Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open source ‘protestware’ harms Open Source

opensource.org

Post reply on HN
Print view View original

111–120 of 575 posts

Re: Open source ‘protestware’ harms Open Source

#111

Post by dspillett »

alexb_ wrote: post #53
cestith wrote: post #12

Bram Moolenaar famously uses Vim to raise awareness. A VPN package, dead drop website, steganography package, onion router, multi-point P2P routing mesh drivers, or other software and education on how to use them could really make a difference for dissidents. There are certainly productive ways to use software to support protests, organizing, workers' strikes, or even support targeted sabotage or insurrections withou…

He uses it to help starving children by including a message on startup. That's a little more agreeable and less political than all of the things you listed. To try and compare it is fucking absurd.

> That's a little more agreeable and less political

I don't think the difference is the message and how political it might be, but the way the message is delivered.

A message, or even refusing to run¹, is completely different to deleting or corrupting data.

[1] though unless that is very precisely targetted I'd still think it a step too far.

Re: Open source ‘protestware’ harms Open Source

#112

Post by lioeters »

seanw444 wrote: post #4

I just don't understand what the node-ipc dev was expecting when he did that. "Hm, maybe if I put malware into a community-trusted module that destroys files of people in a certain geopolitical region, the countless innocent citizens that are affected will realize what they did wrong! Wait, who am I actually targeting again?"

My guess is that they got caught up in the socially accepted "hate fest" against citizens of a certain country, particularly by private companies.

Re: Open source ‘protestware’ harms Open Source

#113

Post by stonemetal12 »

smoldesu wrote: post #27
jraph wrote: post #10

npm install is such a scary command these days (or yarn install, same thing). I never liked it because of the shitload of dependencies it usually pulls but now I would hesitate running it outside a well isolated container. This event added to the strong distrust I came to have on NPM these last months. The NPM ecosystem seems incredibly immature and unreliable and any Javascript project depending on NPM is now a pote…

> In theory the same things could happen for PIP, Maven, Gradle, their Rust and Go counterpart and any such package manager. Any data on this? Rust employs version locking for it's builds, so you'll only be able to propagate malware with it if: 0. The developer's cargo definition auto-grabs the latest dependencies (trust me, very few do this) 1. The developer has deliberately updated the version of their dependency 2…

The only real change from the NPM case is speed of distribution of the end results, users don't need to consciously update. NPM has package and package-lock just like there is cargo and cargo-lock, so devs are just as in control of the dependency versions they are shipping.

Re: Open source ‘protestware’ harms Open Source

#114

Post by ep103 »

edgyquant wrote: post #68
young_unixer wrote: post #43

On one hand, I don't want to be anywhere near protestware when it comes to my work or the tools I use. On the other hand, Javascript developers have a whole different culture than the developer circles I like to frequent. In npm-land, the societal expectations of quality and solemnity (for lack of a better word) are lower, and this kind of behaviour is even celebrated if it favors the "right cause". The last two case…

I don’t think it is understood. Most people who write JavaScript aren’t keeping up with the latest drama. I hadn’t seen any of these political complaints before this thread and I’m a lead engineer on a full stack typescript stack. Not that I have an opinion either way I just don’t think you can reasonably expect devs to keep up with stuff like this.

I think keeping up on things like this is the bare minimum expectation I would have of any lead developer worth his or her salt, because keeping up on things like this is a fundamental aspect of knowing the technological ecosystem in which you claim to have the skills and knowledge in which to make decisions about things like which technical ecosystem your entire team should be using.

Whether or not most engineers _do_ keep up on things like this, is a different question. But that's why there's a large range in salaries for similar positions across our industry.

Re: Open source ‘protestware’ harms Open Source

#115

Post by rectang »

PartiallyTyped wrote: post #36
Cthulhu_ wrote: post #13

Earlier quoted context omitted.

