> It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors.

He's not banned: https://github.com/Marak

You have to keep in mind that his changes were basically indistinguishable from a security breach of his account. Nobody really sabotages their own repos in a malicious manner like this. Suspending his account while they investigated doesn't seem like a stretch.

> This was his own corner of the internet for him to publish his own personal projects.

Which he's still free to do. But the actions in question had nothing to do with his "personal projects". It was specifically about his actions to intentionally break popular Node.js packages and do so with a version number that would disguise the change as a non-breaking update. It was a malicious act, and there's no way to paint it as anything else.

It was a malicious act to the users of his project, sure. But how was it a malicious act to GitHub? I'm glad to hear that they reversed the suspension, but without understanding why it was suspended in the first place, it leaves open the question of what GitHub's motives were in the whole situation.

If DHH decided that Rails was contributing more harm to the world then good, and tried to remove it from GitHub, would GitHub lock his account and restore his repos "on behalf of the community", to side with the smooth operation of the open source ecosystem over a user's personal decisions? To what extent has GitHub decided that they "know best" for the open source community?

It was malicious act to Github's users.

Github first responsibility comes to the community of users it supports, then to any individual user. Free speech/ personal choice / Freedom of expression come secondary to the welfare of its users.

Is it a slippery slope ? Yes, but Github does not have a choice if it cared about the interest its community

> malicious act to Github's users

Usually if I modify my car in my own backyard (aka my property) it is nobody's business to intervene, as long as it's on my property.

Legally speaking, fakerjs was Marak's property and GitHub has no right to intervene with a legitimate user action.

I can see that they "tried their best" but we also have to uphold the law here. If GitHub, say, called him on his phone whether or not his actions were intended...they would've had to restore the account and the "broken" repository as it was before the suspension immediately...which I assume they did.

My point is mostly that there is no legal contract between Marak and the "community", as he was never paid anything. Some might argue about mitigations in between disagreeing parties, but as I said there's nobody forcing you to use his library, just as there was nobody forcing you to update.

It cannot be malicious intent if the other party is free to decide to just ignore it and move on.

This code has never belonged to Marak. This code is ported from other existing projects which had been acknowledged by Marak.

I see it like this. I can't buy a Harry Potter book, translate it to a different language, maybe change some of the character names and then claim ownership while not acknowledging the original work even if I publish it for free.

It's like you and your friends building a Mustang in your backyard, all of you put time, energy, and even money into the project only for you to turn around and claim you invented a new car model built entirely by yourself. No, it's a ford and most of the upgrades were done by others. People that helped you might feel that you are in fact being malicious.

Since we're using analogies, this wasn't his backyard, this is the GitHub's yard.

The ToS of GitHub state that it's not their property, they only claim the license for redistribution. If it would be their property, legal cases (e.g. DMCA) would be against GitHub, not the owners of the repositories. So from their point of view they do not want to be legally responsible for the code they're hosting.

So I'd argue that it wasn't GitHubs backyard. They might be the landlord but they can't take ownership of the things that you build in your (rented?) flat.

Don't get me wrong, I also agree with you. For me this whole situation is kind of a paradox where there's no easy moral (or legal) answer on what to do, and on what society already has agreed upon.

In fact, this action could set a precedent that allows RIAA/MPAA/etc to sue GitHub because it demonstrates they curate and editorialize everyone's code, effectively.

> This code has never belonged to Marak. This code is ported from other existing projects which had been acknowledged by Marak.

Completely irrelevant to the issue at hand, though. The copied code was copied in accordance with an open source license. By this same token, the affected users/companies are free to start their own fork, but they didn't. The developer shouldn't be under any obligation to maintain anything, and GitHub shouldn't be intervening in these kinds of situations as that will simply serve to dull the positive effects these scenarios could have on the dependency landscape (people actually figuring out their shit). This is the package equivalent of a bail-out. At the end of the day it hurts more than it helps.

If you modify your car in your backyard sure, but it wasn't his backyard, it was the public roads, and it wasn't (just) his car, it was his car that he shared with his neighbours. And then he decided to tamper with the brakes as a "prank", knowing full well that others would then use the car.

No. Imagine if all traffic lights were 3D-printed, and that entire infrastructure depended, as an active dependency each time a new traffic light is printed, on some random guy's 3D model that he decided to post on his personal blog years ago. Guy decides to take down the model, now all of a sudden his hosting provider takes control of his site and forces him to put the model back. That is the lens through which you should view this situation.

