One hand, this is a seemingly non-violent and subtle way to protest. On the other, the potential collateral damage is huge and just burns all trust with this developer, and is a net harm to the ecosystem as a whole.
FOSS is great, because we were actually able to track the changes here. But it also points out how many packages go un-checked and just installed into a container running with root permissions.
> One hand, this is a seemingly non-violent and subtle way to protest.
You can't be serious. Being non-violent and subtle is no excuse for deliberately making software have real side effects on a computer that it's not advertised to do, especially a node library. Node modules for some reason tend to be very small and have trivial tasks like checking if something is a number. Imagine if everything shipped with it's own political malware.
No matter how you want to spin it this is completely unacceptable and nobody should ever trust this developer again.
> But it also points out how many packages go un-checked and just installed into a container running with root permissions.
The fact that "packages go unchecked" doesn't make this okay either.
Doesn’t necessarily make it OK, but this will only affect the sloppy.
Then people could write their own code to check if something is a number.
Anny assumptions or claims beyond that are your own delusions.
I would imagine web developers over there, being more educated, technical, and exposed to the West, would be the ones less likely to support the war.
There's nothing subtle about wiping files, why not provide news and information that's being blocked? This could have been an information bridge that would be hard to censor. Hell, run a crypto miner on their machine and donate to Ukraine if you're trying help, that'll have more of an impact then wiping some poor dev's files.
> why not provide news and information that's being blocked?
Radio free europe style. I like it
It's not really an issue to bypass blocks (how do you think Russians access rutracker). Especially not for a person who is capable of doing something with NPM packages.
I don't know how to feel about this because it's not much different than sanctions in theory (very different in execution). Cause pain for people so they "force internal change."
It's not something to root for gleefully.
If this move broke some key software used on the battlefield, would we all be so quick with our positions?