Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open source ‘protestware’ harms Open Source

opensource.org

Post reply on HN
Print view View original

61–70 of 575 posts

Re: Open source ‘protestware’ harms Open Source

#61

Post by slackfan »

rsstack wrote: post #7
commandlinefan wrote: post #5

I'm in Texas. A LOT of Californians disagree with some of the laws that Texas has passed. How long will it be until my hard drive gets reformatted by some protestor in San Francisco who localizes my IP address?

The only good news I have for you is that _perhaps_ in that case the FBI and CISA will investigate, because there will be a US resident victim. IP-based geolocation is garbage but there aren't many Russian/Belarusian-attributed IPs in the US so the intersection of those with people using node-ipc was empty, and the US Government couldn't be pressured to investigate/enforce.

Putting such trust in state actors in the year 2022 seems optimistic to the point of naievety.

Re: Open source ‘protestware’ harms Open Source

#62

Post by spicybright »

It sucks because it only targets individuals, not companies that have actual power to change things.

A big site has production, testing, dev servers spun up by docker or whatever. So to fix this you just need to roll back the node package version and redeploy.

A person learning code/developing locally now just lost everything.

Re: Open source ‘protestware’ harms Open Source

#63

Post by gruez »

nsxwolf wrote: post #17
commandlinefan wrote: post #5

I'm in Texas. A LOT of Californians disagree with some of the laws that Texas has passed. How long will it be until my hard drive gets reformatted by some protestor in San Francisco who localizes my IP address?

Quoted post unavailable.

I think this recent comment is relevant here:

>I don't want to hear anyone in this country [the US] complain about the Electoral College or gerrymandering the next time we decide to pull another Iraq War but they're opposed to it.

>Just like, overthrow the government - it's so easy!

>And if you don't have the guts - well, don't be mad when someone deletes all your files, you collaborator!

https://news.ycombinator.com/item?id=30727720

Re: Open source ‘protestware’ harms Open Source

#64

Post by slackfan »

naoqj wrote: post #48
commandlinefan wrote: post #5

I'm in Texas. A LOT of Californians disagree with some of the laws that Texas has passed. How long will it be until my hard drive gets reformatted by some protestor in San Francisco who localizes my IP address?

Quoted post unavailable.

In a perfect world, everybody's hard drive gets reformatted.

Re: Open source ‘protestware’ harms Open Source

#65

Post by grishka »

jraph wrote: post #10

npm install is such a scary command these days (or yarn install, same thing). I never liked it because of the shitload of dependencies it usually pulls but now I would hesitate running it outside a well isolated container. This event added to the strong distrust I came to have on NPM these last months. The NPM ecosystem seems incredibly immature and unreliable and any Javascript project depending on NPM is now a pote…

> Maven, Gradle

It's very uncommon to specify the "latest" version in Java package managers. The capability is there, but everyone always specifies something exact. And there aren't nearly as many transitive dependencies. Many popular Java libraries don't have any dependencies at all. And, at least on Maven Central, you can't overwrite an already released version of a package, you can only add a new one.

Re: Open source ‘protestware’ harms Open Source

#66

Post by potta_coffee »

cyberpunk wrote: post #24
jraph wrote: post #10

npm install is such a scary command these days (or yarn install, same thing). I never liked it because of the shitload of dependencies it usually pulls but now I would hesitate running it outside a well isolated container. This event added to the strong distrust I came to have on NPM these last months. The NPM ecosystem seems incredibly immature and unreliable and any Javascript project depending on NPM is now a pote…

> In theory the same things could happen for PIP, Maven, Gradle, their Rust and Go counterpart and any such package manager. Any data on this? Supply chain attacks, such as these, can definitely happen to any language. NPM seems to be a nice target simply because the volume of deps your avg 'simple' node project has (I mean, 'npm generate'ing a simple strapi-backed static site for us and there's ~300mb of node_module…

It can be a problem in any language or package manager but in my Golang project, I have a single dependency outside of the standard library, in my Javascript project I conservatively have 200+ (if I consider all the packages installed by my primary dependencies). The surface area is just that much bigger and the packages change so frequently.

Re: Open source ‘protestware’ harms Open Source

#67

Post by scohesc »

It's eye-opening to see the amount of unexpected changes we're going to go through as a result of the west deciding to completely remove an entire country from their economic systems and encouraging/allowing their citizens to harass the (mostly innocent) populace trying to just survive.

I don't like how open source is being co-opted by people supporting _ANY_ political ideology or belief to cause harm to other people around the world. It's not _your_ code, so why are people openly advocating to modify it to cause harm to others?

It's a net negative all around, in my mind.

Re: Open source ‘protestware’ harms Open Source

#68

Post by edgyquant »

young_unixer wrote: post #43

On one hand, I don't want to be anywhere near protestware when it comes to my work or the tools I use. On the other hand, Javascript developers have a whole different culture than the developer circles I like to frequent. In npm-land, the societal expectations of quality and solemnity (for lack of a better word) are lower, and this kind of behaviour is even celebrated if it favors the "right cause". The last two case…

I don’t think it is understood. Most people who write JavaScript aren’t keeping up with the latest drama. I hadn’t seen any of these political complaints before this thread and I’m a lead engineer on a full stack typescript stack. Not that I have an opinion either way I just don’t think you can reasonably expect devs to keep up with stuff like this.

Re: Open source ‘protestware’ harms Open Source

#69

Post by _Nat_ »

ekianjo wrote: post #47

> Instead of malware, a better approach to free expression would be to use messages in commit logs to send anti-propaganda messages and to issue trackers to share accurate news inside Russia of what is really happening in Ukraine at the hands of the Russian military, to cite two obvious possibilities How about not taking sides instead of acting like a kid believing one side is black and the other white with absolutel…

A lot of folks are just anti-war and are protesting the invasion for being an act of military-aggression.
Post reply on HN