The people building infrastructure that depends on one guy's 3D model existing on his blog at all times were the ones who made a mistake. If one of your thousands of dependencies breaks, shame on you, make a fork. The dependency owner owes you nothing, and he can change his creation or remove it any time he likes. If you weren't fortunate enough to fork it while it was still up, then too bad.

Instead we as a corporate community are encouraging coddling and ensuring that if you make this mistake, GitHub, NPM, et al will take care of it for you. The downstream effects of this are much worse than the temporary damage of making people actually figure out their dependency chains.

> It was malicious act to Github's users.

I'm not sure why it matters they are Github users. The packages were hosted on npm through Cloudflare - does that allow Cloudflare to take over the packages too? And NS1 since they host the fakerjs domain?

It’s cool that you’re internet rules-lawyering and all but ultimately he used his free account with intent to harm others, just as surely as if he backdoored his code. Freedom of speech is good, and protest is fine, but why would GitHub amplify the speech of a nutso who abused his position of trust?

>he used his free account

actually, marak has github pro, so it is not a free account

“Your freedom of speech ends at the tip of my nose.” as the saying goes. He took a swing, not just a stand.

> used his free account with intent to harm others, just as surely as if he backdoored his code

There's a huge difference between displaying a message and going in an endless loop and backdooring as in providing an alternative access to control a system you're not supposed to have access to. Words have meaning. This wasn't a backdoor.

There is a difference between robbery and burglary.

There’s a difference between a simile and a metaphor too, but GP is ignoring the fact I used one of those entirely.

They don't have to amplify anything. This is why open source is valuable; if the current maintainer is considered to be unfit or unreliable in some way, the community that disagrees with their rhetoric/leadership can fork the package and keep going like nothing happened. If you don't care/the package is still usable, then ideally no further action has to be taken.

At no point down the road should that involve revoking someone's ownership of a software project, though. Software ownership is sacred, not just because of tradition but because understanding who owns your packages and libraries is paramount to auditing security. Some of the most valuable contributions to computer science have been ones that allow people to verify integrity, be it SHA, TLS or GPG. If Microsoft abuses their position of power to break that chain of integrity, how can we be sure that other repos belong to their respective authors?

I can understand if you, the individual don't find this interesting or consider it inconsequential to your workflow. But other people rely on it, and you can't pretend like an honest chain of custody is somehow valueless.

Amazing you wrote this entire comment without taking a second confirm the premise you're so passionately defending...

No one took away his ownership.

Marak:

https://github.com/marak/Faker.js/

https://www.npmjs.com/package/faker

Post:

https://github.com/faker-js/faker

https://www.npmjs.com/package/@faker-js/faker

Faker.js is not a trademarked term, so someone made a new Faker.js.

In fact multiple people did, and one emerged as the preferred fork: https://twitter.com/faker_js/status/1481918305669627905

-

And to be clear, even if NPM goes and replaces his package with this new fork, it wouldn't take away his ownership.

Github could do the same... doesn't take away his ownership.

His ownership of a Github page is not his ownership of the code.

I don't like this rules-lawyering stuff either, yet this is one time where even if you decide to be purposely inflexible with your understanding of laws/licensing/contracts etc... there's still no issue with how this has been handled.

I see only one of those alleged "nutso's", and that was GitHub.

Everyone else should have been responsibly consuming the dependency. You don't get to call foul when you knowingly use something for something important and don't check to make sure it is okay.

Now that’s just plain victim blaming

As an engineer, part of your responsibility is to foresee this type of thing. Software that does exactly what it should, and is free of defects for it's immediate use case, has no need to be continually updated. As each line is adding more functionality you do not need.

Even if you're trying to keep things rolling forward and buy into taking in updates anyway; you don't do it in such a way as to cause it to leak to production until you are good and certain there is no potential for breakage. If you haven't learned this yet, give a monorepo a try. I assure you, you will be divested of any naivete in this regard.

Setting your package version to allow for minor updates _is_ responsibly consuming the dependency.

This sounds like "I responsibly test in production".

If you do test and isolate testing environment then this kind of breaking update is just business as usual.

That's fair, it does sound like a novice take; but it's still "business as usual" w/r/t what is touted as best practices where it comes to version control. At least that's my slightly above novice take on the matter.

