Comment by kemitchell | Hacker News Reader

Comment by kemitchell | Hacker News Reader

Parent Full thread

This strikes me as hyper-defensive exercise in wrapping the lib thick with every cheap trapping of "community" to hand. I suspect because of the Open Collective handover.

In the end, this thing spits out strings. Does it need eight maintainers, only a few of whom had commits, in low double digits? Does it need its own GitHub org, Twitter account, and Google .dev domain? Addressing open pull requests could be good, but the rest of the roadmap looks like packaging, doc, twiddling with test infra, and more "community" again. That is also work, I suppose, but API and function feel baked. Before he did "bad", Marak did good.

Overall, the vibe here is self-righteous hostile takeover. That's a pretty fraught concept I don't see a need to go near. Maybe it's not fair or accurate, for those better in the know. But from the outside looking in, seems to me a fork, a new name, and a quick tweak to package.json could fully address the issue of another 6.6.6-like release, cleanly. No special deals with the platforms. Name brainstorm, clone, fork, push, and publish of existing MIT code would have been intensely normal. Especially in JS land.

I get that "community" is supposed to make me happy and calm. But in the end, I don't see anything here addressing root causes of what happened, or even speculating on what they might have been. Marak isn't the only solo leading projects who's snapped, and he won't be the last. It's convenient, but ridiculous, to say that has nothing to do with the environment we've built up. Plus we've learned a new way to lose donors, it being no mean feat to get them in the first place.

> In the end, this thing spits out strings. Does it need eight maintainers, only a few of whom had commits, in low double digits? Does it need its own GitHub org, Twitter account, and Google .dev domain?

I'm pretty sure the org and multiple people are to avoid a single point of (mental) failure - quite reasonable given the project history.

Also, if we really want to go that way, Google Search is also just a product that spits out strings. And a few orders of magnitude more over-engineered ;)

> But in the end, I don't see anything here addressing root causes of what happened, or even speculating on what they might have been.

Well, they have a larger team now, which can reasonably prevent a single person from doing that kind of damage when set up correctly. What other root cause are you looking for? Mental checkups for open-source maintainers? Redefining the "free" in free software?

If what happened here was mental health, I'm not sure more people is more better, from a security standpoint. If it was strongly linked to workload and maintainers' plight, I'm not sure more scope is, either. If the harm done was time wasted and confusion incurred, I wonder about users who got burned teaming up as a group of eight.

In any event, the median count of contributors to an open source project remains one. This team-up doesn't help projects != faker.js.

As for scope, I haven't looked at this source in a while. But it seems the strings are still static, in the package: <https://github.com/faker-js/faker/tree/29234378807c414158886...>.

In the end, this thing spits out strings.

That's not really a critism. 90% of web dev is string manipulation.

Not worrying about endian conversion or the format of your floating point is a very good thing (Yes, I'm old enough to have dealt with software developed on Intel machines having to be ported to run on VAX based machines).

Marak isn’t the only one who snapped, but he’s the only one to my knowledge who has introduced malicious commits to this code to purposely hurt other people’s projects. (Even Hans Reiser didn’t do that.) It seems that this might have been a precursor to Marak attempting to hurt people in real life

"Hospitalized Queens man charged with reckless endangerment after cops find bomb-making materials in his home"

https://www.nydailynews.com/new-york/nyc-crime/ny-queens-bom...

I’m not surprised with Marak’s behavior given his mental state. What surprises me is the amount of support he’s garnered for his actions with a lot of people on HN.

I don't think what he did was particularly good but I think he was entitled to do it. And the blame falls on the system we have which relies on random people to do work for free with no contract or obligation.

It's like if a business delivered packages by asking some random homeless person on the street to walk it to its destination. And then one day the person just chucks your package in the river instead of delivering it. It's amazing that the company got so much value out of a free service for so long rather than shocking that it eventually didn't work.

Open source works because we can trust authors to not maliciously harm other people. If it was a bug that's one thing it happens, you move on. But when you purposely do something that you know will cause harm to people that is where I draw the line.

Your analogy isn't even close. No one forced him to write faker.js. He chose to do it and he chose to make it open source under a license allowing people to use it. He also chose to maintain it and help people with issues. If he didn't want to maintain it anymore, It is his right to stop. No company could force him to continue. But he nor anyone is not entitled to add malicious code. Full stop that is where I draw the line. I can't believe anyone is defending that.

He chose to put a package online. He didn't sign any contract stating the package would meet some kind of quality obligations. He had no obligation to do anything.

Yes, it is particularly shitty to intentionally screw it up. But the system that put so much value on something not happening without any safeguards or obligations is the real problem.

