The Ant Design Christmas Egg That Went Wrong

So, sure, it's possible that in some cases people were fired because this Easter Egg outed them for violating some rule. And it's entirely possible that some of the cases of "I got fired for this" are that kind of scenario.

But if this is not against the rules and the firing is actually because it is Christmas-themed, that's a different situation.

I'm also aware that it could be a cultural thing where someone has to be the fall guy and heads will roll to prove our innocence. I see that as deeply problematic. If you didn't forbid open source, firing someone for using it as the "first offense" penalty is not a good policy.

I realize we likely have very little information at this point in time about the details behind the firings and it is the norm for early reports to be wildly misconstrued, which is one of the reasons saying anything at all here is potentially something I will regret.

The days where the state run website only runs code written by the guy in the department who knows how to spell HTML are long gone. Everyone is working on a very small subset of the huge stack of complexity that makes someone else's browser on someone else's device made by someone else on someone else's network linked by someone else's CDN to someone else's datacenter that hold someone else's server hardware which runs someone else's OS which hosts someone else's server stack and uses someone else's framework to show the data you actually wrote. If your non-technical boss can't explain that some parts of this chain aren't under their complete control they're just not being honest.

There is not a single person in the entire history of web development that this sentence does not apply to.

This particular experience make me understand that working for free on open source is really a foolish idea. I was tempted by changing the license but since there are many others using it to build their business I thought it's better to just keep it as it is by respect to early adopters and users which any project is nothing without them.

For a healthy open source project the work needed it's not fun at least for me, it's not just about hacking/problem solving/design, you need actually to do issues triage, answer questions, documentation, extensive testing (with whole infrastructure for builds/releases/communication) those are not fun activities and in most cases done better than paid softwares (because people are passionate about their projects) and in addition to that I need to work fulltime on different (shitty) things to pay the bills and have time for familly ...

Sure there are some projects that are based on peoples' passions and have a few maintainers, but a lot of the bigger projects are big company middleware. It's a big difference from the FOSS movements of the late 90s. I wrote about it before here: https://penguindreams.org/blog/the-philosophy-of-open-source...

Sometimes things will work out for you, sometimes it means exactly what it says on the tin: "I don't promise this works"

Disabling it is easy enough but I have other things to do.

Last, but not the least, I'll document it as follows:

    This code contains easter eggs which are disabled by default. If you want to enable them, set easter_eggs_enabled=true. Please note that, the eggs have their own time, and it won't make them enabled all the time.

I don't really understand why we have "reasonable expectations that maintainers of a project are reasonable people". We absolutely know for a fact that a not-insignificant percentage of our users are malicious. Why do we assume that zero percent of package maintainers are malicious?

The only qualification someone has to be a maintainer is to have written something that someone else wants to use, and to publish that thing on a package repository. Or that they volunteered to take over maintenance of a thing that other people want to use. There's nothing in there about not being malicious.

And yes, I would absolutely blame every glibc user for trusting the glibc maintainers. Glibc is a gift. I don't have any contract with the maintainers of glibc that says they have to act in my interests. I choose to use their work because it saves me time. If that stops being the case, I'll find an alternative (together with everyone else), or roll back to the last known good version of their work that they let me use. If the glibc maintainers really want to make it Christmas Day every day, then that is entirely their right. I do not have the right to demand anything from them or their code. I don't have to use their code, and they don't have to take my needs into consideration when writing it.

An easter egg that they put on other people's sites without their knowledge or consent.

The correct word for this is malware.

Can you illustrate this specifically? Had this happened, will the dev himself/herself get punished?

“Christmas crackers are festive gifts that make a snapping sound when opened.” For example, a Christmas cracker could contain a paper with jokes on it, a paper crown, and a puzzle where you have to disconnect two linked ring-like metal pieces.