> does that allow Cloudflare to take over the packages too?

Fundamentally cloudflare can do that if they so chose. If your threat model doesn't account for that sort of action then you should reassess.

Can != Should. we're not discussing whether Cloudflare had the physical capability of being able to take over the packages. We're asking if they should. Many people seem to believe that they should have, or would have been justified in doing so, and others disagree.

If the attack had been conducted by retargeting cloudflare at a hostile upstream, maybe so. But the attack originated at GitHub, so they're the ones to take action in response.

People point at github repositories all the time for packages.

Github owns npm.

This is an opinion you can have, but it's far from clear that it's an obvious or inherent one. What is the Github "community"? Who constitutes it? If I use Github for a personal project, and share the link with my friend, are we "part of the Github community"? How were we harmed by this incident? Did anyone say "We should shut Github down because they're irresponsibly hosting someone who would use his public JavaScript libraries to make a political statement"?

How was Github's community, specifically, harmed? A lot of developers were inconvenienced, but they would have been just as inconvenienced if he pushed the code to NPM from his local git repo, and never touched Github at all. Where does Github come into this?

It sounds like you’re looking for very clear lines which can and can’t be crossed. Whereas others see a blurry grey area in which GitHub makes judgement calls, and then individuals decide whether or not to use GitHub.

Mm, not really. There are lots of cases much more blurry and questionable then this one. What I'm looking for is 1) a recognition that Github would be in the wrong to suspend Marak for doing whatever he wanted with his own open source project, and 2) an acknowledgement that it's important for Github to be transparent about why they took the actions they did and what motivated their actions.

I still keep failing to see how it's malicious to gh users and I've red all your comments.

If I ever get hacked someday and my repo gets defaced, I hope GitHub acts just as they did to Marek. GitHub can’t tell the difference between an authorized and an unauthorized defacement, and I’d rather they err on the side of caution in this regard. It protects me against attackers, and the only risk of false positives is having to reauth and verify to support that I’m an authorized user when I’m trying to deface my work.

Github will not allow you to use your personal corner of the platform to propagate malware, and hasn't allowed it for many years.

Exactly this. The changes were intentional malware, designed to break the usage of these two modules. GitHub is under no obligation to assist you in hosting malware. The fact that these changes were intended by the original author has no bearing in this situation.

I don't get how people don't understand this.

Breaking a build in a way that is trivially rolled back is not in the same league as pushing code that harvests email addresses, CCs and mines bitcoin.

I'm disappointed to see this kind of comparison made.

Deliberately breaking people's applications? It's malware.

Appreciate it can be confusing to the layperson, but a build is not quite the same thing as an application.

A build will often reach out, download and install new and potentially breaking software components and it is part of its function to prevent breaking software components from reaching the application where it could cause material harm.

It was a bit of code printing ascii art in a loop, with a preceding comment "don't commit this", and we have bo information about whether it was put into the release on purpose or malicious intent afaik. Is it really malware?

If I set up a nice shopfront and invite customers in, and then start kneecapping everybody who walks through the door, you gonna bet the city will have something to say about it. I'm not kneecapping the city, just its citizens, so why should they care - and I'm doing it on my own property which they voluntarily entered after seeing my "dollar store" sign out the front - so it's their own damn fault for believing my sign.

There is a fundamental difference between physical violence like kneecapping and industrial sabotage which causes a minor temporary disruption in production, which is why the former is punishable by most national laws, while the latter isn’t.

> industrial sabotage

> causes a minor temporary disruption in production

pick one

ETA: if someone created a virus that would just display the text "you've been hacked!" and then that virus infected thousands of computers around the world, that someone would have a visit from the FBI with very serious charges. I don't see how this is different.

> Pick one

I don’t understand. Industrial sabotage is an act of vandalism with the intended purpose of causing disruption in productivity. This incident in particular only caused a relatively minor disruption not much bigger then e.g. a partial github outage.

> I don't see how this is different.

The difference is in 1) the intended targets. This incident was targeted against particular industry. The worm you are describing would be indiscriminate and would have the potential to be 2) much larger scale and therefor you could deduce the 3) intention of your hypothetical attacker would not be to cause disruptions of productivity withing a particular industry, but rather to prank random strangers. The difference is rather obvious.

