Open source ‘protestware’ harms Open Source
opensource.org
Open source ‘protestware’ harms Open Source
1–10 of 575 posts
Re: Open source ‘protestware’ harms Open Source
#2[dead]
Re: Open source ‘protestware’ harms Open Source
#3No post body was provided.
Re: Open source ‘protestware’ harms Open Source
#4I just don't understand what the node-ipc dev was expecting when he did that.
"Hm, maybe if I put malware into a community-trusted module that destroys files of people in a certain geopolitical region, the countless innocent citizens that are affected will realize what they did wrong! Wait, who am I actually targeting again?"
Re: Open source ‘protestware’ harms Open Source
#5I'm in Texas. A LOT of Californians disagree with some of the laws that Texas has passed. How long will it be until my hard drive gets reformatted by some protestor in San Francisco who localizes my IP address?
Re: Open source ‘protestware’ harms Open Source
#6100%. I've already seen articles in non-tech media that explain what happened to a non-technical audience, and the explanation sounded a lot like open source is the problem and that proprietary software would never have these problems.
It wasn't that long ago that using open source software required a lot of politicking inside my clients, and we could easily go back there with enough spooked executives.
Re: Open source ‘protestware’ harms Open Source
#7I'm in Texas. A LOT of Californians disagree with some of the laws that Texas has passed. How long will it be until my hard drive gets reformatted by some protestor in San Francisco who localizes my IP address?
The only good news I have for you is that _perhaps_ in that case the FBI and CISA will investigate, because there will be a US resident victim.
IP-based geolocation is garbage but there aren't many Russian/Belarusian-attributed IPs in the US so the intersection of those with people using node-ipc was empty, and the US Government couldn't be pressured to investigate/enforce.
Re: Open source ‘protestware’ harms Open Source
#8Open source malware? That's a new one!
Re: Open source ‘protestware’ harms Open Source
#9I'm in Texas. A LOT of Californians disagree with some of the laws that Texas has passed. How long will it be until my hard drive gets reformatted by some protestor in San Francisco who localizes my IP address?
The only good news I have for you is that _perhaps_ in that case the FBI and CISA will investigate, because there will be a US resident victim. IP-based geolocation is garbage but there aren't many Russian/Belarusian-attributed IPs in the US so the intersection of those with people using node-ipc was empty, and the US Government couldn't be pressured to investigate/enforce.
No post body was provided.
Re: Open source ‘protestware’ harms Open Source
#10npm install is such a scary command these days (or yarn install, same thing). I never liked it because of the shitload of dependencies it usually pulls but now I would hesitate running it outside a well isolated container.
This event added to the strong distrust I came to have on NPM these last months. The NPM ecosystem seems incredibly immature and unreliable and any Javascript project depending on NPM is now a potential future malware.
By the way, does anyone know an easy way to use Svelte without depending on NPM? Because if not I might reconsider my choice of using it in a side project despite me liking it.
In theory the same things could happen for PIP, Maven, Gradle, their Rust and Go counterpart and any such package manager. Any data on this?