Open source ‘protestware’ harms Open Source • Hacker News Board

Re: Open source ‘protestware’ harms Open Source

#171

Post by slackfan » Thu, Mar 24, 2022, 2:58 PM UTC

TeeMassive wrote: post #101

spamizbad wrote: post #23

While I am personally disgusted with what transpired with node-ipc and am also completely gutted and outraged at Russias violent invasion of Ukraine - I don’t like the idea of us trying to “tone police” open source projects. If some idiot maintainer wants to pull a stupid stunt like that they should have the right to do so. In my view it’s the software equivalent of “hate speech” which, while vile, should be protecte…

This is a false comparison. Speech is not software in the sense it can't harm critical infrastructure as malicious software can. And by the way, malicious code violates most OSS licenses because they are not made "in the hope that it will be useful".

The modern OSS scene where people file DMCA notices and other legal actions against forks because, well, because, does not jive with that view.

Re: Open source ‘protestware’ harms Open Source

#172

Post by shkkmo » Thu, Mar 24, 2022, 2:58 PM UTC

akagusu wrote: post #150

The problem is not protestware, sabotage, or whatever. The problem is who does it. Suppose US government did this to sabotage Russia, since it cannot directly act against Russia because it would trigger WWIII. Nobody would care about. But this guy doing it, or you, or me? No. We are not allowed.

> Suppose US government did this to sabotage Russia, since it cannot directly act against Russia because it would trigger WWIII. Nobody would care about.

I would care even more about it. I absolutely don't want our government destroying trust in open source in such a fashion.

Re: Open source ‘protestware’ harms Open Source

#173

Post by ekianjo » Thu, Mar 24, 2022, 2:58 PM UTC

matsemann wrote: post #144

ekianjo wrote: post #122

Earlier quoted context omitted.

> If you can't do that, but still want to engage in the discussion on the topic, your standpoint is clear. That's not the topic at hand. The topic is, you don't need to pollute every thing you work on out there with your preachy opinions on every single topic, especially when you are whole-fully ignorant about what's actually happening, the in-and-outs of the conflict, because you are in a state of constant propagand…

You can't blame people for doing whatever they can when they are literally being bombed. Same with BLM mentioned in another subthread, it's easy to don't care when the issues don't affect you, but for other's it's their daily life. Of course it colors what people do. People who claim there were no politics before, were just oblivious to others' struggle. Which is ok, but it still happened, you were just sheltered or…

> You can't blame people for doing whatever they can when they are literally being bombed.

I can't remember when people cared about the bombs falling everyday in Yemen. How absurd is it for people to suddenly care and cry publicly about one country's conflict while another much bloodier one, not too far away, is being completely ignored. Is their blood less red? Are their children worth less? Systemic racism maybe, since these are not white people?

Mass media (including social media nowadays) is what shapes what people care and feel concerned about. It's not about people's values, this goes on to say a lot more about how easy people can be manipulated to project violence onto anything they had no clue about 5 minutes ago, as long as you repeat it all day long.

Re: Open source ‘protestware’ harms Open Source

#174

Post by kekebo » Thu, Mar 24, 2022, 2:58 PM UTC

Could (/should) this be mitigated on the repository host side by scanning for and flagging malicious commits?

A paper from last year evaluating this on Github achieves a ~50% success rate[0].

Given Github already training ml models across all repositories for Copilot I would guess higher rates would be possible.

[0] https://arxiv.org/abs/2103.03846

Edit: add link

Re: Open source ‘protestware’ harms Open Source

#175

Post by devmunchies » Thu, Mar 24, 2022, 2:58 PM UTC

bjt2n3904 wrote: post #18

commandlinefan wrote: post #5

I'm in Texas. A LOT of Californians disagree with some of the laws that Texas has passed. How long will it be until my hard drive gets reformatted by some protestor in San Francisco who localizes my IP address?

I have legitimately argued against using NodeJS as the foundation of our next product for this very reason. NodeJS' culture is very much "move fast and break things", and "all software is political". Look at the TSC drama. Leftpad.js. This isn't an ecosystem that you want to build and maintain a product on.