GitHub's market is developers. They want to do everything they can to protect that community, and if a developer uses their service to damage other developers, they aren't going to stand for it.

> It was a malicious act to the users of his project, sure. But how was it a malicious act to GitHub?

You can't use GitHub to perform malicious acts, even if the victim isn't GitHub. GitHub isn't obligated to support anyone's malicious acts with their platform.

> If DHH decided that Rails was contributing more harm to the world then good, and tried to remove it from GitHub, would GitHub lock his account and restore his repos "on behalf of the community", to side with the smooth operation of the open source ecosystem over a user's personal decisions? To what extent has GitHub decided that they "know best" for the open source community?

GitHub hasn't done any of these things with faker.js.

Marak deleted the code and replaced it with a non-functional repo that has a README.md that just says "What really happened with Aaron Swartz?" (Reference to a conspiracy theory)

It's still here. You can still see it: https://github.com/Marak/faker.js

Exactly - that really looks like malware. If the same sort of replacement happened with rails, I imagine the same course would happen there - but if there were some corresponding blog post or reasoning in the Readme, GitHub would leave it to the community to let the drama play out (maybe still investigating to see if the login was suspicious in any way).

I would say colors.js definitely can be considered malware. He in effect intentionally spinlocked a lot of packages either directly or indirectly via transitive dependencies, and also intentionally bypassed common semvar rules to maximize the damage.

whether or not those packages should have been affected is another discussion, but it appear it probably had more of an effect on other open source packages and perhaps the work of small mom and pop companies rather than huge corporations.

To an automated protection system that detects “repo deletion + index.html rant” commits, deleting the codebase and updating the README would red flag instantly except for the different filename, and catch lots of garden-variety intrusions.

The deletion here was more complex, and most likely a human was assigned to review user reports to GitHub Security, who accurately determined it was a defacement from someone claiming to be the author’s credentials.

Turns out the author was the attacker, and with that confirmed, it appears that their access was restored so they could proceed with it.

> Turns out the author was the attacker, and with that confirmed, it appears that their access was restored so they could proceed with it.

I suspect this is how it played out as well. In fact, there was a lot of people on Twitter who were questioning whether the author really got suspended since he was posting to github a day or two after he posted his suspension picture.

Like I said above: if that really was how it happened, I would be totally okay with that, and it's completely understandable. But without a public statement from Github on such a visible and public controversy, we're left to speculate on their motives. Many people here disagree about why and whether Github should have or did suspend Marak. I would say that your view is the maximally charitable view to Github themselves. And frankly it's very likely to be true. But it seems like a lot of people believe that Github should have suspended his account, and I disagree with that.

People don't just believe his account should have been suspended, they feel that he should be prosecuted and charged with civil tort given the comments. I think they are ridiculous Karens who would destroy open source in a heartbeat given the opportunity.

> GitHub isn't obligated to support anyone's malicious acts with their platform.

Github isn't obligated to support anyone's anything, your relationship with Github is entirely at-will. And yet, I believe that there are moral boundaries on how Github should act, and that different people can disagree on where those boundaries are. I do not believe that "updating a popularly used library to break it's core functionality" is harmful enough to the other users of Github-the-code-hosting-site that it necessitates intervention from the owner of the platform. I think specifically that the way in which Github came to the determination that this change was "malicious" is unclear, and that Github very clearly has a conflict of interest when it comes to determining which sorts of political speech are "malicious", and which sorts are allowed.

> GitHub hasn't done any of these things with faker.js.

Correct, that's why it's a hypothetical question. If Github is willing to intervene against "malicious behavior" on behalf of "the community", then the obvious question is "which behavior, and which community?"

As another hypothetical example, the https://996.icu/ website is hosted on Github. Chinese browser manufacturers have implemented a pop-up that calls it a "illegal and fraudulent site" if you navigate to the repo. Is this "malicious" behavior? Many in China would think so, and definitely the browser manufacturers seem to believe that it's malicious behavior targeted at Chinese tech companies. Should users be allowed to use Github to perform this "malicious" act, even if the victim isn't Github itself? If Microsoft was criticized for their Chinese offices' working conditions on the site, do you think this would change their viewpoint on whether the repo should stay up? Personally, I would hope that those within Github who are responsible for making such a decision wouldn't take such personal matters into consideration.