The move fast and break things attitude of web development is the cause. A single rogue dev is just an example of the worst happening. In the future I imagine we will have package managers which do not give random individuals so much power. And we will rely on packages from trusted names, Google for example has a very very low risk of sabotaging a package compared to a no name individual. If companies had paid for this package, they could take legal action against the author. But they paid nothing and had no assurances of anything other than a vague hope it would continue to work.

He did something much worse than break a contract, he committed a crime that he could probably be prosecuted for. He did the whole thing with malice aforethought. It looks like fraud at the very minimum - he released a version with the intent to deceive, victims relied on his deception, and they suffered damages as a consequence.

Fraud requires that he used deception (I don't see any evidence that he did) to obtain something of value (again, I don't see it).

The code was open source. The code was published under a new major version number. The code had a descriptive change log that definitely didn't seem congruent with earlier versions. And he wasn't getting paid for it. What thing of value did Marak Squires defraud people of?

I get the sense that people are reacting with extreme hyperbole in their accusations, out of anger that he did something assholish.

Serious question: how is this different from 1Password publishing an upgrade that removes the ability to use standalone vaults in the iOS Safari extension?

At the end of the day, Marak published an update, knowing some people would update the software automatically due to their own workflows, and the update had negative effects on the users. Companies do this all the time and nobody accuses them of installing a "Trojan Horse" or committing a felony.

How did it come to this? Where HN, a place that is supposed to be genuine and curious, believes an act should be acquiesced to or branded a felony based on the individual's personality? Because that seems to be the consensus here and I find it disturbing.

He chose to put a package online. He didn't sign any contract stating the package would meet some kind of quality obligations. He had no obligation to do anything.

If there was a bug in his logic that caused an infinite loop in some scenarios he was under no obligation to fix it. While I think he should in that scenario, I would defend his right to leave it. Another maintainer could fix it, someone could fork the package, whatever.

I am not arguing he owed anything to anyone. I am arguing that he is not entitled to maliciously break things on people. He committed it knowing full way most packages would grab it automatically, most people are okay with that as if it breaks things they can go back a version no big deal. His package is so popular some people might not even realize that one of their dependencies relies on it.

We can argue about how much time you should invest in knowing your dependencies and checking every commit for them, until we are blue in the face. The reality is he knew most people just can't or won't especially in npm world.

There is no defending a malicious act. He is not entitled to commit code maliciously. OS works because we trust maintainers to do their best to have the best interests of the users at heart. The flip side of that is they are under no obligation to work on it. They can walk away at anytime.

If peoples idea of OS software starts to include that someone could do something malicious at any moment, that's the beginning of the end of OS.

> I don't think what he did was particularly good but I think he was entitled to do it. And the blame falls on the system we have which relies on random people to do work for free with no contract or obligation.

Utter nonsense.

You don't put out code under open-source MIT and then want to take it back when you realize other people are using it exactly as you instructed them to use it, which in this case is "anyway they please".

You have to think about this stuff before hand if you want to be compensated if it "takes off", there are other licenses you could use.

The MIT license doesn't prevent you from doing this. If someone cloned the repo, they could continue doing whatever they wanted with it, but the owner is entitled to put up whatever new code they want on their repo.

This is technically true. If he wants to act like spoiled brat and put malware in his own code, he can under MIT (he can do whatever he wants, just like anyone else can do with it).

> And then one day the person just chucks your package in the river instead of delivering it.

That analogy makes little sense.

In my county, what you described is malicious mischief, and is a crime. A homeless person is not entitled to act in such a manner.

Most of the companies that got hit by this (and any paying attention) will probably just change their deployment strategy to slightly slow down their updates. I guess this is equivalent to... I dunno, checking if the random homeless person had at least made one successful delivery? Except the analogy breaks down because code doesn't randomly begin to pick up different behaviors without any intervention (Well, hopefully!).

> What surprises me is the amount of support he’s garnered for his actions with a lot of people on HN.

Well, his motivations were somewhat understandable and his actions were still scratching the realm of acceptable (not cool, but no serious damage and nobody was hurt). It's actually hitting the pretty much perfect spot to generate lots of discussions, since it's very easy and understandable to argue for either side.

What he did was no where near acceptable. Instead of adding an infinite loop to purposely sabotage other projects, he should have either walked away or changed the license for future versions of faker into a much more restricted one. SugarCRM transitioned their software from open source to closed source, and they’re still here with paying customers. There are also many restrictive licenses that change depending on the type of user eg free for personal use but paid for medium to large corporations

> he should have either walked away or changed the license for future versions of faker

He could have, and nobody would be talking about or remarking on it at all, which rather defeats the point.

Actually, when redis changed their license to get paid by cloud services like Amazon, there was a huge uproar. The people behind redis didn’t purposely break anything, had a lot of people talking about it, and had a clearer way towards getting paid. There are better ways to bring attention to an important issue.