Because open source is idealistic and altruistic to a fault; it is the antithesis to "got mine, fuck you", or that of the capitalist "fuck you, pay me". If you limit access to anyone it is, by definition, no longer open source. I mean there's probably plenty of licenses that restrict commercial usage of open source software. That said, I'm all for open source software monetization; include messages in the README, cod…

Part of being idealistic is standing up for what is right but without causing more harm than necessary. > If you limit access to anyone it is, by definition, no longer open source Licensing disagrees. Not everything opensource is permissive.

I'm pretty sure the reference is just to the "no discrimination against people/groups/fields-of-endeavor" ethos. See OSI's Open Source Definition clauses 5 and 6. https://opensource.org/osd

Re: Open source ‘protestware’ harms Open Source

#116

Post by lucasmullens »

staticelf wrote: post #76
bjt2n3904 wrote: post #18

Earlier quoted context omitted.

I have legitimately argued against using NodeJS as the foundation of our next product for this very reason. NodeJS' culture is very much "move fast and break things", and "all software is political". Look at the TSC drama. Leftpad.js. This isn't an ecosystem that you want to build and maintain a product on.

Basically all big js front ends have the same issue. Most of them had banners or whole pages for the BLM movement which made no sense to anyone outside of the US like myself. I mean a framework or library with a global audience shouldn't push american politics. Vue, React, Preact, Nodejs, Ember (had a whole page and made documentation unavailable for some time), Go lang, ExpressJS (still has the banner up), Typescrip…

> The funny thing is, now when Russia has invaded Ukraine there is no banners on the same websites so it's obvious some lives matters more than others in their views..

Supporting one issue publicly does not mean you think it's more important than every issue you don't support publicly.

Re: Open source ‘protestware’ harms Open Source

#117

Post by unethical_ban »

ksec wrote: post #104
commandlinefan wrote: post #5

I'm in Texas. A LOT of Californians disagree with some of the laws that Texas has passed. How long will it be until my hard drive gets reformatted by some protestor in San Francisco who localizes my IP address?

You pretty much summarise what is wrong with the title. It is not "Protestware" that harms open source. It is politics and ideology harms open source. And the rate things are going may be Open Source will not only be split between permissive and copyleft, but progressive and libreRight. Edit: Now I remember Douglas Crockford's "The Software shall be used for Good, not Evil." license. I wonder if there are still any o…

It isn't ideology, it's malware for political purposes.

https://xkcd.com/605/

No, at the rate things are going, OSS will not be as you describe.

Re: Open source ‘protestware’ harms Open Source

#118

Post by dmos62 »

ekianjo wrote: post #47

> Instead of malware, a better approach to free expression would be to use messages in commit logs to send anti-propaganda messages and to issue trackers to share accurate news inside Russia of what is really happening in Ukraine at the hands of the Russian military, to cite two obvious possibilities How about not taking sides instead of acting like a kid believing one side is black and the other white with absolutel…

> How about not taking sides instead of acting like a kid

If you have the power to do something and you don't, that's taking a side. You either oppose something or you enable it. At least own that. If you're saying you're neutral, you either agree with the unpopular side and are scared to admit it, or you can't form an opinion because you're uninformed and thus uncivil, or you feel unaffected by what's happening and thus discompassionate. Either way, that's pretty much the definition of "acting like a kid".

By the way, everything is not propaganda: anti-propaganda can just be the truth.

Re: Open source ‘protestware’ harms Open Source

#119

Post by mannykannot »

The broader issue here is the security problem that this article highlights, which was present before the invasion. If the thesis of this article is correct now, it was correct then, and will continue to be correct. Even if you could put the cat back in the bag, we would still have the cat.

Re: Open source ‘protestware’ harms Open Source

#120

Post by XorNot »

A4ET8a8uTh0 wrote: post #55
commandlinefan wrote: post #5

I'm in Texas. A LOT of Californians disagree with some of the laws that Texas has passed. How long will it be until my hard drive gets reformatted by some protestor in San Francisco who localizes my IP address?

I have long argued that there are things that should remain agnostic of politics ( as hard it may sometimes be ). This trend is genuinely destructive to opensource and I can't help but wonder if it is not done to undermine it by design.

No post body was provided.
Post reply on HN