Live data from Hacker News

Faker.js is now a community controlled project

fakerjs.dev

341–350 of 357 posts

Re: Faker.js is now a community controlled project

#341
post #337

Earlier quoted context omitted.

And just to be clear: by "grilling" you mean lying about and endangering the families of non-elected bureaucrats for the purposes of political fundraising. You're exhibiting and defending precisely the behavior I mean when I say Libertarians are "self-centered anti-social assholes". You are not pretty different yourself, since you believe and spread the same conspiracy theories, and support Rand Paul's attack of comp…

>>I'm glad you don't incorrectly disagree with the fact that most of the arguments proffered against ACA Just because I choose not to respond to all of our unhinged conspiracy laced non-sense claims that everything you disagree with is a dog whistle to racism does not in anyway imply I support said statements. ' I choose not argue with crazy people on the internet, and clearly President Trump broke your mind and I ho…

In no way do I "worship" Fauci. You're projecting your own hero worship of Trump onto me. You're the one who believes and spreads unfounded conspiracy theories, and whose mind Trump broke, if it was not already broken before. It's you foaming-at-the-mouth Trump-worshiping Fauci-haters who are the deranged ones injecting disinfectants, popping horse dewormer pills, and drinking your own urine, instead of wearing masks and getting vaccinated. Get a grip on reality and stop parroting lies and drinking Trump's piss flavored kool-aid. The rampant racism in the US and the fact that Trump exploits it is not a conspiracy, it's a historical fact that you can't deny. You fanatical Trump supporters are spreading ridiculous unfounded and totally disproven conspiracy theories that it was actually AntiFa who attacked the US Capitol to make Trump look bad, when we all know because we saw with our own eyes that they were racist Confederate Flag brandishing Trump supporters, egged on and organized by Trump himself. So do you also believe the election was stolen from Trump, too, like MOST Republicans do? Or do you just pretend to believe those lies and conspiracy theories as performance art trolling, the same way you go out of your way to purposefully mis-spell "democrat politics"? Then Popehat's Law of Goats applies:

https://www.urbandictionary.com/define.php?term=Popehat%27s%...

>Popehat's Law of Goats

>He who fucks goats, either as part of a performance or to troll those he deems has overly delicate sensibilities is simply, a goatfucker.

>He claimed he was just pretending to be racist to trigger the social justice warriors, but even if he is telling the truth, Popehat's Law of Goats still applies.

Re: Faker.js is now a community controlled project

#342

Earlier quoted context omitted.

Open source works because we can trust authors to not maliciously harm other people. If it was a bug that's one thing it happens, you move on. But when you purposely do something that you know will cause harm to people that is where I draw the line. Your analogy isn't even close. No one forced him to write faker.js. He chose to do it and he chose to make it open source under a license allowing people to use it. He al…

He chose to put a package online. He didn't sign any contract stating the package would meet some kind of quality obligations. He had no obligation to do anything. Yes, it is particularly shitty to intentionally screw it up. But the system that put so much value on something not happening without any safeguards or obligations is the real problem. The move fast and break things attitude of web development is the cause…

He chose to put a package online. He didn't sign any contract stating the package would meet some kind of quality obligations. He had no obligation to do anything.

If there was a bug in his logic that caused an infinite loop in some scenarios he was under no obligation to fix it. While I think he should in that scenario, I would defend his right to leave it. Another maintainer could fix it, someone could fork the package, whatever.

I am not arguing he owed anything to anyone. I am arguing that he is not entitled to maliciously break things on people. He committed it knowing full way most packages would grab it automatically, most people are okay with that as if it breaks things they can go back a version no big deal. His package is so popular some people might not even realize that one of their dependencies relies on it.

We can argue about how much time you should invest in knowing your dependencies and checking every commit for them, until we are blue in the face. The reality is he knew most people just can't or won't especially in npm world.

There is no defending a malicious act. He is not entitled to commit code maliciously. OS works because we trust maintainers to do their best to have the best interests of the users at heart. The flip side of that is they are under no obligation to work on it. They can walk away at anytime.

If peoples idea of OS software starts to include that someone could do something malicious at any moment, that's the beginning of the end of OS.

Re: Faker.js is now a community controlled project

#343

Earlier quoted context omitted.

No one took steps to protect JS projects from malicious updates. They took action in this one case but did not fix the underlying issue which is with package managers.

