Hacker News Reader

Comment by d3nj4l | Hacker News Reader

I keep thinking about this event and it seems like a fractal of bizarre phenomena. The act of stripping git history and attribution while forking is itself malicious, but then aggressively creating pull requests across major projects to use the new version and rack up your download count (???), then picking petty fights with the creator of the original over attribution (????), and the fanbase (?????) of the forker dogpiling the original creator (??????) is... what? I struggle to attribute these to normal, healthy motivations. Something is very, very wrong with the JS Open Source community if naked clout chasing like this is not only tolerated but also rewarded with fans!

View on HN

The absolutely crazy thing is the person who caused this doesn't even think they did anything wrong: https://github.com/babel/babel/pull/13783#issuecomment-92724...

And there are people supporting their position.

I think because JS is such a large tent, there are folks not familiar with licenses and general norms in this space. I don't think it's something that being reasonable and pointing things out wouldn't fix.

As an aside I'm now extremely uncomfortable if I find any of ai's work as a transitive dependency for my company's own work because of their attitude towards adhering to licenses.

> I think because JS is such a large tent, there are folks not familiar with licenses and general norms in this space.

It's worth pointing out that this is all about a bunch of packages that decorate strings with ANSI colour escape sequences... I'm not saying it's worthless, or that there is nothing wrong in principle - but it's a lot of noise over something easily replicable from scratch - something simple enough that you may even choose to not bother with a library, (i've always just used ANSI codes directly in JS command line tools, sometimes defined in a few constants and interpolated for readability).

So perhaps the reason why one author is so pissed at misattribution, and the other allegedly doesn't seem to care much about it, is explained by a large difference in perceived value of the code.

To make my point more potent, imagine it was the same debacle over one of the many infamous one line NPM packages like "is-odd" which currently has half a million downloads per day and ultimately consists of the code "return (n % 2) === 1;"... excluding all of the fluff, and even with some unnecessary parenthesis.

I thought it was a joke your is-odd comment. But no it is at version 3.0.1 and has 2.1 million downloads a month[0]... And it has a dependency to is-number. With the performance of today's tree shaking systems I wonder why there is not a simple math lib.

[0] https://www.npmjs.com/package/is-odd

It's pretty crazy. For whatever reason there is a substantial culture around NPM usage of preferring to depend on lots of trivial packages, over writing simple inline equivalents. And it's recursive, which can mean depending on what seems to be a modest but useful package at the top of that hierarchy ends up pulling down 10k packages.

I think this makes it easier to acquire an inflated sense of importance when an authors package reaches popularity - most of the small packages have some value and aren't as ridiculously worthless as "is-odd"; yet they also don't embody anything particularly unique or difficult to replicate.

> I wonder why there is not a simple math lib.

There are some non-standard but comprehensive math libraries such as MathJS. Although I don't think "is-odd" could be attributed to an absence of standard math libraries.

In fairness to the OP he did optimize the hell out of his colorette lib, it's about 1/10th the size of the widely adopted chalk lib and performs way better. Back in the day I remember he was (rightly) complaining that the chalk author submitted PRs to get chalk used in as many libs as possible, while colorette (or whatever it was called--it has a different name before) was the technically superior solution to the problem.

Then he should have made a PR, or at the very least retained the commit history to recognize the original programmer's work. That's non-negotiable, because commit history can be essential to understanding breakage in mature libraries. The fact that anyone would feel comfortable erasing it leads me to believe there's an ulterior motive.

If I understand correctly, the parent is talking about the original author of the library, not the person who forked it.

Yes, this is correct, I was referring to colorette's maintainer. Sorry for confusion.

> I wonder why there is not a simple math lib

This [0] might be what you are looking for, it has both is-number and is-odd.

[0] https://github.com/stdlib-js/stdlib

For what it's worth, this is also all the work of one person who spammed NPM with micropackages to boost his download counts. This meme attacking `npm` for nonsense like `is-odd` is quite literally the result of one person resume boosting.

