start was cool and funny, but later becomes burden.

Post reply on HN