Granted, it's possible these commits are from people outside Ukraine, in which case, I wouldn't give them a pass.
If you want trust, use a (Linux) distribution as intermediary.
OSS is used not because it's safe or secure, but because the benefits outweigh the costs.
Correction: NPM packages are routinely hacked.
I've been using linux packages for two decades, and not once have they been hacked (to my knowledge). I consider those packages to be infinity more secure than proprietary packages where I and others can't check what's running under the hood.
OSS being safe and secure is one of the primary reasons why I prefer open source to closed source software.
I guess I wonder where you draw the line, and if this sort of incident is acceptable, why, and is the line being drawn arbitrary.
There are deeper issues with NPM: how many developers review or audit any packages they download anymore cause each time they pull a single package, it comes with 3000+ dependencies? I'm being hyperbolic, but "open source" isn't the issue here.
What certification are you even talking about if developers themselves can't be bothered to audit their 3000+ NPM dependencies at first place? It's too much work cause too much dependencies? Well that's the architecture NPM chose. I don't have that issue with Go, PHP or Java package management oddly...
I mean do you hang out in your kitchen hoping that Bezos will come by your house to borrow a cup of sugar?
Donate money, take in a refugee, if you're so inclined go fight on the frontlines but this kind of theater is only done because people want personal attention.
> is going to exclude that person from participating in other software projects
It's not targeted at developers. It targets end users. It shows a browser dialog containing the author's message if the timezone is set to a Russian city.
> isn't telling anyone anything they haven't heard yet
It's not trying to inform you. It's trying to inform Russian citizens by sharing an onion link to the BBC website so they could have access to uncensored information.
> is only done because people want personal attention
It's probably done because the author is Russian. It's stated in the author's GitHub profile.
It's also a red herring too. No answer to your question validates the original commenter's factual understanding of this incident. The commenter got the basic facts completely wrong, which highly suggests that the commenter didn't bother to look beyond the title. But it was apparently enough to label someone an attention seeker.
If you already have tor installed you are already capable of getting the information you want.
Put in onto social media, your website, your disclaimer, code comments, code license etc.
But never in the functionality of your code.
Virtue signalling will be the death of us. Wanting to look like you're doing something is winning more than actually doing something.
But fortunately, we live in a society where speech has an effect. Speech (which you derisively refer to as 'virtue signaling') shifts the Overton window, and influences the direction society goes.
It's ironic that you mention this, because the Overton window has been shifted so far to the left, I don't even think it's on the wall anymore.
Censorship is _rampant_ around the world. I'm glad you think it's all roses and daisies out there, but you have no idea how naive your perspective is.
If anything, the common trend seems to be insecurity and feelings of martyrdom among disciples of ideas that would have been considered batshit insane a decade ago. Have you completely failed to miss the boat where the American right took a hard step away from the center, courtesy of Obama, and later Trump and Q?
I repeat, as someone who moved out of a city to get away from much more than 'the occasional broken window', your perspective is naive and you look ridiculous.
> Is an election that the right loses actually a legitimate election?
That's a cute way to 'remember' it was the first time we did mail-in voting at scale, or did you also forget that in 2016 the media and left wouldn't shut-up about Russia infiltrating our elections? You know, if things were so f*cked in 2016, I'm not sure what changed to make the 2020 elections so impervious to fraud by comparison.
> Basic public health measures are tyrrany!
You do realize that the models for COVID-19 got more wrong the longer the charade went on? You do realize that for 2 years things such exercise and preventative care were put off for sheer virtue signaling through cloth masks? No, of course not, you're just another person who thinks we all made it through a 'pandemic' when worse pandemics have happened no sooner than a decade ago. Here's a hint: None of the measures during the pandemic were in the name of "public health" and someday in the near future, you'll learn in difficult ways why that is the case.
I truly hope you find the right way. From only two comments I can tell you're the type of person who thinks propaganda could never affect them, but is somehow hyper aware of the propaganda that is affecting others. It's the most dangerous type of pawn and you're the epitome. Congratulations.
You're not informed if you're just repeating what some billionaire wants you to.