Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open source ‘protestware’ harms Open Source

opensource.org

Post reply on HN
Print view View original

51–60 of 575 posts

Re: Open source ‘protestware’ harms Open Source

#51

Post by makecheck »

One of the things I think protestware doesn’t understand is that the “users” of something are not clear-cut, and that should be especially obvious for things like chains of dependencies in modules/libraries. In other words, some (if not many or even most) people have no idea that something else they use (or even need) is depending on your stupid module.

For example, how would I know if my mouse driver software happens to use a certain Node module, and one of its auto-updates just starts breaking things? Yes, it would be a stupid technical decision on the part of the mouse driver company (and that company would ultimately be responsible for the fallout) but how does that help the person actually affected, in the meantime? And did the protestware developer really not think that someone “downstream” like this could be affected by such decisions? Not everyone is sitting at a terminal seeing a message printed out.

Of course there are other reasons too, e.g. you completely destroy your credibility as a project (or even potential employee in the industry) by pulling stunts like this, and how could that be worth it in the long run?

Re: Open source ‘protestware’ harms Open Source

#52

Post by slackfan »

spamizbad wrote: post #23

While I am personally disgusted with what transpired with node-ipc and am also completely gutted and outraged at Russias violent invasion of Ukraine - I don’t like the idea of us trying to “tone police” open source projects. If some idiot maintainer wants to pull a stupid stunt like that they should have the right to do so. In my view it’s the software equivalent of “hate speech” which, while vile, should be protecte…

1. I agree, as much as I think the maintainer of node-ipc is a flipping idiot and should be given an atomic wedgie, it's their project to do with as they wish.

2. That being said, forking a project due to maintainer disagreements is a time-honored open source thing to do.

3. The last point you made is already happening on both sides of the political aisle.

Conclusion: Maybe software being political isn't a great thing, but that's what everybody chose, and that's what everybody gets to live with. I am looking forward to the +NOPOLITICS licensing clauses.

E: Bring on the downvote brigade, I'm just happy knowing that in the end this too will inevitably burn itself out.

Re: Open source ‘protestware’ harms Open Source

#53

Post by alexb_ »

cestith wrote: post #12

Bram Moolenaar famously uses Vim to raise awareness. A VPN package, dead drop website, steganography package, onion router, multi-point P2P routing mesh drivers, or other software and education on how to use them could really make a difference for dissidents. There are certainly productive ways to use software to support protests, organizing, workers' strikes, or even support targeted sabotage or insurrections withou…

He uses it to help starving children by including a message on startup. That's a little more agreeable and less political than all of the things you listed. To try and compare it is fucking absurd.

Re: Open source ‘protestware’ harms Open Source

#54

Post by q3k »

jraph wrote: post #10

npm install is such a scary command these days (or yarn install, same thing). I never liked it because of the shitload of dependencies it usually pulls but now I would hesitate running it outside a well isolated container. This event added to the strong distrust I came to have on NPM these last months. The NPM ecosystem seems incredibly immature and unreliable and any Javascript project depending on NPM is now a pote…

Go at least will never run arbitrary package code as part of a go get / go build / go install.

Only the resulting binary might contain malicious code, but the build and package management part is guaranteed safe.

In addition, go installs the oldest viable version that matches constraints - dependencies are thus not only locked, but also don’t automatically update to the newest available version during relocking unless explicitly requested by the user or another dependency.

Re: Open source ‘protestware’ harms Open Source

#55

Post by A4ET8a8uTh0 »

commandlinefan wrote: post #5

I'm in Texas. A LOT of Californians disagree with some of the laws that Texas has passed. How long will it be until my hard drive gets reformatted by some protestor in San Francisco who localizes my IP address?

I have long argued that there are things that should remain agnostic of politics ( as hard it may sometimes be ). This trend is genuinely destructive to opensource and I can't help but wonder if it is not done to undermine it by design.

Re: Open source ‘protestware’ harms Open Source

#56

Post by JasonFruit »

I think a lot of efforts to support one or the other side in a war overlook that governments often do things that are supported by only a small portion of their people, and that support is often achieved only through dishonest propaganda. And while the governments have the resources to weather economic and social pressure, their people frequently do not, the more so the more repressive the government. If we can't very directly target the government, not the people, we should keep out of wars that are not an attack on us.

Re: Open source ‘protestware’ harms Open Source

#57

Post by slackfan »

Latty wrote: post #34

Do people think the people protesting like this don't know that this is damaging? They presumably feel that the issue at hand is more important than that damage. Every protest every has been met with "but this protest is being done the wrong way, don't inconvenience me", but that's the point: protest has to disrupt things to make people take notice and make changes. Would I do this? No. I don't think it's effective o…

If the intent is to disrupt, why be surprised at people being pissed off about it? Seems like a natural progression of the conversation.

Re: Open source ‘protestware’ harms Open Source

#58

Post by mushyhammer »

dewey wrote: post #44
bjt2n3904 wrote: post #18

Earlier quoted context omitted.

I have legitimately argued against using NodeJS as the foundation of our next product for this very reason. NodeJS' culture is very much "move fast and break things", and "all software is political". Look at the TSC drama. Leftpad.js. This isn't an ecosystem that you want to build and maintain a product on.

Isn't this mostly a problem of auto-updating and non-pinned dependencies? If you vendor and audit your dependencies this isn't really a problem.

Yes true but have you audited your thousands of modules? If you have a build tool that wasn’t born in 2020 chances are it pulls a hundred dependencies from 20 separate vendors.

I saw this as a JS developer who scarily runs npm installs multiple times a day.

Re: Open source ‘protestware’ harms Open Source

#59

Post by alexb_ »

spamizbad wrote: post #23

While I am personally disgusted with what transpired with node-ipc and am also completely gutted and outraged at Russias violent invasion of Ukraine - I don’t like the idea of us trying to “tone police” open source projects. If some idiot maintainer wants to pull a stupid stunt like that they should have the right to do so. In my view it’s the software equivalent of “hate speech” which, while vile, should be protecte…

He has the legal right to, of course. And that right won't be stripped from free software ever. He also has the freedom to be called a dumbass who is harming open source on a massive scale.
Post reply on HN