Hacker News Reader

To clarify things for the community:

1) No, they (Chinese developers) have not contributed more. You revoked access from @jbielick who was #2 contributor to the package behind you. He messaged me in Slack today that he received zero notification from you and simply received a notification from NPM that he was removed access from the package. You removed his access completely from NPM.

2) My email to you prefaced the concern of the China-based user with "completely unknown" and "To an outsider". Here's the original email to clarify it for people viewing this from an incorrect context:

    Hi Alex,

    Thanks for your work in the open source community.

    I am curious, since the project is open source, if you will be transparent as to the transfer of the koa-router repository and NPM ownership to a completely unknown user "ZijianHe" to the community.  Was there a monetary transaction?  Why did you choose him?  Why not transfer to the KOA org?

    To an outsider, this is all a huge red flag, as an unknown Chinese GitHub user suddenly has full control of a NPM package with 130K weekly downloads and is used by major corporations.

3) I did not "repeatedly" assert that. I stated the word "Chinese" one time. One time is not "repeatedly". I would share with the community your response to my message, but I am not going to do so.

I notice that Alex's claim about you "repeatedly" making accusation(s) regarding "Chinese" users seems to refer to your emails to NPM, not your email to Alex himself that you have provided above.

I hope my attempt to clarify this aspect doesn't take the focus off the other parts of your responses, because the issues you raise are concerning to me and I share your belief that the community deserves info about all this.

Setting aside everything racial, do you know @ZijianHe personally, or was he simply the highest bidder? That's what this all comes down to. Thousands of people (apparently) put trust in you not to backdoor their codebases, and if you simply sold that vector to a random person, that's at best a hugely irresponsible decision.

It may even be completely innocent and valid for a developer to do this, but :

1. there seems to be -intentionally- very little transparency about it,

2. the second most prominent contributor - who was also the most prominent contributor for the last two years - was, we are told, locked out without notice

3. the original developer has repeatedly declined to acknowledge that the community has (or could have) any concerns worth even discussing.

4. the Github history indicates a strong possibility the package was bought.

If someone wants to sell their package, perhaps they have every right to, but the author's repeated dismissal that anyone might be legitimately concerned or legitimately want to know more about this process is bizarre and alarming.

Hey amingoia, thanks for responding. I think the worry here is bigger than this single situation and is really about package maintenance and ownership for the community at large. This is a very popular package. Selling it to anyone just to move on is a burden on open source. I will say it is completely your choice here, but as a consumer of the package and the other 130K+ a week I would urge you and others to be a bit more careful when transferring ownership.

> Let's set the record straight... @ZijianHe offered to maintain it, and I agreed to let him maintain it. Our relationship is not anyone's business.

Why not be transparent about selling the package? Or attempting to do so?

> Chinese developers have contributed more to this repository than anyone from the Koa organization. This kind of racial scaremongering or guilt by association is not acceptable. Its offensive.

Nice rhetoric here. But you know the Country of origin of most cyber attacks is China right?

Source: https://www.csis.org/programs/cybersecurity-and-governance/t...

> I'm not going to say anything more on this issue. This is beyond ridiculous.

Suit yourself. But it really isn't. Sorry for all the harassment you're getting but, it's not exactly unwarranted...

If you pulled up crime statics on black people vs white people, you'd have similar damning statistics. Rather than prejudicing this "unknown Chinese" guy why not treat him as a person first and find out who he is, and what he has to say?

Fair point. Although one shouldn't discount statistics altogether. Security experts lean on skepticism to help minimize exposure and discover new things.

Race and nationality aside, the transfer of ownership to an entity that has zero open source contributions in the js space does look very suspicious. I'm just surprised that an open source author didn't provide that disclosure to users of his work.

In almost all cases, including this one, you will have better signals than to bucket a whole race or culture under a generalized stereotype.

For example i can see at least another Chinese contributor who is against this who works at Alibaba that commented.

The principle issue here is that the repo was put up for sale, and anyone paying for the opportunity to maintain a free library should be scrutinized. This would be true regardless of if they were Chinese, black, or a white guy from San Francisco.