For every one thing, he broke it down into as many possible packages as possible, and all of his packages depend on 20 more of his packages. It's like a fractal of resume boosting.

https://github.com/jonschlinkert/info-symbol https://github.com/jonschlinkert/success-symbol https://github.com/jonschlinkert/warning-symbol https://github.com/jonschlinkert/error-symbol

My personal favourite is making every single ansi colour into a separate package, and then making `ansi-colors` which depends on all of them, and all of these packages are just a single function call with a provided number. It's honestly insane.

https://github.com/jonschlinkert/ansi-black

https://github.com/jonschlinkert/ansi-reset

https://github.com/jonschlinkert/ansi-bold

https://github.com/jonschlinkert/ansi-dim

https://github.com/jonschlinkert/ansi-italic

https://github.com/jonschlinkert/ansi-underline

https://github.com/jonschlinkert/ansi-inverse

https://github.com/jonschlinkert/ansi-hidden

https://github.com/jonschlinkert/ansi-strikethrough

https://github.com/jonschlinkert/ansi-black

https://github.com/jonschlinkert/ansi-red

https://github.com/jonschlinkert/ansi-green

https://github.com/jonschlinkert/ansi-yellow

https://github.com/jonschlinkert/ansi-blue

https://github.com/jonschlinkert/ansi-magenta

https://github.com/jonschlinkert/ansi-cyan

https://github.com/jonschlinkert/ansi-white

https://github.com/jonschlinkert/ansi-gray

https://github.com/jonschlinkert/ansi-grey

https://github.com/jonschlinkert/ansi-bgblack

https://github.com/jonschlinkert/ansi-bgred

https://github.com/jonschlinkert/ansi-bggreen

https://github.com/jonschlinkert/ansi-bgyellow

https://github.com/jonschlinkert/ansi-bgblue

https://github.com/jonschlinkert/ansi-bgmagenta

https://github.com/jonschlinkert/ansi-bgcyan

https://github.com/jonschlinkert/ansi-bgwhite

Wow, that is no joke. ansi-colors relies on ansi-blue, which relies on ansi-wrap and makes a single call to ansi-wrap, providing the constants 34 and 39. It’s a couple dozen packages whose sole purpose is to provide a distributed set of constants. That is pretty blatant. On his bio he boasts about having over 1000 open source projects, and I can’t help but think he could have a few useful ones in there that are overshadowed by this embarrassing display of clout-chasing.

His explanation on Reddit:

"The way I learned how to program was by publishing one project a day that used a specific language feature I was trying to learn. No one even looked at my projects or used them until I had quite a few published. I didn't even want people to use them at that point, since I had no idea what I was doing. Then one day I realized that people were actually using some of the things I published as a learning exercise, and I started going back and fixing and improving that code. Rinse and repeat. That's pretty much all I did.

Why is the default for people to assume the worst all the time? It's depressing as hell."

If true, it's kind of sad so many people badmouth him.

It sounds like he's just making excuses. If he really thought his contributions were just for learning, he wouldn't be bragging in his bio that he's "created more than 1,000 open source projects". That's like saying "I've written more than a million lines of code" because I copy-pasted one line of code a million times in college.

> I hope he didn't brag about "more than 1,000 open source projects." That number's so large it's a red flag that he's never build anything complex.

I have nothing against them as a person - I don't know them at all. However, the ANSI colours one is blatant package-downloads optimisation. Infact, the READMEs were clearly copied and pasted,

> The color reset, in ansi. [1]

> The color strikethrough, in ansi. [2]

etc.

Which don't really make any sense.

[1] https://github.com/jonschlinkert/ansi-reset [2] https://github.com/jonschlinkert/ansi-strikethrough

Maybe public common repository shouldn't be used as a dumping ground for every random guy learning how to make their first script. It's a bit like learning to drive by going to a public highway and just starting driving at random directions and then saying "why are you folks screaming? I'm just learning, it's depressing you always assume the worst!"