> Reference to a conspiracy theory

I'll be honest, I didn't know this was in reference to a conspiracy theory. Aaron Swartz was driven to suicide by the relentless and cruel prosecution of the United States government, and the inaction of the MIT administration. That incident is tragic and sad enough as is, and I hope it goes without saying that don't agree with anyone attempting to co-opt that tragedy for their own conspiracy theories about Qanon. But I don't think Github should be responsible for making the call on whether something is "good" enough political speech to be worth protecting.

I completely agree with this take.

I am completely baffled by folks defending Marak, or putting any sort of blame on GitHub. What Marak did was not "political speech". If he wanted to, he could have easily done any of the following:

1. Pulled down his repo, or replace his repo by whatever message he wanted to send.

2. Output his political message during the build.

3. Heck, all faker.js does is output fake data for things like names and addresses. I think he would have been well within his rights to make this data something like "123 Fascist Way, Fascistville, NY".

But he didn't. He replaced his code with an infinite loop that was a DoS attack. He deliberately released it as a patch version because he knew it would be pulled in by others that follow semver rules. The fact that his attack wasn't more severe (like, say, encrypting someone's hard drive) doesn't mean it wasn't an actual attack.

And for those quoting the "no express or implied warranty" section of the license, I guarantee no legal system is going to let an actual malicious act be defended by a license.

What he did was utterly unprofessional, hazardous, and outright dangerous to those who trusted and used his library.

By putting it on Github, he surrendered a portion of his right to distribute to Microsoft, and Microsoft did the best course of action to protect their reputation and the interest of their stakeholders.

I see nothing wrong with this.

> professional

then pay him? I'd admit that this person didn't really contribute anything really worthy. But please do not require someone to be "professional" when you did not pay him a dime.

Unprofessional as in done by a person I wouldn't hire in his current mental state.

> hire him

So what you do mean is someone had to spend hundreds of hours maintaining some projects you've been using and also should have perfect personality and well behaved enough before you hire him?

I would prefer to avoid people who sabotage stuff and literally build bombs.

How was it hazardous or "outright dangerous"?

You see a build fail, you pin the previous version of that dependency, run the build again and go on with your life.

Asshole move? Sure. Hazardous and dangerous? Don't be dramatic.

There is a little bit of dissonance here. Microsoft, a multi billion dollar company who works with organizations such as ICE which routinely engages in human right abuses and causes sever suffering and harm to thousands of people who are already pretty vulnerable.

vs. an open source developer who’s work benefits companies like Microsoft who have no obligation to pay for that labor. And engages in a single industrial sabotage which causes minor disruptions, and harm which at most costs other developer some time and temporary frustrations.

I feel like we need some sense of relativity when we attribute nouns such as hazardous and dangerous here. Especially when we are talking about Microsoft.

Indeed, he definitely could do his protest in a way which wouldn’t inconvenience billion dollar companies or even anyone.

Just like BLM could protest in a remote location or do an online petition. Except that no one would give a fuck about that. The same about a message during the build.

You call it a DoS attack, I call it a brownout warning about unsustainable open source funding. After all old versions are unaffected. No hidden RCE there. Only ones who opted in for pulling a new version without due diligence (aka free shit lovers) experienced a minor inconvenience. He didn’t do anything a malware author would do with such distribution channel.

I would definitely do it some other way, but can’t blame him. If he had put a notice during the build, no one would see it. If he added an unskippable five minute timeout to that message it would a DoS attack as well.

I suffered a similar “DoS attack” myself. By Microsoft. They did one hour brownout of Devops pipelines still using windows server 2016 or something, to warn about unsustainably of supporting them (striking similarity). Right at the moment we had to deploy an urgent hot fix for our client. If there was a notice somewhere, I didn’t read it. No one does. Which is why they do brownouts. He didn’t put an early warning, but that might be a difference between a multibillion company and some random guy on the internet.

He is unprofessional, but well, don’t expect professional behavior from people you don’t have professional relation with. Who I would call unprofessional, are the developers who expect free working shit from some random internet guy and have audacity to complain when he intentionally releases a broken version to protest taking free stuff without giving back.

I’m mildly entertained by the uproar caused by his protest. Reverting to an older version of a library is not an end of the world. I think it is not caused by the minor inconvenience he caused to the lazy devs, but by the threat of the end of relying on free work from open source devs.

We will have to do it ourselves or pay for it. Like in any other industry.