I’ll be using Deno for new projects from now on.

Re: Open source ‘protestware’ harms Open Source

#176

Post by ComradePhil » Thu, Mar 24, 2022, 2:59 PM UTC

I think there needs to be a counter effort against these people. Some entity like the EFF should maintain a database of people who have engaged in protestware so that there can exist APIs which will check for whether any of your dependencies come from these blacklisted people... or if you are about to hire them.

Re: Open source ‘protestware’ harms Open Source

#177

Post by duxup » Thu, Mar 24, 2022, 2:59 PM UTC

Latty wrote: post #34

Do people think the people protesting like this don't know that this is damaging? They presumably feel that the issue at hand is more important than that damage. Every protest every has been met with "but this protest is being done the wrong way, don't inconvenience me", but that's the point: protest has to disrupt things to make people take notice and make changes. Would I do this? No. I don't think it's effective o…

I don't know what the next step is after "I've deleted your files... now listen to what I have to say."

That makes no sense. It sounds more like an excuse for acting out.

Re: Open source ‘protestware’ harms Open Source

#178

Post by KyeRussell » Thu, Mar 24, 2022, 2:59 PM UTC

staticelf wrote: post #76

bjt2n3904 wrote: post #18

Earlier quoted context omitted.

I have legitimately argued against using NodeJS as the foundation of our next product for this very reason. NodeJS' culture is very much "move fast and break things", and "all software is political". Look at the TSC drama. Leftpad.js. This isn't an ecosystem that you want to build and maintain a product on.

Basically all big js front ends have the same issue. Most of them had banners or whole pages for the BLM movement which made no sense to anyone outside of the US like myself. I mean a framework or library with a global audience shouldn't push american politics. Vue, React, Preact, Nodejs, Ember (had a whole page and made documentation unavailable for some time), Go lang, ExpressJS (still has the banner up), Typescrip…

Again, you’re calling this “political” because it doesn’t matter to you, and it certainly sounds like it doesn’t personally affect you. To other people, BLM is a serous existential threat. You’d lose your mind if someone chalked the question of your existence up to “politics”. You’re really showing your hand. And no, I’m not American either, but that doesn’t somehow make me blind to the fact that BLM is a big deal.

Re: Open source ‘protestware’ harms Open Source

#179

Post by shadowgovt » Thu, Mar 24, 2022, 2:59 PM UTC

cpitman wrote: post #6

100%. I've already seen articles in non-tech media that explain what happened to a non-technical audience, and the explanation sounded a lot like open source is the problem and that proprietary software would never have these problems. It wasn't that long ago that using open source software required a lot of politicking inside my clients, and we could easily go back there with enough spooked executives.

It strikes me as kind of an odd position that given political advocacy in open source software, closed source would be safer.

Proprietary software provided by a single vendor is much easier for a government to lock down via actual sanctions. Hypothetically, they can outlaw your company doing business with that vendor.

Re: Open source ‘protestware’ harms Open Source

#180

Post by slackfan » Thu, Mar 24, 2022, 2:59 PM UTC

slackfan wrote: post #160

beaconstudios wrote: post #153

Earlier quoted context omitted.

not every politics-adjacent thread needs to devolve into "the wokes are coming for us all". You can disagree with the actions of progressives without making it this all-encompassing threat. Hell, I'm pretty left-wing and I'm fairly critical of some of the factions. Either way, I can't see anybody putting "must add a BLM banner to their website" to the licensing conditions of their FOSS code.

That would be a wonderful thing to able be do, if the woke brigade wasn't screaming "YOU'RE WITH US OR YOU'RE AGAINST US" a parent over. ;) Ignoring that isn't an option, unfortunately, believe me, that's been tried.

>yeah but so what

Being silent about shitty behavior is the same as condoning it, don't you know? Just because you don't like the playbook doesn't mean it doesn't work.

>Anybody who legitimately makes a "liberals only" stand in their license will get forked and their usage will drop off.

Considering that the developer just pulled a "no russians" stand with their software...