When ‘node-ipc’ overwrote all files on disk, NPM just waited while the author himself published an amendment and posted that the package ‘only created a text file, no biggie’.
But if they did, people might die for real, if suddenly important information about patients is gone or manipulated. Or a important operation had to be canceled because of it. How can one critizise bombings of hospitals and then potentially do the same on a software level?
Get over yourself.
I think the main concern of the OP was with _human_ collateral damage that can result from the deleted bits. Having worked for years in EMRs, I can definitely say that sustained IT outages in modern hospital systems can and often do lead to increased deaths.
I usually oppose “whataboutism” but I can’t bring myself to do it here. This is a war where the nation of Russia has decided to murder Ukrainians. Means to interfere with Russia’s blood-soaked campaign must be viewed not in isolation, but in the context of what they are attempting to stop.
To be clear, I am not making a general purpose “the end justifies the means” argument. I am making a narrow and specific “the circumstances justify extreme behavior with severe externalities” argument.
Now, there's nothing this action could achieve aside from making people angry, becoming Russian propaganda-fodder, reducing trust in NPM, etc, in any remotely likely scenario. So any damage is a crime, and arguably even the possibility of damage is a crime.
* A strike on head of ISIS while being surrounded with a class of children might pass this test. Similarly even if one side (say ISIS supporters) has more civilians killed that does not imply a crime by itself.
Yes, this is a warcrime. But the proposed solution is to react with a warcrime?
I do not agree.
War sucks for civilians. It sucks less for the civilians who get some files deleted than for the civilians who get their houses shelled by Russian and Belarusian artillery.
Does the NPM project have a general duty of good stewardship? Of course. Does the NPM project have a duty to interfere with a developer who chooses to increase the misery and pressure applied to a nation that has been committed to a path of an unjust war of aggression, which is deliberately bombing civilians? Fuck no.
Regardless of one's positions on the Ukraine war, I don't see how manipulating node packages could, for example, stop a Russian hypersonic missile or fortify Ukrainian barracks.
By the way, if you look at the damage to Ukraine's infrastructure and human capital, it has already lost the war. Also evident by repeated calls from Zelensky to resume negotiations. He badly miscalculated from the start...