Open source ‘protestware’ harms Open Source • Hacker News Board

Re: Open source ‘protestware’ harms Open Source

#141

Post by dragonwriter » Thu, Mar 24, 2022, 2:50 PM UTC

staticelf wrote: post #76

bjt2n3904 wrote: post #18

Earlier quoted context omitted.

I have legitimately argued against using NodeJS as the foundation of our next product for this very reason. NodeJS' culture is very much "move fast and break things", and "all software is political". Look at the TSC drama. Leftpad.js. This isn't an ecosystem that you want to build and maintain a product on.

Basically all big js front ends have the same issue. Most of them had banners or whole pages for the BLM movement which made no sense to anyone outside of the US like myself. I mean a framework or library with a global audience shouldn't push american politics. Vue, React, Preact, Nodejs, Ember (had a whole page and made documentation unavailable for some time), Go lang, ExpressJS (still has the banner up), Typescrip…

> Most of them had banners or whole pages for the BLM movement which made no sense to anyone outside of the US

pretty sure they made sense to quite a few people outside the US:

https://blacklivesmatter.uk/

https://tribunemag.co.uk/2020/06/frances-black-lives-matter-...

https://www.americamagazine.org/politics-society/2020/06/22/...

Re: Open source ‘protestware’ harms Open Source

#142

Post by shkkmo » Thu, Mar 24, 2022, 2:50 PM UTC

ISL wrote: post #83

There is an argument to be made in the opposite direction. One of the key benefits to open source software is the opportunity to inspect the code that you're running... before you run it. At issue here isn't open source as a concept, but rather an emergent ecosystem in that blindly trusts package uploaders not to be malevolent. It points to a need for improved testing coverage. Indeed, since open source is open, it i…

There were deliberate attempts to hide the file deletion payload in obfuscated d code. Running your tests would have resulted in your files being deleted or the test passing and would have done nothing to protect you from this particular instance.

Re: Open source ‘protestware’ harms Open Source

#143

Post by pkulak » Thu, Mar 24, 2022, 2:51 PM UTC

lioeters wrote: post #112

seanw444 wrote: post #4

I just don't understand what the node-ipc dev was expecting when he did that. "Hm, maybe if I put malware into a community-trusted module that destroys files of people in a certain geopolitical region, the countless innocent citizens that are affected will realize what they did wrong! Wait, who am I actually targeting again?"

My guess is that they got caught up in the socially accepted "hate fest" against citizens of a certain country, particularly by private companies.

If a company does business in Russia right now, they are giving money to the Russian government which will be used to kill Ukrainians. Let's not conflate wartime trade policy with Twitter wokeness marketing.

Re: Open source ‘protestware’ harms Open Source

#144

Post by matsemann » Thu, Mar 24, 2022, 2:51 PM UTC

ekianjo wrote: post #122

matsemann wrote: post #99

Earlier quoted context omitted.

How hard is it to just say "I think Russia is wrong for invading Ukraine and killing people"? That's all you have to do. Just write it. If you can't do that, but still want to engage in the discussion on the topic, your standpoint is clear. You're not some holier person not taking a stand. You have taken one, you just don't dare to spell it out.

> If you can't do that, but still want to engage in the discussion on the topic, your standpoint is clear. That's not the topic at hand. The topic is, you don't need to pollute every thing you work on out there with your preachy opinions on every single topic, especially when you are whole-fully ignorant about what's actually happening, the in-and-outs of the conflict, because you are in a state of constant propagand…

You can't blame people for doing whatever they can when they are literally being bombed. Same with BLM mentioned in another subthread, it's easy to don't care when the issues don't affect you, but for other's it's their daily life. Of course it colors what people do.

People who claim there were no politics before, were just oblivious to others' struggle. Which is ok, but it still happened, you were just sheltered or privileged.

Re: Open source ‘protestware’ harms Open Source

#145

Post by ComradePhil » Thu, Mar 24, 2022, 2:52 PM UTC

bjt2n3904 wrote: post #18

commandlinefan wrote: post #5

I'm in Texas. A LOT of Californians disagree with some of the laws that Texas has passed. How long will it be until my hard drive gets reformatted by some protestor in San Francisco who localizes my IP address?

I have legitimately argued against using NodeJS as the foundation of our next product for this very reason. NodeJS' culture is very much "move fast and break things", and "all software is political". Look at the TSC drama. Leftpad.js. This isn't an ecosystem that you want to build and maintain a product on.

That reminded me of the whole Ayo.js thing: https://github.com/ayojs/ayo

The NodeJS community somehow tends to attract the worst kind of people.

Re: Open source ‘protestware’ harms Open Source

#146

Post by 46Bit » Thu, Mar 24, 2022, 2:52 PM UTC

Latty wrote: post #71

slackfan wrote: post #57

Earlier quoted context omitted.

