Is Open Source Free If We Aren’t Allowed to Break It? | Hacker News Reader

Is Open Source Free If We Aren’t Allowed to Break It?

thenewstack.io

15 pointsbelter23 comments

This story has been going around for a couple weeks. It's illustrative of some of the misunderstandings both the public and those of us in tech have.

Free and Open Source software - of course you are allowed to break it, the insert malicious (or even useful) fixes. The author can do that - but so can anyone else. There's literally no moral or ethical problem with what Marak did.

The confusion is that, using github is nothing to do with "Free and Open Source". Centralized package managers like node.js are not FOSS.

You can do whatever you want from a copyright stance - but you can't necessarily expect publish it on someone else's platform or force others to use it. Their platform - their rules. Marak's "own personal" account is shown to, well be not really his own. Yawn - you thought micro$oft would be different?

Freedom does include the "right" to be a dick, but the way that works is we've also got the right to fork, shun, banish, AND ignore you and take over "your" published works (which are not really "yours" are they?)

> Free and Open Source software - of course you are allowed to break it, the insert malicious (or even useful) fixes. The author can do that - but so can anyone else. There's literally no moral or ethical problem with what Marak did.

It might not break the tenants of FOSS, but that's not the only part of being "moral".

I am still a bit surprised with the (in)famous equifax hack they didn't try to sue the developers of Struts. Seems like the next logical step these days... Too many people (me included haha) accept that we can use someone else's code without due diligence, licensing considerations (remember reactjs patent bomb?), security checks etc. We all like free things and developing software is expensive and someone out there doing all the work for us for free and we also become aggressive and grumpy when their code breaks. Something is wrong here. I think you should either live on approved supported old versions of "free" software (while paying Red Hat, for example) or do it yourself but then you are on your own.

You have the freedom to break it, but you can't force people to run the broken code.

This is very similar to freedom of speech. You have the freedom to say stupid things, but you can't force people to listen to your ideas or let you yell them on their lawn.

Someone recently commented here on the difference between a right and a power. I think that was very illuminating. Forcing people to run your broken code/listen to your opinions is not a right or a freedom, and framing it that way is misguiding. It would be a power, which thankfully Marak doesn't have.

...Marak didn't force anyone to do anything. He just orchestrated events to temporarily inconvenience those who thoughtlessly parasitized his work without a second thought. I'm amazed people aren't more up in arms about Microsoft locking him out of his own GitHub, or reverting it or something? NPM has always hosted old versions of things, so it was symbolic in that sense.

Microsoft are the ones who flexed power here, not Marak. Marak momentarily caught people who should have known better by surprise. Microsoft abused their privileged position to do self-interested damage control.

> He just orchestrated events to temporarily inconvenience those who thoughtlessly parasitized his work without a second thought

I understand his frustration but he explicitly gave everyone permission to do exactly that in the first place with the license.

Should have known better than to download and use his package, for its intended use, off of the Node package manager?

If someone breaks into your house, do you also claim that they should have known better than to use off-the-shelf locks? Come on man.

You're allowed to break your own copy. Other people are allowed to keep their copies in working order.

The point is the developer was not allowed, by github, to break his own copy, they suspended his account.

This is a reminder of how much power you cede to Microsoft when you decide to make yourself completely reliant on their free services.

I think it would have been fine if that code had stayed in a separate branch, or a separate repository. You can create a repo and put all the silly print statements and infinite loops you want, and Microsoft will leave you alone.

If you mount a supply-chain attack, deliberately overwriting a package you know people are relying on with code that will break their systems, that is something else.

Maybe GitHub should have frozen only this one repo, though I doubt that would have made a difference in the public response. But you can't really say that they banned someone's private little experiment here.

As to the power you cede to Microsoft, that is a weird way to phrase it. Microsoft gave you the right to use their platform, for free. All they did is take that away. That is not much power at all.

I want to point out my latest example of a supply chain attack that's going on all the time: GitHub Actions

GitHub Actions uses tags to represent it's versions, which would be great if GitHub locked down tags. They don't. Every GitHub Action I encountered in my first foray into the technology a couple weeks ago included a "Publish" script - that as it's first action, deleted a tag! And then reused that tag.

This is absolutely a supply chain attack, if not a malicious one.

Yeah I feel uneasy about using third-party GitHub actions. I suppose you could use `action@<hash>` syntax instead of a tag... At least actions are usually self-contained, you don't have the same problem of transitive dependencies you have in npm.

This came up in another thread on here about the event, but how does this action outwardly appear like anything other than his account being compromised to some kind of moderator?

It seems like access was restored pretty quickly because within hours of the whole thing going down and reading about him being banned, I could see it was already restored.

Anyway, if my account started to sabotage my projects, I’d hope GitHub would suspend it until there was a better understanding of what was going on.

It's github's copy, not his. He's effectively a volunteer maintainer of a github/MS owned repository.

There is the "moral" side of the question and the "ethical" side of the question.

Morals are rules YOU live by... so, if you feel you should make a known damaging change to your FOSS project and that fits your "morals"... then, yes, (deliberately) break the code.

Ethics are rules EVERYBODY lives by... so, if you feel you want to make a known damaging change to your FOSS project... then, no, don't (deliberately) break the code.

If your Morals don't align with Ethics then you see this as an issue.

If your Morals align with Ethics then there is no issue.

That... while admittedly convenient, I dare say, is not quite how those words are used. Morals, (standards by which one judges wrong or right, and which are generally shared within a culture) are the subject of the study of the field we call "Ethics".

Though in your defense, language is organically morphing, linguistics descriptive moreso than prescriptive, and it is not an uncommon way of seeing those two terms used.

It makes me think back to when I had to convince my boss open source was ok and safe to use at work. It was an uphill battle for years. It gives open source a bad name to play shenanigans like this.

... so your boss gained some amount from using FOSS. Did the FOSS projects gain anything from that? If not, why should they care if your boss wants to pay a different group to supply him software under more restrictive terms?

he'd better find out how much the other option gonna cost him before jumping to conclusions ))

No, it should give those who don't safely use FOSS a bad name. You audit code you pull in right?

You're not one of the thoughtless ones who just YOLO's updates, right?

The license plainly states the software might not work and comes with no guarantees of it not breaking things:

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

In this case i don't think he should face legal problems, but people throw this around like its a blank cheque. I hardly think that's true.

Like imagine someone found out their package was being blindly used in a life critical application and the maintainer intentionally sabotaged it. Yes it would be the fault of the people who used it blindly, but im pretty sure the license wouldn't get the maintainer off of murder charges.

There would be no murder charges in that case. The developer of the “life critical application” has sole and ultimate responsibility to ensure that their product works as advertised. The developer of a dependency that they happen to use has no such responsibility. If the application developer updated his dependencies and then didn’t bother to verify that the application still works correctly, then that would be open and shut negligence.

Reply on news.ycombinator.com