Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open source ‘protestware’ harms Open Source

opensource.org

Post reply on HN
Print view View original

391–400 of 575 posts

Re: Open source ‘protestware’ harms Open Source

#391

Post by whatshisface »

whimsicalism wrote: post #384
whatshisface wrote: post #319

Earlier quoted context omitted.

The simplest explanation is that US companies + media + government is the only group with enough clout to do this, and they will not sanction themselves. It's not like there's a Netherlands invasion of Germany for us to all use as a neutral reference.

I think you are conflating things here. Sure, US govt is not going to sanction itself. But I don't perceive the general populace as being as outraged by lives lost when the US bombs a hospital in Afghanistan as opposed to when Russia bombs a theater in Ukraine.

I would posit that the ratio of the number of people who know about it to the number of people outraged about it is similar in both examples. It's really about which got the 24/7 coverage.

Re: Open source ‘protestware’ harms Open Source

#392

Post by HWR_14 »

baryphonic wrote: post #262

To be honest, I'm annoyed by the benign protestware messages when they start to get in the way of using the software, particularly on mobile. I was looking at the isomorphic git documentation the other day, and noticed that their "#BlackLivesMatter #DefundThePolice" banner scrolls under the rest of the content, leaving this annoying gap that takes up screen real estate, especially in landscape mode on a phone.[0] Wha…

I feel that's because too many people still aren't seeing what their sites look like on mobile devices. I'm sure the perma-banner looked fine on desktop.

Re: Open source ‘protestware’ harms Open Source

#393

Post by grishka »

ahtihn wrote: post #371
grishka wrote: post #77

Earlier quoted context omitted.

As a Russian, you already notice this and you already have many things in your everyday life disrupted. Someone deleting your files as an act of shoving politics where it doesn't belong helps absolutely nothing. If anything, it's not an act of protest, it's an act of vandalism. Causes don't matter here — vandalism is simply never okay.

> vandalism is simply never okay Neither is invading another country. Someone didn't delete the files. You deleted them yourself by blindly trusting 3rd party software that you got for free with no guarantees of anything.

> Neither is invading another country.

Indeed. Except, did I elect this president? No I did not (and elections in Russia are more of an illusion anyway). Can I do something to stop him? No I can't. What's the point of this act then? Putin and his allies don't use npm. This can't affect them by any stretch of imagination.

> Someone didn't delete the files. You deleted them yourself by blindly trusting 3rd party software that you got for free with no guarantees of anything.

Yes, of course, npm is at fault here for downloading untrusted code and running it with no sandboxing whatsoever on behalf of your OS user. This kind of stuff used to be called an RCE vulnerability and used to cause people to issue urgent security patches, but somehow, now it's considered a perfectly normal way of doing things. At the very least, there should be a permission request if this untrusted code tries to access anything outside of the project directory.

Re: Open source ‘protestware’ harms Open Source

#394

Post by mannerheim »

shkkmo wrote: post #378
mannerheim wrote: post #369

Earlier quoted context omitted.

How many Russian cyberattacks on Americans go unpunished by Russia? I don't see any reason for America to bother prosecuting American attacks on Russia as long as Russia isn't prosecuting Russian attacks on Americans.

This wasn't just an attack on Russia and other people's bad behavior doesn't excuse your own.

Whether or not they're excused is orthogonal to whether or not America should prosecute. If Russia doesn't prosecute cyberattacks on Americans, then the logical leverage to get them to do so is to not prosecute American cyberattacks on Russians.

Re: Open source ‘protestware’ harms Open Source

#395

Post by edgyquant »

ocdtrekkie wrote: post #251
edgyquant wrote: post #68

Earlier quoted context omitted.

I don’t think it is understood. Most people who write JavaScript aren’t keeping up with the latest drama. I hadn’t seen any of these political complaints before this thread and I’m a lead engineer on a full stack typescript stack. Not that I have an opinion either way I just don’t think you can reasonably expect devs to keep up with stuff like this.

I think if you pull in code from all sorts of random people across the Internet, you probably absolutely should have some idea what risks that entails, and stay aware of the "latest drama", so you know when running "npm update" is likely to ruin the rest of your day. Of course, the ideal solution is just to not use an ecosystem where pulling in code from all sorts of random people is common.

Hard disagree. Needing to follow the politics of every piece of your tech stack is a ridiculous way of doing things. We should have a system to verify if a module is malicious or not, that’s an engineering problem, politicking about in open source communities is not. Engineers should be engineering things.

Re: Open source ‘protestware’ harms Open Source

#396

Post by BaronVonSteuben »

mrtranscendence wrote: post #313
BaronVonSteuben wrote: post #302

Earlier quoted context omitted.

Yes but pointing out that the emperor has no clothes is mean, so we need to pretend not to notice. Despite our modern day knowledge that most human behavior is almost entirely incentive-based (the hard part is identifying the incentive), we're still supposed to pretend that it's altrusim.

