Hacker News Reader

Comment by sethvargo | Hacker News Reader

Hi there. I’m around to answer any questions!

If I was you, I would not answer any questions, and I would consult a lawyer.

edit: Looks like they were public gems, but in general it's always good advice to consult a lawyer before disrupting commercial or public systems.

He's not under arrest, Miranda.

That would be an insane precedent to send if breaking or removing a FOSS project becomes a crime simply because your project happens to be used in some mission-critical system.

Good way of making sure no one ever contributes to FOSS again.

While it’s not a crime, at the very least they might be liable for damages.

To establish criminality or liability intent is often looked at, and this is a pretty clear-cut intent to injure the other party.

No questions, but thank you for making it marginally more difficult for tech companies to avoid responsibility for whom they work.

Do you think that there is a point in having boarders between countries? If so how should they be enforced? If a 17 year "child" crosses the boarder should they be detained (ie. kept in prison until deportation) or should they be allowed to walk free in the US. If a child and parent both crossed the border should only the parents be detained leaving the child to fend for itself in America? Should they be detained in the same cell? ie keep children detained with adult.

I agree that keeping children in cages is not good, but there are solutions. If ice had a bigger budget maybe it could have more beds, larger cells, better food. I don't see how removing enforcement is a solution.

What do you think ICE is doing with over $700 per person per night that they would do better with even more money?

Using children as a way to take advantage of existing policy is a well known strategy employed by the cartels to get across the border, which is what initially precipitated the separation policy under the Obama Administration. While, sure, ICE having more funding would be good it's still just treating a symptom of a much larger problem (growing strength of Cartel activity and human trafficking).

Free movement of peaceful people is a basic human right; borders are based on entirely arbitrary violence, and are utterly ridiculous and plainly contrary to decent morals and good sense.

Guess I don’t have decent morals and good sense, because open borders sounds like a really bad idea and is something that’s only ever advocated for by an entrenched elite that’s completely insulated from any potential problems that policy will cause.

> I agree that keeping children in cages is not good, but

Come on, man.

I'm waiting for you to write what the alternative is? Make a law stating that if you cross the boarder illegally, or for that matter, commit any crime, but are a child, then you do not get detained?

Would you be much happier if it was a normal room, but locked from the outside?

I never saw anyone talking about "cages" until about a year or so ago. It seems the alternative of better accommodation isn't what people are demanding here, but rather, giving children a waiver to break any and all laws. If you want to see children being forced or recruited into cartels in record numbers, making them immune from any kind of border enforcement is a surefire way to do it!

Do you think this action had any net impact on ICE operations?

It's a political statement. This action receiving news coverage is net impact.

It's a political statement that will do nothing but echo in people's respective echo chambers. It'll get positive coverage like this in places like the Daily Dot and MSNBC, and Tucker Carlson will use it as "just another example of far left Silicon Valley attempting to circumvent our laws".

The net impact is zero.

Tucker Carlson talking about this is a good outcome. This will only highlight the power that open source and open source contributors have. Lol, a political kerfuffle over an devops FOSS project.

Make working with ICE a toxic asset. Make people not proud of working for ICE contractors.

You actually think that Carlson is going to inform his viewers of the virtues, let alone technical details, of a FOSS project?

>Make working with ICE a toxic asset. Make people not proud of working for ICE contractors.

This kind of activism in tech leads no where good. It will lead to witch hunts, more "cancel culture" purity spirals, and generally shit software used for critical functions of our government.

The goal was not to disrupt ICE, Chef, or any organization thereof. The goal was to remove my code from an ecosystem that was using it for purposes I perceive as evil. I had no goals of disrupting ICE operations or Chef operations.

I suspected a small percentage of people with a hard, runtime dependency would be impacted, but I did not know Chef (the software) had a hard runtime dependency and was pulling that dependency from public RubyGems instead of a mirror they control.

Besides the political statement, do you have any technical opinion about an organization such as Chef shipping things that have runtime deps to third parties?

It wasn’t a political statement. I have a few thoughts in general. These aren’t specific to this situation.

First, always minimize runtime dependencies. I personally prefer compiled things for this very reason.

Second, if you’re going to include a third party dependency, how are you auditing it? There’s an unexplored area around security here too. The Node.js ecosystem has had a series of incidents where popular packages have had cryptocurrency miners injected into otherwise helpful packages. If you’re depending on third party runtime dependencies: how are you auditing changes and contributions, how are you scanning for vulnerabilities, how are you patching those vulnerabilities if you don’t have an internal fork upon which you build?

Third, RubyGems is a volunteer-run organization. I believe other software ecosystems are similar. From my understanding of the situation, a RubyGems outage would have had similar effect.

What are your thoughts on Golang?

I believe you should use whatever language is practical for your use case.

If you use Go, then try one of the new self-hosted repositories, such as github.com/gomods/athens since it allows you to archive every dependency you ever update so you can always retrieve past dependencies.

Compromised third party libs are absolutely not “an unexplored area around security”. It’s a super well-known threat.

Sorry - by “unexplored” I meant “not a topic I’ve seen discussed at length with regard to this particular issue”

I don't have a question, I just wanted to let you know what you did was extremely based.

Extremely based? I’m not sure I understand your comment.

‘Based’ is slang for doing something without caring what other people think, and gained meaning from followers of Lil B, or ‘based god’: https://www.urbandictionary.com/define.php?term=Based&amp=tr...

TIL

It's internet slang primarily used on imageboards to mean 'extremely respectable'

Has there been any blowback from other clients/employers since taking the repo offline?

There have been some angry people on Twitter/HN/Reddit, but I would say “no” in general. Most feedback has been “you broke my stuff, but I don’t mind. thank you for standing up”.

Did you contact Chef asking them to cancel the contract before removing the github code ?

I contacted them three times. One by mail, twice publicly via Twitter. I received no response. My correspondence did not request cancellation of the contract but rather an explanation. Inside sources at the company confirmed the contract and also noted leadership was forbidding them to speak publicly.

Reply on news.ycombinator.com