It is true that there are some vulnerabilities in the standard design for npm package management. Packages are designed to assume by default sources can be trusted and to pull aggressively. That's a system that's very convenient for developers... Assuming somebody doesn't use it in an extremely malicious way by building our trust with a working package and then pushing a change designed to screw users. Fortunately, i…

The only reason anything happened cause the developer intentionally crippled their own package which they had the right to do. If someone was modified a package to do something actually malicious you could go months without ever finding out.

Re: Faker.js is now a community controlled project

#344

Earlier quoted context omitted.

It is true that there are some vulnerabilities in the standard design for npm package management. Packages are designed to assume by default sources can be trusted and to pull aggressively. That's a system that's very convenient for developers... Assuming somebody doesn't use it in an extremely malicious way by building our trust with a working package and then pushing a change designed to screw users. Fortunately, i…

The only reason anything happened cause the developer intentionally crippled their own package which they had the right to do. If someone was modified a package to do something actually malicious you could go months without ever finding out.

I don't disagree that there are degrees of harm and differences in the ease of detecting such harm. But what's the significance of the distinction? Whether it's found out immediately or found out months later, the remedy for the community will likely be the same if the damage is widespread enough... Flag the version as bad in npm, break the connection between npm and the GitHub repo if the damage was purposeful, and the community picks up the package and starts maintaining a non-malicious version.

Re: Faker.js is now a community controlled project

#345
post #242

Earlier quoted context omitted.

Setting your package version to allow for minor updates _is_ responsibly consuming the dependency.

This sounds like "I responsibly test in production". If you do test and isolate testing environment then this kind of breaking update is just business as usual.

That's fair, it does sound like a novice take; but it's still "business as usual" w/r/t what is touted as best practices where it comes to version control. At least that's my slightly above novice take on the matter.

Re: Faker.js is now a community controlled project

#346

Earlier quoted context omitted.

I've already posted this before, but what Marak has done is anything but reasonable. If anyone was being a "dick", it was him. If he just wanted corporations to pay, there are plenty of other alternatives like changing the license for future versions like SugarCRM did. It's been years since they've done that and they have plenty of customers. https://sugarclub.sugarcrm.com/engage/b/sugar-news/posts/sug... Since the d…

To be honest I'm commenting only part with "f.. it I'm not longer working on it", I have ambivalent feelings to "lets change code in such way that builds will go into infinite loop or fail", ambivalent because as it is not nice, but somebody who was a victim of such situation should learn not to add dependencies to newest version, because here was only some small "joke", but it might be something much worse like pois…

> Problem is in this that default behavior is "we are not paying for tools"

The problem is if the person wants to get paid, then they need to use licensing that is more restrictive and sets the expectations for eventual payment. The MIT license is a "do whatever you want with my code as long as you don't sue for inadvertent mistakes" license. No one else is at fault for that license except for Marak. The expectation of doing what you want based on the license is inline with behavior. If he wanted to change behavior, he just has to change the license or don't go open source. You can't have your cake and eat it too ie. you can't have open source's viralness and expect everyone to pay. If you want a near guarantee that people will pay for your work when they use it, don't go open source. Open source is not about getting paid.

> You are mentioning several ways how this guy was able to collect money, yep, but again changing license would mean that somebody else will fork previous version and thats all.

Since we're on this subject, I'm going to remind you that Marak didn't come up with faker on his own. He ported it and maybe even the data from a ruby project that was also called faker. To my knowledge, he hasn't shared any of the monetary contributions to his project with the people maintaining the ruby version of faker.

If his software is so simple that someone can just fork it and gain an audience, then maybe it's too simple to replicate and too much of a commodity; but as I've already pointed out SugarCRM successfully transitioned to closed source and I believe redis has successfully transition to a more restrictive license. Neither of them messed with other people's projects. There's no excuse for the bullshit that Marak pulled. Zero. Changing the license is more simple than adding an infinite loop to waste CPU cycles.

> which at the start was cool and funny, but later becomes burden.

I've already written this, but most people just walk away instead of doing something malicious.

Re: Faker.js is now a community controlled project

#347

Earlier quoted context omitted.