> What he did was no where near acceptable.

It was a rebellious act against (what seems like) overbearing organizations, comparable to spraying a graffiti on their walls. As I said, there was no serious damage and nobody was hurt; it's not like he burned down buildings or shot at people. I'm of the opinion that this was not the right way as well, but in the end it really wasn't that bad.

Changing the license would be just as “rebellious” and it wouldn’t have hurt anyone. It also would have drastically increased his chances of getting paid. Given his bomb making activities, I feel that this was more of an excuse to watch the world burn.

You don't get to tell other people what they should do for you.

But you do get to criticize poor judgement and provide reasonable alternative courses of action.

Nice bait-and-switch, but we can scroll back and see how relevant your defense of the comment I responded to really is.

Declamations are fine; declarations about what is "acceptable" and what "they should have done" are more than mere criticism of poor judgement, etc., and are what the author of the comment I responded to actually wrote.

> Instead of adding an infinite loop to purposely sabotage other projects, he should have either walked away or changed the license for future versions of faker into a much more restricted one

Then from the context, you can clearly read the comment you responded to did not mention that Makar needed to do anything for him specifically.

> he should have either [done this thing (that I deem would be "acceptable") or this other thing]

(This is my last response to you, since you were strawmanning from the beginning and this is obviously not going to go anywhere that doesn't involve intellectual dishonesty dressed up as a clever retort.)

Or ad hominem attacks.

I'm sure 6.6.6 threw a spanner in the works for folks who didn't lock deps. Not great. But Marak's one of us. This feels a lot bigger than that.

I don't have a direct line on what happened to him, or where it took him, mentally or otherwise. But the hints so far aren't great. To one of us.

I think the responses from the platforms---GitHub, OpenCollective---get folks thinking, whether they feel it that way or not.

What GitHub did was completely reasonable. They mitigated harm to their users on their own infrastructure and property. They did not change his code. They just took down his malicious code that caused harm.

The vast majority of people on HN would never purposely harm strangers. Most of these strangers are fellow developers ie “Us”

I understand some of the imperatives GitHub's people must have felt. I've advised folks providing open source infra under drama, though I can't talk details.

I'm sure the people who got burned on builds had bad days. It's not fair to blame them entirely, for not locking deps. It is fair to point out this isn't the first time builds have broken, with npm or other repositories. Nor the most widespread in effect. Does this count as a crisis?

If anything, I suspect a crisis of faith. Seeing bad things can come of `npm install`, and those bad things might be intentional or just plain weird, instead of well intended but accidental, can make people anxious. Publishers to npm don't just disappear or malfunction. Their faults can be byzantine. But there are defenses against them.

On the maintainer side, like it or not, we all have an editor when it comes to publishing on GitHub. But it matters how invasively that power gets wielded, and how heavy-handed it's perceived. This episode suggests to me that the threshold for intervention in the name of user interest's pretty low.

That's based on the information I have. Perhaps GitHub will share more on the blog.

If people want full control over their repo, then they shouldn’t use GitHub, gitlab, bitbucket or any other free service. They should host it on their own server.

This is an open and shut case. GitHub did the right thing.

> Marak's one of us

One of who, exactly? Marak needs professional help. This isn't a "personal army" situation.

A social scientist who has studied industrial sabotage might be able to correct me if I’m wrong: But I have read one (1) book on the subject—which frankly is one more then most—and I don’t think there is any evidence of correlation between industrial saboteurs and sociopathy. In fact, quite the contrary, saboteurs often go to quite a length to prevent people being physically harmed in the sabotage.

A saboteur is more often then not mostly frustrated at their employer, or the industry, and try to maximize harm to those entities, not innocent bystanders. However given that saboteurs are often quite angry and have often been in a prolonged state of stress, and most often act alone—keeping their plans secret until they are executed—they are often not in the best position to correctly estimate who will receive the most harm.

In our industry there are plenty of frustrated workers, some are underpaid, others are overworked, some work for entities they morally object to, etc. When a colleague engages in this kind of sabotage which causes disruption on some scale we might see it as an act of solidarity from a shared frustration. This is certainly the case in other industries, and I don’t think tech is any different. In fact this incident reviles that our industry might even be more vulnerable to industrial sabotage then other industries.

Most of what you’ve written is valid. The main issue I have is that you’re implying that software developers and engineers are “underpaid”. That doesn’t reflect reality. We are one of the highest paid professions in the US due to several factors. There is also a lot of career mobility ie If you’re not happy, change companies. The other issue is assuming that Marak is rational. I do not believe he is at the moment since he was involved with manufacturing homemade bombs at his apartment.

Reply on news.ycombinator.com