Ever publish a Java project to Maven Central? It's a massive pain, but it also acts as a bar to make sure you're publishing something of value you think others might use.

Unlike a public highway, you can't actually harm anyone by publishing to a public repository. The code is just there; you can ignore if you prefer (you can't ignore a swerving car in a highway).

What's actually harmful is the blind trust most developers have on adding dependencies without proper vetting. But if someone publishes a package they are not responsible for vetting it for inclusion in your project. So shifting blame to the library author gets responsibilities backwards.

Perhaps you would prefer a curated package registry, but in this case you would need actual curators. Something like Debian has maintainers, but doesn't have every library in existence (and what it has is often outdated anyway). Npm and other language registries aren't curated, by design. You could create a curated registry on top of npm but, again, you need curators.

By publishing one single script - not likely. By publishing 1000 scripts - yes, you can, by polluting the public space and making it so much harder to find real supported code that can be relied upon. It's like throwing garbage on the street. One can won't do much, do it many times - and your neighborhood is a dump.

Same argument as with spam. Sending an email is not a crime, and sending an email to somebody you didn't know to ask them maybe they want to do business with you is not that bad. Do it couple of millions of times, and it breaks the whole system.

> What's actually harmful is the blind trust most developers have on adding dependencies without proper vetting.

Now comes the victim blaming. Nope, the fact the people should verify stuff does not absolve the guilt of those who put garbage into the public space. On the contrary, they are making the problem so much worse. And yes, there are means to deal with the problem, but again "you can clean up" is not an argument that absolves the guilt of somebody who throws trash around. They are doing bad thing, and should feel bad about it.

It kind of stretches credulity for him to say these are just test projects that he doesn’t want people to use when his profile is bragging about having 1000 open source projects.

Exactly. I almost believed it until I saw shameless self-promotion and soliciting donations under it. I mean I have nothing against people getting paid for their work, especially open-source developers, but you can't both claim you were just learning and didn't expect anything, and use that to brag and solicit donations.

Agree. And also when you publish something on NPM you could expect someone to download it and you would need to maintain it. You cannot say later "Ohh I didn't know or I had no idea".

Wow, this person's Github about says it all.

> Several years ago I switched careers from sales, marketing and consulting to learn how to program, with the goal of making the world a better place through code. Whether that means giving people access to information, the tools and technology to level the playing field with big corporations, or empowering people in impoverished regions to participate in the world economy.

> To date, I've created more than 1,000 open source projects in an effort to reach my goal.

They're good at marketing, I'll give 'em that.

There can be a lot of value in value in a code base such as this. Just copy an existing open source lib, add a small speed up, push for fast adoption across common OS build tools, now you can sell committer rights for a high price to anyone wanting to launch a supply chain attack. Could be very profitable.

This is of course unlikely to be ai’s motivation. I just wanted to present a count point to the argument that such modules have low value.

Very true, this is a reason i'm trying to distance myself from the NPM ecosystem actually... It's a cultural problem as much as a technical one, and it is ripe for exploitation... In combination with some of the NPM CVEs revealed in the past, it's pretty scary the reach and potential a single NPM package has for destruction and exploitation... and that is before even considering packages that get included in front and back end code for the web.

I don't think this is a fair framing. This isn't left-pad - it's a library that abstracts something people find annoying, and finding the right abstraction can be difficult even if the final code doesn't seem complicated. Add in a few years of bug fixes and whatnot, and it seems pretty rude to dismiss the result as "easily replicable from scratch".

I think it's worth pointing out that these pull requests replace a totally unrelated package with either one of these two packages that claim to be copying each other.

The way it was framed was that someone forked a packaged and started replacing all users; not what happened.

Also: I don't even use JS, so, I have no idea who these people or libraries are.

I was replying to GP's suggestion that the argument is over relatively trivial code, not to anything about the core dispute.