If the intent is to disrupt, why be surprised at people being pissed off about it? Seems like a natural progression of the conversation.

Was anyone surprised people were pissed off?

Indeed, judging by the response it seems like a very successful protest (aside from the reports of lost NGO files.)

Not something I’d have done, but I understand the idea.

Re: Open source ‘protestware’ harms Open Source

#147

Post by ekianjo » Thu, Mar 24, 2022, 2:52 PM UTC

dmos62 wrote: post #118

ekianjo wrote: post #47

> Instead of malware, a better approach to free expression would be to use messages in commit logs to send anti-propaganda messages and to issue trackers to share accurate news inside Russia of what is really happening in Ukraine at the hands of the Russian military, to cite two obvious possibilities How about not taking sides instead of acting like a kid believing one side is black and the other white with absolutel…

> How about not taking sides instead of acting like a kid If you have the power to do something and you don't, that's taking a side. You either oppose something or you enable it. At least own that. If you're saying you're neutral, you either agree with the unpopular side and are scared to admit it, or you can't form an opinion because you're uninformed and thus uncivil, or you feel unaffected by what's happening and…

> If you have the power to do something and you don't, that's taking a side.

Pushing political commit messages is not "power". If you like like everyone around you you are not a rebel, just a conformist.

And using indiscriminate IP-location malware to annoy people is the textbook definition of evil child behavior. I'm not sure what exactly you are trying to defend here.

> By the way, everything is not propaganda: anti-propaganda can just be the truth.

How do you know what the truth is when you have no foot on the ground?

Re: Open source ‘protestware’ harms Open Source

#148

Post by Latty » Thu, Mar 24, 2022, 2:52 PM UTC

shkkmo wrote: post #90

Latty wrote: post #34

Do people think the people protesting like this don't know that this is damaging? They presumably feel that the issue at hand is more important than that damage. Every protest every has been met with "but this protest is being done the wrong way, don't inconvenience me", but that's the point: protest has to disrupt things to make people take notice and make changes. Would I do this? No. I don't think it's effective o…

The problem is that that the node.js filesystem deletion "protests" was an indiscriminate digital attack that harmed people who are doing a much better job of actively opposing the invasion. I believe that the developer who implemented that attack should face criminal charges. Our ability to trust our open source is a critical part of our economy. People who abuse that trust to directly harm others should know they w…

I agree, to some extent. I think it was largely ineffective and poorly targeted protest. The media coverage is not really necessary as it's already highly reported on, and the people harmed have no control over it.

With that said, disruptive protest can be (and often is) illegal. I may think it's justified in some cases, but also if I do something illegal I expect to face legal punishment for it. Some people lay down their lives to protest: to some people committing a crime is a cost worth paying.

Again, my point isn't that I agree with the action, just that the idea that protest should disrupt no one is counter to the whole point of protest.

Re: Open source ‘protestware’ harms Open Source

#149

Post by harry8 » Thu, Mar 24, 2022, 2:52 PM UTC

JumpCrisscross wrote: post #38

harry8 wrote: post #21

Earlier quoted context omitted.

Counter point: if bigcos are so damn stupid they avoid open source & Free software for idiotic reasons that creates space for less stupid startups who will do and be better. Why do we need to save the rich ignorant and prejudiced from themselves? They're not worthy object of charity.

> not worthy object of charity Most people, certainly productive people, are employed by companies. Take an extremist position on who your product works for and you limit the developer pool. An agnostic competitor would be expected to replace you.

It's not an extremist position to say you don't have to do much about big companies feelings about using Free software. You don't have to expend your scarce resources to make them feel comfortable. Note well here I am talking about nothing whatever of substance, this is all pure marketing. If big cos turn from Free software due to prejudice and ignorance about what it is, what it does and how to manage it, rather than riding it like Google, Facebook, Apple etc to untold riches (that were not obtainable to those companies without Free software), that's not any Free software developers' problem.

The GPL, LGPL, BSD, Apache licenses have not changed. A rogue actions by any supplier comes directly under bargaining powers of suppliers in your corporate strategy risk analysis. If it happens you deal with it and you've already thought about it or you have no business in making decisions in a large company. If any big company runs away scared from Free software, bye.

Google literally shot to glory when they went extra hard at using Free software when established big companies were scared. It's not a sufficient condition for their success but it was absolutely a necessary one. They don't get going if they have to pay for operating systems alone.

Re: Open source ‘protestware’ harms Open Source

#150

Post by akagusu » Thu, Mar 24, 2022, 2:52 PM UTC

The problem is not protestware, sabotage, or whatever. The problem is who does it.

Suppose US government did this to sabotage Russia, since it cannot directly act against Russia because it would trigger WWIII. Nobody would care about.

But this guy doing it, or you, or me? No. We are not allowed.