What GitHub did was completely reasonable. They mitigated harm to their users on their own infrastructure and property. They did not change his code. They just took down his malicious code that caused harm. The vast majority of people on HN would never purposely harm strangers. Most of these strangers are fellow developers ie “Us”

I understand some of the imperatives GitHub's people must have felt. I've advised folks providing open source infra under drama, though I can't talk details. I'm sure the people who got burned on builds had bad days. It's not fair to blame them entirely, for not locking deps. It is fair to point out this isn't the first time builds have broken, with npm or other repositories. Nor the most widespread in effect. Does t…

If people want full control over their repo, then they shouldn’t use GitHub, gitlab, bitbucket or any other free service. They should host it on their own server.

This is an open and shut case. GitHub did the right thing.

Re: Faker.js is now a community controlled project

#348
post #337

Earlier quoted context omitted.

>>I'm glad you don't incorrectly disagree with the fact that most of the arguments proffered against ACA Just because I choose not to respond to all of our unhinged conspiracy laced non-sense claims that everything you disagree with is a dog whistle to racism does not in anyway imply I support said statements. ' I choose not argue with crazy people on the internet, and clearly President Trump broke your mind and I ho…

In no way do I "worship" Fauci. You're projecting your own hero worship of Trump onto me. You're the one who believes and spreads unfounded conspiracy theories, and whose mind Trump broke, if it was not already broken before. It's you foaming-at-the-mouth Trump-worshiping Fauci-haters who are the deranged ones injecting disinfectants, popping horse dewormer pills, and drinking your own urine, instead of wearing masks…

You are the only unhinged person here. I am having a calm conversation where you are ranting and raving... It is sad really

>>In no way do I "worship" Fauci.

Press X for doubt

>>You're projecting your own hero worship of Trump onto me.

Never voted for the man... I disagreed with him about 50% of the time, however I saw in real time the lies and misinformation the media was putting out.

>>It's you foaming-at-the-mouth Trump-worshiping Fauci-haters who are the deranged ones injecting disinfectants, popping horse dewormer pills, and drinking your own urine, instead of wearing masks and getting vaccinated.

Fully vaccinated, just do not support the mandates

//and for the record Trump also supports the Vaccines.. Much to the chagrin to part of his base

Also calling on of the most widely distributed human drugs, a drug that won accolades for saving peoples lives across the world a "horse dewormer" is unhinged conspiracy, and medical misinformation. Sure it may not be a treatment for COVID, that however does not change the reality that is a human drug, proscribed by doctors all over the world, and is infact on the WHO list of essential drugs...

>> disproven conspiracy theories that it was actually AntiFa who attacked the US Capitol

Where did I say that? There is clear evidence AntiFa violence all through out 2019, 2020, and 2021 with out having to talk about 1/6 protest turned riot.

>> So do you also believe the election was stolen from Trump, too, like MOST Republicans do?

Stolen in the sense you are talking about... No. However I do believe many states governors (on both sides) inappropriately (and IMO illegally) used their executive powers to change election laws under the guise of "emergency" to manipulate election turn out and other factors for their (or their parties) political advantage.

I also do not believe or support the narrative that voter ID is a threat to democracy, nor do I support or believe the narrative that the US has the most "secure" elections in the world.

>>Popehat's

Ahh yes... Ken White. another famous person broken by Trump. The one famed free speech advocate now fully supporting Censorship of all manner.

Re: Faker.js is now a community controlled project

#349
post #339

Earlier quoted context omitted.

I’m not defending the author. GitHub is in their right to do what they did. But certainly not because of the nonsense GP claims. And yes you can host viruses on S3. What you can’t do is use Amazon’s network to do illegal shit (such as distribute viruses without consent).

Obviously I mean to distribute viruses via S3, which is what’s happening here. Your account is guaranteed to be flagged as soon as they find out. The update here was distributed to every subscriber.

What's your point? That doing illegal shit will strip you of your rights?

You know, I hear that if you go around stabbing people, you lose the right to not spend a bunch of time in prison, too.

Re: Faker.js is now a community controlled project

#350
post #282

Earlier quoted context omitted.

Unprofessional as in done by a person I wouldn't hire in his current mental state.

> hire him So what you do mean is someone had to spend hundreds of hours maintaining some projects you've been using and also should have perfect personality and well behaved enough before you hire him?

I would prefer to avoid people who sabotage stuff and literally build bombs.
Post reply on HN