I think I made it clear enough that I was suggesting these packages are somewhere above the one-liners. While I agree finding the right abstraction is useful and takes time, I find it hard to apply that to a package that provides a function that wraps strings... I think it's fair to say that it's somewhat useful, but easy to replicate from scratch, and that's ok it deserves to exist - it does however considerably affect how different people perceive it's value.

But perhaps for contrast we should compare to the other end of the spectrum... Intel uses Minix3 in intelME which is part of every modern intel CPU [0]. Minix3 has a 3 clause BSD license which requires reproducing the copyright notice for basic attribution [1]. Which they failed to reproduce. Now in Tanenbaum's public letter, he politely suggested it would have been courteous if they had merely informed him of what it was being used for [2]... no mention of lack of attribution, no hysteria, no invoking of the mob on twitter, he didn't make even 1/10th the fuss this NPM package developer made.

Lets cut to the chase: The difference between these two people is that one cares about attribution way more than contributing to FOSS. They care about it to such a degree that makes me uncomfortable to touch their code, in-case of any perceived injustice against them or missed opportunity for self-promotion.

[0] https://en.wikipedia.org/wiki/Intel_Management_Engine#Hardwa...

[1] https://github.com/minix3/minix/blob/master/LICENSE

[2] https://www.cs.vu.nl/~ast/intel/

The difference is that someone pirated another person's software and tried to get away with it. Then that person's fan club wrote a bunch of nonsense to distract, deflect and cloud their malfeasance.

Attribution may not be a concern for career criminals but FOSS tries to stay on the side of the law. Otherwise, projects risk being "tainted" by copy-pasted code that could lead to even larger legal repercussions. ReactOS had its development shut down in 2006 because of mere allegations; they had to prove all their code was written by themselves

https://reactos.org/project-news/reset-reboot-restart-legal-...

wow... listen to yourself, this is FOSS, we aren't the MPAA. You are just banging the drum louder for the OP, nothing to do with what I said at all.

If you don't care about software licenses or attribution, then you're not apart of FOSS. Sorry, Tom

Am I right that this is the important part of the library?

https://github.com/jorgebucaran/colorette/blob/d1ff3a7/index...

I agree that the author clearly spent a lot of time polishing it, hence the pride and feeling of betrayal.

> The absolutely crazy thing is the person who caused this doesn't think they did anything wrong.

And now he's saying this of the person he took the work from [1]:

1. "I believe he is a good person, but love colorette too much and prefer impulsive actions ... Impulsive behavior can be very dangerous."

2. "Comments like this [https://news.ycombinator.com/item?id=28662796] shows that his behavior in that case was very questionable. Seems like he is systematically put himself in conflicts."

True or not, I find his claims of the victim having impulsive or questionable behavior, and systematically creating conflicts, ironic.

On a more positive note - it looks like both parties are starting to discuss a resolution [1]; maybe even co-maintainership of the original work in question [2]. I personally think that would take a lot of guts, from both parties, given everything that's transpired.

I also think johnnyshields in the linked GitHub thread [1] deserves acknowledgement for some noticeably simple, but effective, attempts at facilitating resolution.

[1] https://github.com/ai/nanocolors/pull/14#issuecomment-927346...

[2] https://twitter.com/jorgebucaran/status/1442055448899641348

GitHub / NPM / Twitter together with the conference scene seem to be leading to some form of insta-gramification of open source and programming in general it seems.

Edit: Maybe HN is to blame as well.

You are right I keep hearing in interviews, videos and blogs people talking about how many stars, please star me etc

There is something of a insane competition going on at various levels, people judging languages by their rank on various sources. Saying a specific language is "winning the race". We all know since the 70s that no language is winning ever. Calm down, code in what you like and people around you can use and understand. Create a new language, have fun... Things in life are not always a competition, you can relax.

