GitHub has now suspended the maintainer:
I think someone should make a big deal about this. What would be the first step?
On the other hand, my GitHub was once suspended (and all repos shuttered) for posting gists that looked like spam to some algorithm. It was extremely unsettling, and they need to do a better job communicating. But they may have suspended the account because they thought it was hacked, which is almost reasonable.
I assume that GitHub now lives in Microsoft-liability-fear mode. Expect them to police commits in popular projects.
If losing your Github means losing your projects, that's on you for being lazy/irresponsible with them. Git is already decentralized, and anything important should be cloned on something you own.
He could've done far, far worse in terms of the technical impact of these changes. It's obvious that he was trying to make a statement, not exfiltrate data to sell on the dark web.
It's scary because, as a FOSS maintainer, your code is your responsibility to do with what you will until it's no longer in the market's interest. You don't have the right to expect any sort of compensation for it, but if your project somehow becomes successful and you upset the natural order, all of the work you were told belongs to you that you should be grateful is so successful without being compensated for is now no longer under your control. There was never a business relationship to sever in the first place.
The market doesn't want to come up with a way to compensate FOSS developers with high-profile projects like these, yet the general expectation is those individuals should just continue working on these libraries for companies to profit off of them.
I wouldn't have handled this situation the way this person did, but we're reaching this point where legitimate protest and speech is being met with erasure and confiscation of your work, and that should scare everybody.
> This guy abused Github to distribute malicious code to thousands of projects.
That's one way to look at it. An alternative view is that a bunch of companies took some free code and shoved it into their apps and then got mad that the free code is causing them problems. Instead of examining the inherent contradictions of the FOSS community, commercial interests would rather just erase the protestor.
That's how protesting often works. Deliberately interfering in normal affairs is a very common protest tactic. Just look at the interstate shutdowns after the George Floyd killing, or going back to Rosa Parks and the Montgomery bus boycott, worker strikes, etc. etc. That's exactly how protest works.
Forcing application code to print statements like "LIBERTY LIBERTY LIBERTY" is very, very different than trying to infiltrate commercial systems and exfiltrate sensitive data.
If you pull random unverified code from the internet don’t be surprised when something breaks.
Let's decide how serious this is. Exactly.
I am, for one, of the opinion that it is not at all serious. Not deserving of a lawsuit or an account ban. Not even newsworthy.
I mean, this could easily become the new normal for OSS. You use it – you're not insured against anything, for there is no formal contract.
There is no Zuckerverse contract.
No, I haven't seen many people try to argue that the intent wasn't malicious. Most people seem to be arguing that it's fine and npm and Github should allow it. Or the classic you shouldn't trust random software. If you ever wonder why people like the Apple app store just look at the Devs in this comment section. Makes it kinda hard to trust you.
2. You originally claimed, " no its a criminal act. crashing RANDOM servers that you DONT know what they do ...". That is far removed from what you're talking about here. Which is not only misplaced, but also ignorant.
3. Your original claim also implies that the intended effect of the change was to crash "RANDOM servers". I disagree with that claim, and with your subsequent claim that that proves malicious intent.
----
I understand that you're upset — I suspect because you've suffered either this or a fate similar to many unsuspecting users of the npm libraries in TFA — and would like to see whom you view as the cause behind it (i.e., the author) suffer some form of punishment. But that doesn't mean you should support just about any harm done to them by any entity in the world.
GitHub is not a software distribution platform/marketplace. It is not an "App Store". The relationship between one GitHub user and another is not very similar to the relationship between an app store user and publisher.
If you pull someone else's code through GitHub, you're clearly making a copy. From that point on, that copy is your responsibility. That is how the FOSS world has always worked, and so has GitHub's model of public repos.
Now, if you ask me about npm, that is a whole different thing.
He didn't go around submitting PRs to update the version of this. He didn't deploy anything into production.
You have the right to use the code for free, and he has the right to do terrible things with his code. If you don't like that arrangement, get him to sign a contract that includes responsibilities on his part like not shipping intentionally broken packages. Or get your distribution from someone that does have a responsibility to you.
I probably wouldn't do the same in his position, but I still support his (moral) right to do what he did. It's his project, and he can tank it if he wants to. Just like if I had a business, I could tank it if I wanted to. It's probably not a wise thing to do, but it is something I could do.
No, that's not what the TOS says.
In the same way that being an asshole isn't illegal, doing "bad things" is not against the TOS.
> This guy abused Github to distribute malicious code to thousands of projects.
1. AFAIK he didn't abuse Github. He used the typical method of uploading code, into his own repo.
2. He didn't distribute the code, that was npm.
3. The code being malicious is your interpretation. Can code not contain political or nonsensical messages? I think people should be free to share code with political messages, or with nonsense if they want.
It's an alarm that should be buzzing through sleepy programmer skulls. It should alert them to the fact that it's no longer the small company that respected programmers, where you felt your account was yours, and your repositories were yours.
