Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

So what’s next (personal news from developer of popular CoreJS polyfill)

github.com

Post reply on HN
Print view View original

291–300 of 348 posts

Re: So what’s next (personal news from developer of popular CoreJS polyfill)

#291

Post by modestmc »

ufmace wrote: post #261
modestmc wrote: post #123

Earlier quoted context omitted.

I know far too well how you feel, happy you found what you’ve been missing. Out of curiosity, what did you remember about the link that you tried searching for? Do you remember when you last saw it? [insert semicoherent hopium about ChatGPT as a magical panacea here]

I remembered it as an article where a guy semi-jokingly claimed to have hacked most of the web through a supply-chain exploit and listed off a ton of clever things he did to evade all of the immediately obvious ways to notice that such a thing was happening. Pretty sure I saw it here on HN originally, but I couldn't come up with any search terms to find it in Google, Bing, DDG, HN Angolia search, etc.

The author said he updated the article, so if the link changed then maybe; however, I can tell you somebody definitely reposted it last night and it got almost 100 points. Too funny.

I assume you tried punching in keywords like “fake NPM package hack” or something like that?

Re: So what’s next (personal news from developer of popular CoreJS polyfill)

#292

Post by edude03 »

ricardobeat wrote: post #201
DanHulton wrote: post #115

Earlier quoted context omitted.

The idea that they _don't_ pay for it is wild, honestly. There's no FOSS equivalent in so many other industries - they pay for every part of their supply chain and yet still somehow make a profit. You can't open a hotdog stand and use "FOSS hotdogs". The whole point of the post is that the FOSS model doesn't work and that sucks. I don't know what the answer to that is, and neither does he, but the answer certainly is…

But who said the FOSS model doesn't work? It's been working for decades. Having a well-paid, full-time job as an OSS maintainer is what doesn't work - it's the equivalent of becoming a celebrity, not achievable for 99% regardless of effort.

I mean it's clearly not working for this guy.

But seriously, depends on your definition of "works". It works for large companies, doesn't seem to work for anyone else. It seems the only opensource that "works" is when large companies are nice enough to open source and maintain something that is accidentally useful to someone else (IE, never the crown jewels obviously) otherwise you mostly hear stories of harassment and burn out.

Re: So what’s next (personal news from developer of popular CoreJS polyfill)

#293

Post by chrisshroba »

lobocinza wrote: post #280
EugeneOZ wrote: post #134

Earlier quoted context omitted.

HN is a little bit more “filtered” place: on Reddit and Twitter there are enough people who hate him just for the sake of hatred. He is Russian - they call him “fascist”. He has a road accident - they are intentionally omitting a little detail that a victim was crawling the road at night. I didn't know about the memes and Twitter jokes. Even after that post, people still try to blame him. I’m pretty sure this situati…

> a victim was crawling the road at night Is that verifiable? Because... > In November 2019, Denis Pushkarev, maintainer of the popular core-js library, lost an appeal to overturn an 18-month prison sentence imposed for driving his motorcycle into two pedestrians, killing one of them. https://www.theregister.com/2020/03/26/corejs_maintainer_jai... Unfortunately Russia judiciary system is far from ideal and fair but b…

> better to trust that system than to take his word as truth.

What? Why would that be better? Absent more information I'd rather assume innocence until proven guilty.

Re: So what’s next (personal news from developer of popular CoreJS polyfill)

#294

Post by newswasboring »

throwaway290 wrote: post #267
newswasboring wrote: post #227

Earlier quoted context omitted.

... This guy wasn't able to find an employer like that, no?

Did he look though? Maybe he is not aware this is a possibility. Even if he cannot leave Russia there are likely russian companies that would pay him and be even happy if he contributes to OSS. I know Qiwi, Yandex publish and maintain packages

Yeah but if the statement is a guy like this could find something like this, then the answer is no. I think mostly because it's not entirely clear how to get such a job and how to do that job without handing over the reigns of your project to the company.

Re: So what’s next (personal news from developer of popular CoreJS polyfill)

#295

Post by [deleted] »

chrisshroba wrote: post #293
lobocinza wrote: post #280

Earlier quoted context omitted.