I've experienced too much altruistic, generous, kind behavior to support this cynical view, unless you're defining "incentive" so widely as to be meaningless (sure, some people are incentivized to help others partially because they get good feelings by doing so -- I suppose Ayn Rand was right all along).

I don't think it's cynical at all, I think it's just accepting reality. Our advanced consciousness is just a very thin layer of abstraction on top of the same brain/mind that powers many other animals. Some of the best minds who study this, question if there's even any such thing as "free will" at all.

I don't think recognizing that is conflicting at all with a positive outlook, or the choice to be optimistic, or a humanist, etc. You can choose to believe it or choose not to believe it, and still value human life and try to progress humanity forward.

Also don't underestimate the value/incentive of following your conscience, acting out your beliefs etc. Cognitive dissonance (which results from not doing so) is deeply uncomfortable and a good motivator for being "altruistic."

Re: Open source ‘protestware’ harms Open Source

#397

Post by stjohnswarts »

NoGravitas wrote: post #356
cameronfraser wrote: post #349

Earlier quoted context omitted.

they're virtue signaling, not trying to create change

Would you rather they signal vice?

Rather they signal nothing, to be honest. I mean it is their perogative but makes one think twice about the future of the software. So it's another data point. Not all or nothing. I hate all or nothing types from all sides. 99% of things are on a spectrum and I think that life should be the same. Sure some things are 0 or 1 but they are relatively rare.

Re: Open source ‘protestware’ harms Open Source

#398

Post by yyyk »

FDSGSG wrote: post #339
yyyk wrote: post #291

Earlier quoted context omitted.

I can't agree with these arguments. A) IP geolocation is far from perfect, quite a few completely unrelated people could have been affected. B) There was a chance of massive collateral damage to stuff like hospitals, water company, etc. and therefore affecting civilians, including children. If you think Putin wouldn't use that to rally Russia and launch a massive war, you haven't observed Putin for long. We got very…

> If you think Putin wouldn't use that to rally Russia and launch a massive war, you haven't observed Putin for long. Do you believe that node-ipc would do this but the current vastly more impactful sanctions regime wont? Also, everybody capable of thinking understands that Russia isn't capable of launching another "massive war" when it already has almost all of its conventional combat power committed to Ukraine. If…

>Do you believe that node-ipc would do this but the current vastly more impactful sanctions regime wont?

>There's no other kind of "massive war" he could launch at this point.

Russian society isn't anywhere near enthusiastic. That's why Putin has been searching for ever dumber excuses. Give him an actual indefensible incident to rally society around, and he'll get a lot more manpower. That could expand the war to Odessa and Moldova, and also 'retaliatory' cyberwar in the West.

Now, there's a level of escalation I'm fine with risking - say, over stationing peacekeepers in parts of Ukraine. Stuff that actually helps Ukrainians. But over an self-appointed idiot's personal action which doesn't help anyone and nobody asked for? $#@! no.

>Why not call it software holocaust if we're gonna go there? What's wrong with you?

It's attacking civilians as to influence their government (except Russia is a dictatorship and the government doesn't even care). I have more pointed comparisons in mind, but I'll spare the thread.

Re: Open source ‘protestware’ harms Open Source

#399

Post by michaelt »

kennywinker wrote: post #359
LunaSea wrote: post #292

Earlier quoted context omitted.

So basically virtue signalling

The term “virtue signaling” is a pet peeve of mine. Like the word “problematic” it’s too vague and broad to be useful. The implication seems to usually be that it’s all talk and no action. But if we’re talking, as we are now, that’s completely separate from my actions. Like, if I say “pollution is bad” and don’t do anything in my life to reduce pollution that’s virtue signaling, but it’s not if I’ve dedicated my life…

> The implication seems to usually be that it’s all talk and no action.

That's the implication. But I'm pretty sure the critics would be even angrier if the open source project had taken action.

Re: Open source ‘protestware’ harms Open Source

#400

Post by ocdtrekkie »

edgyquant wrote: post #395
ocdtrekkie wrote: post #251

Earlier quoted context omitted.

I think if you pull in code from all sorts of random people across the Internet, you probably absolutely should have some idea what risks that entails, and stay aware of the "latest drama", so you know when running "npm update" is likely to ruin the rest of your day. Of course, the ideal solution is just to not use an ecosystem where pulling in code from all sorts of random people is common.

Hard disagree. Needing to follow the politics of every piece of your tech stack is a ridiculous way of doing things. We should have a system to verify if a module is malicious or not, that’s an engineering problem, politicking about in open source communities is not. Engineers should be engineering things.

You can not engineer away human problems. I agree that's a ridiculous way of doing things, but it's the only reasonable way to use Node! Which is to say, I think Node is not a great tech stack if you do not want to follow drama.

Adding an antivirus scanner to your Node project is not going to fix this. It certainly hasn't solved the malware issue in the last few decades for PCs.

Post reply on HN