The rules have changed with that acquisition, and Microsoft exploited the good reputation of that small company and the inertia of its users. Step by step, the site became more "social", and started suffering from the usual issues. Step by step, we see the same bigco policies that treat users as worker ants. When an ant starts making up a mind of its own, queen ant sends some soldier ants to cannibalize it.
Now, I realize here on HN the tired old rants of Moxie are considered gold. But if you want to skip being treated like an ant, run your own server, maybe support upcoming federation protocols to kill this centralization and bring down the nest, or at least migrate to some place that respects its users in the meantime.
> What’s amazing about Github is how it really brings the social aspect into play. Chris and Tom are showing us all visually how git development is supposed to work. I know I personally had some bing moments once I started pulling in commits from external git repos.
https://web.archive.org/web/20080514210148/http://github.com...
Yeah, you're right: they weren't "one of the good guys" even before the acquisition. Microsoft were only the biggest and most well-known proponent, but never a monopolist of EEE.
I have to say, though, that every time in recent memory that GitHub has popped up in the news, it's for something that's made me sigh. The only thing still keeping me one of their customers is the painfulness of transferring over all of my existing repositories.
You are, of course, entirely right: GitHub shouldn't be banning users for pushing code to their own repository (with the exception of if the commit contains copyrighted or illegal material, which clearly is not the case here), nor under any circumstances should they be commandeering their user's code and continuing to distribute it without the user's consent.
Even if you do want to set up your own instance, it's very easy to do so. It's one of the least resource-intensive server applications I've seen - roughly 200-300 MB of RAM used on most days, minimal background CPU usage, statically linked Go binary or a Docker container according to preference. A Raspberry Pi with a few hundred megs of spare RAM or a sub $5 VPS will be sufficient.
What's so painful about "git clone"?
Oh, you mean you've locked yourself into GH by using some of their proprietary extensions, that isn't present in vanilla git?
But how is this even possible? Whenever someone dares claim that Microsoft never abandoned its old "EEE" strategy ("Extend" being the middle of the three Es), legions of HNers always rush to defend them and praise their conversion to Good Guys!
It wouldn't surprise me if banning the guy's account was the decision of someone at the npm team.
What is "malicious code" anyway? Maybe Microsoft Windows is malicious. It does contain code to format your disk.
Windows contains the rm -rf code, but you, as a user, would have to knowingly trigger it and confirm. It's not like windows tricks you into formatting your drive.
Directing the argument into windows is just whataboutism.
The repository contains the console.log code, but you, as a user, would have to knowingly download it and run it. It's not like pushing code into a repository tricks you into running the code.
Trying to "win" by labeling something as "whataboutism" is just idiotism.
Can you not see a difference between this and between releasing a new package with a README saying "this module will print 'liberty liberty liberty' to your console in an infinite loop!"?
Every developer is responsible for what goes into his project, including dependencies. When a developer wants to update a dependency, he is responsible for the appropriateness of the update. In order to get an idea, he should audit the changes. For personal code, such an audit may constitute of a quick skim to determine that nothing breaks. For production code, it may also include a security audit.
When a dependency that used to do X now does Y and therefore breaks your stuff, you are the one responsible for dealing with it. The author disclaimed any warranty and any fitness of purpose for his project, and whether his intentions make sense or not is of no consequence.
My point was that there is no such thing as "malicious code". Code is code, and it's your responsibility to determine whether it fits the context. That someone put it out there with an MIT license means the responsibility is yours.
P.S. Ata nishma bachur magniv, lama macharta et ha'autobus? OK, ro'e she'ata gar be-Sverige achshav (Scandinavia ze ha'chalom sheli) az mevin.
1) GitHub and npm are supposed to be separate things. There might be stuff in that GH account that affects other ecosystems. By all means block the npm account, but that should be it.
2) in the end, one is responsible for the packages one pulls. We keep relearning that lesson over and over, because global package repositories made us lazy.
Is that going to be true forever? I would assume not. There is already much deeper integration between github and npm than there was a few years ago, and Github seems to be going fairly deeply into CI and distribution.
Microsoft owns both Github and NPM. There is an obvious conflict of interest here.
If the source was maintained on Bitbucket, why the hell would bitbucket nuke the developer's account access? That's not their problem what happens on NPM.
Github and NPM are defacto the exact same company on the other hand. Github actions are in retaliation of NPM "mispublishing".
People cannot argue that it is open source with a license which expressly doesn't have any warranties, and then cry foul if the author deletes it for whatever reason. If it was that important, you should've had better processes in place.
> license which expressly doesn't have any warranties,
The license is about legal liability and has nothing to do with social norms. Though now that you mention it, I’m not sure if the “no warranty” clause will hold up in court when the bug is malicious and the author admits it was intentional.
You don't?!? That's bizarre... Here, re-read your first sentence: "He got banned on GitHub for what he did to HIS GitHub repos." I added some helpful emphasis; did you catch it?
If not, riddle me this: How many people did he force to download stuff from his GitHub repositories?
a counter-factual that isn't known or proven.
May be bitbucket would also nuke the repo, if NPM asked them and show proof that it contains malicious code. It would prevent spread, and would prevent damage.
