Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open source ‘protestware’ harms Open Source

opensource.org

Post reply on HN
Print view View original

21–30 of 575 posts

Re: Open source ‘protestware’ harms Open Source

#21

Post by harry8 »

Cthulhu_ wrote: post #13
Palomides wrote: post #11

Earlier quoted context omitted.

a disagreeable take: why should open source projects make any effort to be accessible to corporations that will never donate or support them?

Because open source is idealistic and altruistic to a fault; it is the antithesis to "got mine, fuck you", or that of the capitalist "fuck you, pay me". If you limit access to anyone it is, by definition, no longer open source. I mean there's probably plenty of licenses that restrict commercial usage of open source software. That said, I'm all for open source software monetization; include messages in the README, cod…

Counter point: if bigcos are so damn stupid they avoid open source & Free software for idiotic reasons that creates space for less stupid startups who will do and be better. Why do we need to save the rich ignorant and prejudiced from themselves? They're not worthy object of charity.

Re: Open source ‘protestware’ harms Open Source

#22

Post by bnt »

Larrikin wrote: post #15
seanw444 wrote: post #4

I just don't understand what the node-ipc dev was expecting when he did that. "Hm, maybe if I put malware into a community-trusted module that destroys files of people in a certain geopolitical region, the countless innocent citizens that are affected will realize what they did wrong! Wait, who am I actually targeting again?"

Probably hoped the effects would negatively effect people there so they could put pressure to stop the murder of other innocent civilians. Arguments like this are similar to the BLM protest that try to equate property with human lives.

Or, you know, I’ll never touch Vue.js again?

Re: Open source ‘protestware’ harms Open Source

#23

Post by spamizbad »

While I am personally disgusted with what transpired with node-ipc and am also completely gutted and outraged at Russias violent invasion of Ukraine - I don’t like the idea of us trying to “tone police” open source projects. If some idiot maintainer wants to pull a stupid stunt like that they should have the right to do so. In my view it’s the software equivalent of “hate speech” which, while vile, should be protected.

This could quickly devolve into a nasty slippery slope where people who simply disagree with a direction of an open source project try to strip it of its licenses or eject it from various package managers.

Re: Open source ‘protestware’ harms Open Source

#24

Post by cyberpunk »

jraph wrote: post #10

npm install is such a scary command these days (or yarn install, same thing). I never liked it because of the shitload of dependencies it usually pulls but now I would hesitate running it outside a well isolated container. This event added to the strong distrust I came to have on NPM these last months. The NPM ecosystem seems incredibly immature and unreliable and any Javascript project depending on NPM is now a pote…

> In theory the same things could happen for PIP, Maven, Gradle, their Rust and Go counterpart and any such package manager. Any data on this?

Supply chain attacks, such as these, can definitely happen to any language. NPM seems to be a nice target simply because the volume of deps your avg 'simple' node project has (I mean, 'npm generate'ing a simple strapi-backed static site for us and there's ~300mb of node_modules...).

There's not really a cure. You can peg your deps to a version, but with that much code in there, you're never going to really know if that version is compromised.

If you can come up with a solution, there's money to be made..

Edit: The best we really have atm is just scanning for known vulns with stuff like xray/lifecycle/dependabot. Better than nothing, but for sure there are malicious packages out there yet to be discovered.

Re: Open source ‘protestware’ harms Open Source

#26

Post by JumpCrisscross »

> harms peacemakers as much as the warmongers—even ethical hackers using a VPN to work against the invasion might become collateral damage

This line of criticism could be blunted by targeting government IP blocks. Would that make it okay? (I don’t think so. But it’s less black and white.)

Re: Open source ‘protestware’ harms Open Source

#27

Post by smoldesu »

jraph wrote: post #10

npm install is such a scary command these days (or yarn install, same thing). I never liked it because of the shitload of dependencies it usually pulls but now I would hesitate running it outside a well isolated container. This event added to the strong distrust I came to have on NPM these last months. The NPM ecosystem seems incredibly immature and unreliable and any Javascript project depending on NPM is now a pote…

> In theory the same things could happen for PIP, Maven, Gradle, their Rust and Go counterpart and any such package manager. Any data on this?

Rust employs version locking for it's builds, so you'll only be able to propagate malware with it if:

0. The developer's cargo definition auto-grabs the latest dependencies (trust me, very few do this)

1. The developer has deliberately updated the version of their dependency

2. The developer doesn't notice any significant changes when debugging/staging the new release

3. The package passed through testing without identifying any malware or malicious changes

In theory, it's possible to distribute malware with Rust's dependency system, but doing so would be pretty difficult. I'd say there's some pretty good roadblocks in place to prevent it from happening.

Re: Open source ‘protestware’ harms Open Source

#28

Post by gruez »

Larrikin wrote: post #15
seanw444 wrote: post #4

I just don't understand what the node-ipc dev was expecting when he did that. "Hm, maybe if I put malware into a community-trusted module that destroys files of people in a certain geopolitical region, the countless innocent citizens that are affected will realize what they did wrong! Wait, who am I actually targeting again?"

Probably hoped the effects would negatively effect people there so they could put pressure to stop the murder of other innocent civilians. Arguments like this are similar to the BLM protest that try to equate property with human lives.

>Arguments like this are similar to the BLM protest that try to equate property with human lives.

Yeah, but the problem with this is that, taken to its logical conclusion, you end up with a nihilistic view that's basically "do you support The Cause? if yes then any protest action is acceptable, if no then any minor transgression should be cracked down by law enforcement". This works especially well when The Cause is something that could plausibly affect tens of millions of people, so you can excuse quite a lot of damage.

Re: Open source ‘protestware’ harms Open Source

#29

Post by JumpCrisscross »

bnt wrote: post #22
Larrikin wrote: post #15

Earlier quoted context omitted.

Probably hoped the effects would negatively effect people there so they could put pressure to stop the murder of other innocent civilians. Arguments like this are similar to the BLM protest that try to equate property with human lives.

Or, you know, I’ll never touch Vue.js again?

Charitably, it creates a new friction for Russian business in deploying open-source software. That drag further diminishes Russia’s economy, and thus, its warmaking ability.

Re: Open source ‘protestware’ harms Open Source

#30

Post by extheat »

bjt2n3904 wrote: post #18
commandlinefan wrote: post #5

I'm in Texas. A LOT of Californians disagree with some of the laws that Texas has passed. How long will it be until my hard drive gets reformatted by some protestor in San Francisco who localizes my IP address?

I have legitimately argued against using NodeJS as the foundation of our next product for this very reason. NodeJS' culture is very much "move fast and break things", and "all software is political". Look at the TSC drama. Leftpad.js. This isn't an ecosystem that you want to build and maintain a product on.

So you’re basically saying, don’t use X tool chain because the 3rd party software doesn’t move on your pace? Or they have different “views” than yours? I don’t see how that makes any sense. Why do you have to be beholden 3rd party developers and the pace they work at?
Post reply on HN