The maintainer appears to be unwell:
https://abc7ny.com/suspicious-package-queens-astoria-fire/64...
Lately he seems to have come to the belief that Aaron Swartz was intentionally targeted because he discovered evidence of child abuse at MIT, which is a pretty far fetched claim that seems to just be riding on the Epstein media attention.
That's why a judge often has to determine if the person is mentally ill or just a criminal.
There are plenty of situations where someone has hurt other people and they've been literally insane.
If your insanity causes you to believe that someone is doing horrible things like murdering children you might decide to do them harm, thinking you're the good guy.
In reality you have paranoid schizophrenia or a litany of other mental health issues.
It's not cut and dry :-/
Another article: https://www.njhomelandsecurity.gov/at-a-glance/9-21-20
Unless there is other evidence, you’re just blindly speculating as to his intent.
This thread and press coverage is just reputation damage. Most newspaper articles are not even 90 % true, so rampant theories go floating until innocent some people are burned for life.
The author's twitter also commented about loosing their possessions in a house fire in October 2020.
Or maybe his crypto bet went in a poor direction...?
https://web.archive.org/web/20081020082418/http://www.jimbas...
Focusing on the troubles of this one person is a mistake. Of course the more "unbalanced" individuals will crack first. But we should expect more and more to go the same way (not necessarily by sabotaging their code though).
This model of software development is unsustainable.
I don’t think this is right. It seems very sustainable as evidenced by 30+ years of sustained OSS development.
It seems very sustainable as we live in a time of the best OSS software ever produced with more high quality software than ever produced by ideological volunteers.
I’ve seen statements similar to yours and they just seem so at odds with reality.
The big question is what happens when a maintainer wants to retire and a successor can't be found? Or (as in this case), when a maintainer gets so annoyed by their users that they refuse to continue co-operating with their user base.
We don't really have an answer for either of these questions yet, and we won't bump into them until maintainers get old or angry. But we have been predicting that this problem will happen.
Now we're bumping into this problem, it's our new reality. What's the solution?
That’s there’s only been a few problems like this despite millions of users is a sign of strength.
I hedge by pinning yo specific versions and keeping my own package manager (RStudio) to keep mirrors if the packages I scan. That the packages are open source means they are easier to scan or fork.
If a maintainer stops then the project can be forked. If nobody wants to fork then that probably means no one cares enough. And that’s ok.
Mostly it forces us to be flexible. I don’t think software is a thing but a process or cycle.
If a thing has an expiry date that is >10 years, then you're not going to see any problems for 10 years. That doesn't mean the expiry date doesn't exist, or that the thing won't hit it. It can be wildly successful for all those years and then hit the expiry date and stop immediately.
I’ll take a decade of success as a sign of sustainability over a package maintainer losing their shit as a sign of h sustainability.
I for one enjoy if anyone makes money with help of my code. I very well know I wouldn't have made it so far without many many others having chosen this way before.
I'm happy to contribute code, or documentation, but that's not the same thing.
https://www.reuters.com/article/us-usa-new-york-bomb/new-yor...
I think this is a person that has been driven to the absolute end of their patience. If he's really barely been getting by, then I can only imagine the sheer frustration he must be feeling. Not only are there swathes of fortune 500 companies which depend on his package but don't contribute a dime, but he also had a company with millions of dollars in funding look at his idea and then weaponize his own project to beat him to market.
Or to lock up his Github account for exercising his prerogative onto his own code?
His behaviour is unusual, but that, you know, could change easily. It could become the normal just like that. Puff.
Yes, certainly. I think this is sane because with OSS you can control it if you need to. Until then use what exists. It’s sane to use Linux in my project even though I don’t control that. I suppose it’s also sane to use Windows even though I don’t control that.
Brave man.
There we are.
"they can legally copy your Intellectual Property"
But let's be honest - if they hadn't copied his, they could have easily used the Ruby or Perl version. All he did was port a previous library.
faker.js was inspired by and has used data definitions from:
https://github.com/stympy/faker/ - Copyright (c) 2007-2010 Benjamin Curtis
http://search.cpan.org/~jasonk/Data-Faker-0.07/ - Copyright 2004-2005 by Jason KohlesIt’s a contentious topic, but last I heard people here tend to believe it isn’t (as long as it’s Google copying Oracle’s stuff)
- Copying an interface for the purpose of providing a compatible implementation (what Google allegedly did - although of course part of the debate is whether they also copied any of the implementation)
- Copying parts of the implementation, not for the purpose of compatibility (what faker.js did - in this case, copying constants)
The faker libraries are all that -- compilations of mostly non-copyrightable facts.