Did you not read his message? The entire point was to inconvenience billion dollar companies not helping pay or foot the bill for all the software they use and steal unpunished and unscathed.

Be careful not to confuse defense of the individual with criticism of how Microsoft behaved.

Microsoft behaved as a good steward of both a code-hosting service and a package-hosting service in the face of an attempt to exploit both to harm users.

Correct. You basically never have the right to commit sabotage

Except that it was his code, and it's open source therefore the risk of using said code is your own. It's his project, He's under no obligation to maintain it in a functional state or at all just because you happen to use it. That's just egotistical and narcissistic on your part

You're wrong. If I routinely share my lunch with someone at work, I don't get to poison it because "It's my sandwich, I'm under no obligation to make sure it's safe just because you happen to eat it." Hell, I can't poison it even if someone's stealing my lunch.

I can't create code with malware. I can't modify my code to make it malware. That's a crime. You're wrong

Everything about your comment is wrong. For one you're not giving your lunch to anyone, More analogously you're putting something in the refrigerator, and people can take at their own leisure and risk. You can poison it if you want, in fact it's a pretty common workplace tactic for people to mix in something like a laxative to THEIR OWN food because they're tired of it being stolen everyday. Again you make the choice to use the software, or take the food, the risk is on your head.

And the cybersecurity industry would like to have a word with you since you don't believe it's possible to create malware.

You're wrong. You literally just described assault or (best case scenario) a tort

https://law.stackexchange.com/questions/966/can-one-be-liabl...

> I can't create code with malware. I can't modify my code to make it malware.

I guess I can appreciate your confusion but I still think I was clear in my previous comment. I'm willing to concede I would have been more clear if I had written:

I can't legally create code with malware to distribute without a warning. I can't legally modify my code to make it malware if I know people are using it.

PS I'm not discussing this further

"I am completely baffled by folks defending Marak, or putting any sort of blame on GitHub." Github's actions are unwarranted. (Marak should have at least been able to verify his ownership of the account and get it back)

"1,2,3" Honestly, these ARE better things to do (and probably more effective) than what Marak has done.

"replaced his code with an infinite loop that was a DoS attack" So far I haven't seen anything about this actually causing harm and denying service.

"The fact that his attack wasn't more severe (like, say, encrypting someone's hard drive) doesn't mean it wasn't an actual attack." The fact that his attack wasn't more severe shows that he wanted something that would make an impact without hurting anyone.

" guarantee no legal system is going to let an actual malicious act be defended by a license. " That's the legal system's problem. The license is the license. Somebody's violation of an EULA (because they didn't read it) may be in all ways justified, but that argument probably won't hold up in court.

I wish he did something less controversial while still impactful, but it is incorrect to put it under the same term used to describe real cyberattacks that severely harm and kill innocents.

General rule (at least for me) is to avoid people wanting to be a people-pleaser or politically correct without offering real tangible solutions at the problem on hand.

What he just did is intentionally mess with the society for the heck of it and naturally the society will find ways to fix it and restrict him as necessary, right.

> I am completely baffled by folks defending Marak... > I think he would have been well within his rights to...

I think this is the crux of it all. I (and many others it seems) disagree with the actions he took and think they're shitty, but also think he has a right to do this with his code that he provides and publishes for free.

> It doesn't feel like there was enough criticism against GitHub for their decision to ban the developer of faker/colors.

HN, at least, had a ton of discussion on this[1]. People advocated both ways.

> This was his own corner of the internet for him to publish his own personal projects.

No, it wasn't. It was Github's corner of the internet and then it was Microsoft's. If he just wanted a place to publish his personal projects, he could have put them on a personal, self-hosted website.

By putting them on a social network, like Github, he is submitting to their whims. He doesn't have any legal right to stay on that site if they want to kick him off of it.

He also wasn't the only author. Other people contributed to his repos. He was happy to receive the benefits of Github, and he should also realize that it comes with some loss of control.

Notably, he eventually used Github as a platform to deploy a Trojan to thousands of unsuspecting users. The other circumstances don't matter. Microsoft can and should remove Trojans from Github.

1. https://news.ycombinator.com/item?id=29877745

> By putting them on a social network, like Github, he is submitting to their whims. He doesn't have any legal right to stay on that site if they want to kick him off of it.

Of course, legally speaking, Github can do whatever they want with their website, but we're not talking about the legal aspect.