> a victim was crawling the road at night Is that verifiable? Because... > In November 2019, Denis Pushkarev, maintainer of the popular core-js library, lost an appeal to overturn an 18-month prison sentence imposed for driving his motorcycle into two pedestrians, killing one of them. https://www.theregister.com/2020/03/26/corejs_maintainer_jai... Unfortunately Russia judiciary system is far from ideal and fair but b…

> better to trust that system than to take his word as truth. What? Why would that be better? Absent more information I'd rather assume innocence until proven guilty.

[deleted]

Re: So what’s next (personal news from developer of popular CoreJS polyfill)

#296

Post by runnerup »

robflynn wrote: post #43
karaterobot wrote: post #7

In my unasked-for opinion, he should absolutely give up on this project, and take a salaried job that'll let him support his family and not have to deal with the entitlement issues and lack of perspective the community evidently has. If half of what's in this post is true, he's shown admirable restraint: I'd have burned it all down the first time someone got pissy about a free thing I gave them.

The open source community can be wild sometimes. Back when I was still maintainer and lead dev for Gaim (not Pidgin), I would occasionally get downright hateful people e-mailing me for not implementing whatever feature they thought needed to be implemented, or not getting it implemented quickly enough. One guy managed to get ahold of my cell phone number somehow and called me at 4am to discuss "his ideas" with me for…

Gaim was an amazing help in my life at the time. Huge thank you.

Re: So what’s next (personal news from developer of popular CoreJS polyfill)

#297

Post by runnerup »

Jcowell wrote: post #180
sgammon wrote: post #174

Earlier quoted context omitted.

he said he was "driving home at 3am," you know, as one does, and two girls were "crawling on the highway." i am honestly not sure i've ever heard a less believable story

I can envision many ways that can happen in America.

I have a friend who went through almost exactly the same driving event as this guy. Hit a man wearing all black on a country road at 1AM. Could have driven away but called 911, rendered first aid, and stayed through the ordeal. He also ended up spending several years in US prison for it.

Really fucked up.

Re: So what’s next (personal news from developer of popular CoreJS polyfill)

#298

Post by ufmace »

modestmc wrote: post #291
ufmace wrote: post #261

Earlier quoted context omitted.

I remembered it as an article where a guy semi-jokingly claimed to have hacked most of the web through a supply-chain exploit and listed off a ton of clever things he did to evade all of the immediately obvious ways to notice that such a thing was happening. Pretty sure I saw it here on HN originally, but I couldn't come up with any search terms to find it in Google, Bing, DDG, HN Angolia search, etc.

The author said he updated the article, so if the link changed then maybe; however, I can tell you somebody definitely reposted it last night and it got almost 100 points. Too funny. I assume you tried punching in keywords like “fake NPM package hack” or something like that?

Pretty much yeah, and no combination I could come up with brought up the article on the first few pages, mostly just infosec blogspam. Of course it might actually show up in searches now, since it's been on the HN front page in the last 24 hours.

Re: So what’s next (personal news from developer of popular CoreJS polyfill)

#299

Post by shmolf »

btown wrote: post #67

From this article, Denis Pushkarev seems to be a remarkably principled developer in a horrible situation, and I admire his commitment to this project. Setting that aside, though, is anyone else alarmed that such a widely used project has exactly one maintainer who is able to push arbitrary changes without review? Especially one already in legal trouble and significant debt, unable to travel, for a project embedded in…

That snyk.io search also uses core-js.

window['__core-js_shared__'].versions

Just more evidence of how prevalent and important that library is.

Re: So what’s next (personal news from developer of popular CoreJS polyfill)

#300

Post by esailija »

glorken wrote: post #242
maccard wrote: post #199

Earlier quoted context omitted.

I live in the middle of a medium sized city in the UK, and drive late at night a couple of times a year for various reasons (day out in another city, late gig, visiting friends, etc). On pretty much every artery road here, if someone was sitting in the middle of the road and I was travelling at 60mph, there's absolutely no chance whatsoever that I would see them. For example, see [0] - this is a major road within a f…

There is a difference. He hit them on a crosswalk, not in the middle of nowhere. While not totally blaming zloirock, I don't understand why a driver shouldn't be punished for killing a pedestrian on a crosswalk.

There are no crosswalks on highways. It's basically like someone sitting on a traintrack and blaming the train operator for killing them.
Post reply on HN