I do like releasing everything I develop as FOSS, but we all agree that something like this can happen when we do, even though most of us (me included) find it at least distasteful.

Unfortunately this is what happens when any space gets super-competitive, then some people stop caring about spirits and anything else that's impossible to police in a meaningful way. JS is one of the, if not the, most popular programming language in use and it's incredibly accessible. It'd be (and I say this in the most polite and constructive way I could think of) silly to expect that stuff like this won't happen and that there won't be any group of people even cheering this kind of behavior.

We all seemingly live in bubbles, at some point we have to realize that we have the whole world in front of us in this crazy place called internet. Well, wasn't that the idea behind the "Eternal September"[0]? It'll not get better unless the whole world gets better.

[0]: https://en.wikipedia.org/wiki/Eternal_September

Somewhere around the 2012'ish era, programming attached itself to the "modern" world of politics, political correctness, etc. This was all facilitated through the hard-use of Twitter, an already politically polluted field.

Honestly the best thing you can do is just not use Twitter or Github for social reasons. It's almost a sport at this rate. People trying their best to create drama and false gods. It's almost as bad as LinkedIn.

That's Andrey Sitnik's MO. He's done it before (size-limit vs bundlesize, nanoid). Copy. Tweak. Logo. Repeat. He then goes around opening pull requests painting himself as author.

That development went social is really awesome. Like having the flu or something.

Arguments of other side explains a lot:

https://twitter.com/PostCSS/status/1441734989490446336

https://twitter.com/sitnikcode/status/1441878805337935877

That does not at all explain their overly aggressive approach and (initial) lack of attribution.

It explains their course of action, as Jorge was not flexible in his "my way or highway" approach. And I would also either ditch or fork earlier version, if maintainer of API is sabotaging my project.

IMO, making fork, instead of integrating or writing their own(without the need to acknowledge original author due to significant changes to a code) shows struggle of dealing with this situation. I think that it is too harsh to declare it as intent that is directed specifically towards Jorge, but they took that route where they were vulnerable to attack. In the place of users of Jorges API(because I'm not related in any way to anyone here - I'm just reading this piece an making my comment), if I knew that Jorge would be taking this to public and rally a mob to torch other side, I would be making my own code, but then I don't exactl'y understand using so many unowned modules on personal project, as it is vulnerable to do so in first place(it saves some time initially, but if they are improving code so much, that it is running faster, then that is not an issue to write their own) - and one of the vulnerabilities is exactly this situation.

I am sympathising here with Jorge, but only on that side where his efforts in making that API might be significant to him. I don't see anything else good from this situation, as he is not going to get back his main user and others might avoid using his other works because of this conflict. Well, he might have a temporary victory in getting his name in fork, but that will just lead to ditching any code of his in future. The important part is distinguishing author side and his ability to communicate with users and once again I can sympathise with him as author, but not as user, as his communication and solving issues are taken from defensive-aggressive side. You can like or dislike my opinion, but that does not change that fact.

> It explains their course of action, as Jorge was not flexible in his "my way or highway" approach.

I don't understand where this conclusion is coming from as it doesn't seem Andrey raised any concerns with colorette prior to his aggressive actions.

> The act of stripping git history and attribution while forking is itself malicious,

Well, okay, the forking could have been more politely, but author is a bit fast to pull the pirate card. It's a free/libre fork of a free/libre project after all.

> nanocolors implementation and API are the same as Colorette. You essentially pirated my work.[0]

[0]: https://twitter.com/jorgebucaran/status/1441728642711572486

free/libre does not equate to unlicensed.

Fork has violated the license of original by stripping the attribution and history.

free/libre != Do what you want

Copying and redistributing software without a license IS the definition of software piracy.

The current version appears to be MIT licensed. It is safe to assume that the fork was made under the same license. Given this assumption, and given that the MIT license requires copyright information to be preserved, stripping attribution is a license violation.

The claim of piracy is valid.

Reply on news.ycombinator.com