Hacker News Reader

Comment by no_wizard | Hacker News Reader

Is it though?

Was it malice when maintainers started adding those posinstall scripts asking for funding? which lead directly to the creation of `npm fund`, for instance. Was that also malice?

Given all the evidence we have - I think its murky. That's my point, at the end of the day.

Arguably, I could say that making millions of dollars off an open source library and not contributing back is malice - yet that argument is rarely given the same open and shut approval.

Mind you, this is bigger, IMO, than `faker.js`, this raises questions around open source software as a whole, that are relevant in this case and beyond

There's nuance in this conversation that is missing so far.

View on HN

I keep seeing this comment that companies are making their millions 'off of open source libraries' and it's a catchy phrase but let's be real the big companies that are using faker JS are making an insignificant amount extra by using that library, there are alternatives to mock data, etc. A key feature of MIT style licenses is that you can do whatever the hell you want with it for free, use a more restrictive license if you don't want people making a bunch of money off your code. I feel bad for this maintainer but a good takeaway is probably to not do a bunch of work for free unless you see a path to income down the road from it.

It is actively anti open source argument. It makes limited sense in subculture where contributing to open source is expected, but that subculture is absurdly small and answer to it is "this absolutely should not be mandatory".

In any other context, it is argument against open source existing.

> Was it malice when maintainers started adding those posinstall scripts asking for funding? which lead directly to the creation of `npm fund`, for instance. Was that also malice?

No, because that did not impair use of those libraries whereas this change deliberately broke every program written by someone who trusted him and used his code under the social contract he offered.

Open source maintainer funding and burnout are real problems but betrayal won't make things better. Imagine if you lived in a house with a bunch of roommates who weren't doing their share of the housework — you're entirely within your rights to stop volunteering to clean the toilet but it's crossing a line if you instead modify it to flush up.

What is being described here is a prototypical case of industrial sabotage. Books have been written about it, the jury is very much not out on whether we should consider it malicious, although I very much consider it not... In fact industrial sabotage is quite often made out of love for the fellow worker.

This is very much a philosophical question and I doubt we will resolve it here on HN. However if you want to deem this act malicious I beg you to ask your self: To whom is the malice directed towards, who was harmed the most? What does this act tell us about the industry?

I, on the other hand, see this sabotage as a clear act of love from a fellow worker.

Sabotage is still malicious even if you sympathize with the motivations.

I would also strongly question any “fellow worker” explanation since I'm sure the pain will almost universally be felt by the “fellow workers” who have to update things, reassure their security team, or increasingly start justifying their use of open source software.

As is usually the case in most direct action. Your average strike will cause much further harm then this act for other workers. However the goal is not to halt production, halting production is simply a means to an end, the goal is usually better working conditions for the rest of the workers. This is why you often see workers stand in solidarity with strikers even when the strike directly harms them.

In that case, this is extremely weak since it was so quickly and easily reversed. A strike which has no purpose or chance of success tends not to get much support.

> To whom is the malice directed towards, who was harmed the most? What does this act tell us about the industry?

It certainly wasn't directed at the large corporations, they have many systems in place to mitigate this type of attack. It was directed at everyone else, like fellow open source devs, contractors, hobby developers, students, and small to medium businesses.

The goal simply appears to be chaos and attention.

If you publish your code under a license that says anyone can use it for free and don't have to contribute, don't act all hurt when people and companies do just what you said they could.

If you want to get paid, or you require contribution, use an appropriate license. It's not hard.

Reply on news.ycombinator.com