I'm not saying faker.js did no wrong, just saying if hypothetically a purported copyright owner sued him, they would have a really hard time proving substantial infringement happened given the available precedents.
But I don’t see how GitHub has the right to suspend him and rewind his work. I mean, that has to be a copyright infringement if there ever was one.
And the code is open-source under the MIT license, so GitHub can do with it as they see fit.
You can copy it and claim ownership over that, but it doesn’t allow you to remove the author from their work and then keep the work as your own.
The author has a right to delete it if they want to.
No he's not, and you're just trying to be outraged. Just fork the code if you don't trust him. Oh, but you don't want to take his place as the maintainer? Maybe deep down you know that there's still a difference between being in charge and submitting the occasional pull request?
Your actions contradict your words here.
A maintainer role could be to just accept some occasional pull request if he don't want to make it a bigger project.
I agree. It was an irresponsible prank. But Microsoft didn't fork the projects. They hijacked his digital identity on two of their platforms, instead. I find that much disconcerting than what this one maintainer did.
For them it must look like a malicious hacker took over the devs account, and reverting the malicious actors changes is exactly what I'd expect of a responsible custodian.
If you want to trick people into downloading malicious software, don't do it on someone else's platform.
_faker_ is already gone from our project. The parts of faker that we were using were almost trivial to implement ourselves... probably should have done that from the start.
The biggest thing that excites me about the possibilities for the future of smart contracts is that creators of all kinds could automatically benefit from any work they do.
This scenario, for example: Any company that used faker.js to make a profit would have X% of that revenue feed back to the smart contracts. The creator would probably get the most, followed by the maintainer, then anyone who had a PR approved, then maybe people who submitted good bug reports. All automatically, and all directly in to everyone’s wallet.
Not only would this be an easy way for creators to get paid, it would also incentivize the maintenance of those creations.
And if you didn’t want to get paid, you could simply have funds directed to charity or opt out of your share entirely.
>Any company that used faker.js to make a profit would have X% of that revenue feed back to the smart contracts.
Doesn't work in the real world. If you rely on them to tell you what their profit are for a project, they'll just give you a value of 0$ and continue to not pay you the same way they did before. The blockchain/smart-contracts adds no value compared to changing the licence on your code because either way you have to beg/sue them to get paid.
Even with a client who is well intentioned and wants to pay you, they will never want to link their profit to a smart contract and expose their financial data. Measuring profit btw is very complicated and there is a lot of human interpretation to it, you can have a company worth bilions of dollars with top employees making millions per years even if it technically has never made a profit.
And also, the risk of a bug in the smart contract emptying their account would be enough to stop any serious companies.
If we were in a different version of the world (which we might end up in), it will be a no-brainer for someone to create a company that openly builds on the work of others and shares profit with those others. It democratizes the "I only need a small piece of a big pie" business model.
Not every commit is worth the same level of compensation.
Companies like Google/Amazon have to go through and adjust compensation based on talent and contribution levels, but how would that be done in Open Source?
In [my] ideal scenario it's not the people that are vetted and compensated, but the work itself. A student who comes up with a particularly genius contribution could be compensated as equally as someone who worked in the field for decades and proposed the same contribution.
Note: it also requires an environment where work is recorded publicly so that plagiarism is essentially impossible, though that brings it's own challenges.
> I totally agree that it does not work in the current version of the real world.
Quick notes:
- I'm talking about a hypothetical ideal future as I see it, and why that's exciting to me
- I don't think we're anywhere close to where we need to be for this to be realistic. More like 50+ years when we figure out patents, copyright, delivery, and fine-detail privacy-friendly monetization (person X purchased Y because of seeing a billboard and having conversations with sales rep Z.)
- I like moonshots. I think that setting big ideals as goals is a great way to get to where we can be as a society and as a planet. No one else is obligated to share that mindset or those goals (or even agree that those ideals will get those goals)
If a founder came along and saw that a specific open source project could be the foundation for a business, then they could use it to build that business and feed back a portion of all profit as an operating expense. Then everyone involved would be benefited by contributing.
Honestly the project would be better off forked. He did not write this library entirely by himself, at this point I just see him as holding other committers contributions as hostage. It's a bad look, why would anyone want to deal with him after this stunt is beyond me.