Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

bleepingcomputer.com

Post reply on HN
Print view View original

391–400 of 1001 posts

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#391

Post by bluefox »

slavik81 wrote: post #362
bluefox wrote: post #341

Earlier quoted context omitted.

You are saying "scary", but I think "alarming" is more appropriate. It's an alarm that should be buzzing through sleepy programmer skulls. It should alert them to the fact that it's no longer the small company that respected programmers, where you felt your account was yours, and your repositories were yours. The rules have changed with that acquisition, and Microsoft exploited the good reputation of that small compa…

GitHub has always been about "social coding". This is a quote on their homepage on May 2008 (three months after GitHub was founded): > What’s amazing about Github is how it really brings the social aspect into play. Chris and Tom are showing us all visually how git development is supposed to work. I know I personally had some bing moments once I started pulling in commits from external git repos. https://web.archive.…

Yeah, I was a GitHub user in 2008. Though it obviously had a social aspect, it wasn't considered a "social network" type of site. Its ongoing transformation into one is a result of the acquisition by Microsoft.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#392

Post by hn_throwaway_99 »

bastardoperator wrote: post #108

Should I get paid for my multiple contributions to faker (I don't think I should)? I've submitted several PR's for generating data all of which were accepted. Even back then the maintainer was barking about money... Honestly the project would be better off forked. He did not write this library entirely by himself, at this point I just see him as holding other committers contributions as hostage. It's a bad look, why…

> It's a bad look, why would anyone want to deal with him after this stunt is beyond me.

The maintainer appears to be unwell:

https://abc7ny.com/suspicious-package-queens-astoria-fire/64...

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#393

Post by ThunderSizzle »

qaq wrote: post #244
IceDane wrote: post #186

Earlier quoted context omitted.

This is not the way. Github doesn't have the right to tell someone what to do with their own code. The only right thing to do in this situation is to fork the repositories and fix the situation on the npm side. Github doesn't get to ban this guy because he took a dump in his own backyard. EDIT: I suppose the literal DoS attack in the code probably puts him squarely in the "malicious behaviour" category which then giv…

Are you sure their TOS does not give them a right to do this regardless of "malicious behavior"

Is it really that malicious?

Obviously people wouldn't use that source code if they didn't want it.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#394

Post by spijdar »

no_wizard wrote: post #374

This isn’t a vulnerability nor is it corrupt, these are intentional actions on behalf of the project maintainer. Not that I agree per se, to be absolutely clear, however saying these are corrupt or somehow vulnerabilities isn’t the truth. This is the software working as intended

They are absolutely corrupt -- intentionally corrupt, but the intention was to break the software in retaliation.

Drilling holes in your boat to sink it means yes, it is sinking "as intended", but it's still an act of sabotage.

I suppose you can specifically argue against the word corrupt as implying a corruption of the author's intention, but I think it also applies to "does not behave as anticipated".

(now, the interesting question is how fair is it to anticipate free work from an individual -- I don't know where to draw the line, but this seems to cross some boundary...)

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#395

Post by A4ET8a8uTh0 »

IceDane wrote: post #202
starkd wrote: post #175

Earlier quoted context omitted.

I couldn't help but think the same thing. Seems like an incredibly immature way to handle it. He could have easily set an end date and state nothing will be maintained beyond that date. It's not a good look.

I don't think he cares at this point. I think this is a person that has been driven to the absolute end of their patience. If he's really barely been getting by, then I can only imagine the sheer frustration he must be feeling. Not only are there swathes of fortune 500 companies which depend on his package but don't contribute a dime, but he also had a company with millions of dollars in funding look at his idea and…

His twitter page complaining that his github got locked-up suggests he cares. I am not unsympathetic, but only because, I am starting to see this more as an effort to undermine open source as a movement/cause.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#396

Post by throw_m239339 »

tomrod wrote: post #348
throw_m239339 wrote: post #128

Earlier quoted context omitted.

None of these points have any legal standing, from a copyright perspective. https://news.ycombinator.com/item?id=29868199

Despite the need to keep it clear, copyright does not reign supreme.

> Despite the need to keep it clear, copyright does not reign supreme.

neither do NPM TOS, or whatever Microsoft thinks they are entitled to, since NPM is owned by Microsoft.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#397

Post by TranquilMarmot »

seattle_spring wrote: post #345
TranquilMarmot wrote: post #239

Earlier quoted context omitted.

The little `^` in version numbers in NPM's `package.json` file is such a bizarre choice. The fact that it by default installs all new dependencies with that means that builds on different machines at different times could result in _completely_ different artifacts.

You should always commit a lockfile (either npm's or yarn.lock) alongside package.json

This helps with CI and deploys, but on developer machines running `npm i` will install different things at different times. The amount of churn a `package-lock.json` file undergoes when all of the dependencies have a `^` is crazy.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#398

Post by josephcsible »

spijdar wrote: post #394
no_wizard wrote: post #374

This isn’t a vulnerability nor is it corrupt, these are intentional actions on behalf of the project maintainer. Not that I agree per se, to be absolutely clear, however saying these are corrupt or somehow vulnerabilities isn’t the truth. This is the software working as intended

They are absolutely corrupt -- intentionally corrupt, but the intention was to break the software in retaliation. Drilling holes in your boat to sink it means yes, it is sinking "as intended", but it's still an act of sabotage. I suppose you can specifically argue against the word corrupt as implying a corruption of the author's intention, but I think it also applies to "does not behave as anticipated". (now, the int…

> now, the interesting question is how fair is it to anticipate free work from an individual

I don't really see how this is relevant. Suddenly doing no more free work at all would have been perfectly fine, but this was intentionally breaking preexisting code.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#399

Post by no_wizard »

dopamean wrote: post #370

Marak Squires is a really shitty person with an extremely checkered past. I wouldn’t use any software he was responsible for.

I think this is one of those levels where it’s appropriate to ask for sources. Multiple sources, from reputable exchanges / sites.

Sometimes folks get disillusioned which can lead to things like very real depression which can drive them to do things that otherwise they would not.

I don’t agree with the choices in this case personally, I do not think we should rake the maintainer over a fire over it without more evidence of actual wrongdoing.

This feels to me, if I was projecting myself as an armchair psychologist, that feelings of disillusionment have driven this behavior and I can understand how maintainers like this get there, especially when people build multi million dollar businesses on the back of your work without giving support or worse, demanding things they feel entitled to.

Is it fair? No. Should perhaps they handled this differently? I wouldn’t have done this, I think there is a more graceful way to retire projects personally. Is it true that legally they were licensing their work in a way where millions could do this? Of course.

However, ethos cut both ways. Companies and certain individuals like to ignore the ecosystem and not contribute back, lots of big ones, that make billions per quarter, and then chastise maintainers for not being responsive, or trying to change licensing to get more personal benefit etc. yet they don’t want to be held responsible for the other side of the ethos: contributing back to those which you built your success upon.

Re: Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

#400

Post by rodgerd »

donkarma wrote: post #378
yashap wrote: post #205

Earlier quoted context omitted.

He’s also going on about a wild conspiracy theory about Aaron Swartz getting assassinated because he was on to Ghislaine Maxwell, or something like that. And linking it to his open source comments in a way that doesn’t seem to make sense. He’s almost certainly going through major mental issues, along the lines of schizophrenia or something similar. He needs help.

How is that a wild conspiracy theory?

For one thing, the MIT Media Lab is an associate of Epstein's.
Post reply on HN