> a counter-factual that isn't known or proven.
No, it's a question. Questions can't be "known or proven"; only answers can.
It's fine to host code that contains any instructions, as long as the intent of that code is not to trick someone into running malicious software.
In this case, if the author had updated the documentation sufficiently along with the change to make it clear what the new behavior was, that would have been fine?
I agree that malware is unhostable. And in this case I think the author crossed the line. But I am concerned about getting that line defined in a way that restricts project owners from making whatever changes they want in their own self-interest without tricking people, per se.
This is obvious from the fact that GitHub won't suspend your account for releasing a new version of a package that has breaking changes... Clearly there is a scale here. The only disagreement is about where the line is.
IMO, if the package author had simply deleted the code - ie. published a new version with no functionality, then no action should be taken against them by GitHub or NPM. For this example, I think suspending the account is OTT, but I think NPM would be justified in reverting the package, since an infinite loop is somewhat malicious: and by that I mean that nobody would reasonably expect a package to hang just from importing it. If the package actually deleted data, then both the suspension and NPM revert would be justified.
In no other circumstances do I want GitHub patrolling what users commit to their own repositories.
Of course, if you pull my code and run it sight-unseen, and are damaged by it, you have a right to be upset at me (and possibly sue me) but that's not something I want GitHub to (try to) police.
If my code has a licence which provides no warranty, then you can use it, but any damage is your fault, that's the point of the MIT license.
Are they now gatekeeping the kinds of code changes you can make to your own repo?
So some ToS could override the software license for your project? In that case I don't see why anyone would use github, ever.
I for one think that it makes sense - if I have an identity on github, it can only be turned off gradually, not immediately.
I would say, maybe suspend github services for the account and put a timer - 30 days - on suspending the github identity too.
right...
No human has been harmed here. No property has been substantially harmed either. Anything he "stole" should've been made public for free in the first place.
the future is exhausting sometimes.
Github doesn't have the right to tell someone what to do with their own code. The only right thing to do in this situation is to fork the repositories and fix the situation on the npm side. Github doesn't get to ban this guy because he took a dump in his own backyard.
EDIT: I suppose the literal DoS attack in the code probably puts him squarely in the "malicious behaviour" category which then gives github the right to do this.
Obviously people wouldn't use that source code if they didn't want it.
> GitHub hosts a wide variety of collaborative projects from all over the world, and that collaboration only works when our users are able to work together in good faith. While using the service, you must follow the terms of this section, which include some restrictions on content you can post, conduct on the service, and other limitations. In short, be excellent to each other.
Yes they most certainly do.
Also, his landlord gets to ban this guy because he was building bombs in his apartment.
https://abc7ny.com/suspicious-package-queens-astoria-fire/64...
https://www.qgazette.com/articles/more-charges-possible-for-...
https://nypost.com/2020/09/16/resident-of-nyc-home-with-susp...
https://www.reuters.com/article/us-usa-new-york-bomb/new-yor...
If you perform action in obviously bad faith, your account will be suspended – it's very simple.
Github's terms of service must have somewhere detailed description about it.
Please, point me to the part where bugs, intentional or not, are disallowed.
Taking over someone's account is not justified; for this, definitely, but I'd say it's never is. Block the account yes; take over, no.
>GitHub has the right to suspend or terminate your access to all or any part of the Website at any time, with or without cause, with or without notice, effective immediately. GitHub reserves the right to refuse service to anyone for any reason at any time.
github owns your account -- if the github company thinks they should terminate your account, they will.
note that they didn't do that to faker, since it had a major revision: https://www.npmjs.com/package/faker?activeTab=versions
I'm not very familiar with npm/js, but isn't this policy since left-pad?
I would say that github is actually taking a stance that's reasonable of an "OSS author's union", if it existed - penalize one bad actor to recuperate the standing of all of us.
As another commenter said[0], this is malicious code and THAT is against the ToS of npm[1].
[0] https://news.ycombinator.com/item?id=29865977 [1] https://docs.npmjs.com/policies/open-source-terms#:~:text=Co...
> I don't understand why
If he can break his code because he is the owner then shouldn't the same reasoning apply for Github suspending the account?. It is their website and their rules. Keep in mind Github owns npm and the author has published a malicious package to npm which has 20 millions of downloads so I'm not surprised.
This is a library, not standalone software. Breaking it means breaking the code of every software which uses that library.
> No warranty means he isn't liable for any behavior of the software at all.
Somebody should tell all those computer virus authors, all they had to do was not include a warranty, and they're untouchable!
The users of this software pull it, explicitly, voluntarily. The author says it doesn't serve any particular purpose, and in using it you understand that. the software itself did nothing malicious, it just stopped working. It's not the same thing as slapping a license on a computer virus and forcibly foisting it onto an unwitting victim. It's not naive legalese loophole workaround thinking. When you choose to use the software you agree to abide by the license, which includes no promise of utility whatsoever.
No, those other programs importing it is what breaks them. They do that themselves. Or does he have push access to all their repositories?