The developer community has put some trust on Github not to do whatever they want. It's an implicit, non-legal, non-enforceable, social agreement that Github is going to "respect" our user accounts on their platform as long as we don't break the TOS.

They could delete all existing repositories tomorrow, and replace them with pornographic images, and they would probably be in their legal right, but that doesn't mean that we can't critizice them for it.

I trust GitHub more based on their actions in this case. They acted to prevent further attacks and gave him access back after it was mitigated.

> but we're not talking about the legal aspect

Yes we are. I was responding to someone[1] who was alluding to the legal aspect using legal terms s/he clearly doesn't understand.

> > "What GitHub policy did he violate? The really outrageous thing is that the developer going "rogue" was actually him expressing his freedom of speech..."

1. https://news.ycombinator.com/item?id=29961662

GitHub acted reasonably to mitigate harm. They didn’t delete his older commits or “replace it with porn”. They acted reasonably unlike Marak.

FWIW, GitHub's actions here have in no way damaged my trust in them.

They interpreted a developer's attempt to harm the community via abuse of the trust the community had placed in him as damage and mitigated it in the short run. That's a value-add.

Value add in to who? It sounds like you believe open source developers owe something to someone which simply isn't the case. You should evaluate the license(s):

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

I don't see where this license obligates github to distribute future versions.

Also if we're expecting people to do the bare minimum specified in their license, github's license gives them all the leeway they needed for their actions too.

GitHub is under no obligation to distribute further versions. Neither is Marak under any obligation to maintain and upkeep the repository. While in bad faith of the community, you are the consumer who CHOSE to use his software, free and at no cost to yourself. You have no right to dictate how that repository is used, especially if you never donated or contributed to the project itself.

> While in bad faith of the community, you are the consumer who CHOSE to use his software, free and at no cost to yourself. You have no right to dictate how that repository is used, especially if you never donated or contributed to the project itself.

Either we're going by a legalistic interpretation of the terms in which case Marak was free to fuck up his project and github was free to kick him off npm for it, or we're agreeing that people can be held to moral standards apart from legal ones.

If we agree that moral standards about bad faith should prevent npm/github/microsoft from taking control of something that Marak has put work into, then we should also be able to agree that moral standards should prevent Marak from releasing a deliberately broken version of a package as a fuck you to corporate users. Even that action of Marak's I think is wrong, but the backlash also landed on many open source projects.

I don't have a problem with GitHub or NPM taking down his project. Just like I don't have a problem with him poisoning it if he so chose. I do have a problem with people here whining about their own selfish wants. Again not one person is obligated to use faker.js, if you wanted the security that parts of your code base would not be tampered with, then you probably shouldn't have been using a third party library that wasn't under your control in the first place. Common sense is all too lacking here across the first world.

At the end of the day, open source is built on trust. Even the more paranoid-architected flows outside of npm (checksums via side-channel, curated package distributions maintained by a third-party such as debian) don't protect the end-user from actual malicious action on the part of the trusted source. Consider the story of how Univesity of Minnesota got banned from adding patches to Linux (https://www.theverge.com/2021/4/30/22410164/linux-kernel-uni...). In that case, they were caught. But if they weren't caught (or if a critical mass of Linux maintainers went rogue and were in on it)? Enough malicious actors with the right credentials can publish and checksum a damaging package in any system that allows code reuse. It is, perhaps, riskier to rely on a system with one maintainer. If that's the case, moving Faker .js to community controlled was a great first step in restoring trust in the package; it's harder to compromise a group.

We can sit here and cluck our tongues and say "Should have known better than to trust someone else's code," but that's just victim-blaming. Marak broke trust. He took advantage of a system with a vulnerbility and he exploited it. And everybody uses a system that is vulnerable in some way.

Because he did this, the system interpreted his actions as damage and routed around them. The system may change to make this attack harder in the future. And the result will be more complex and have more failure modes, and everything will be slightly worse as a result because we have to replace with process what we were previously able to do with human-to-human trust. "Nice job breaking it, hero."

IANAL but i highly doubt that that license would protect you if you were being intentionally malicious (as opposed to say grossly negligent).

I'm just as much an armchair lawyer as the most of the rest of HN but my understanding is that liability waivers aren't considered enforceable if malicious intent or gross negligence is involved. Anybody with more legal expertise want to clarify?

I am also not a lawyer, but this is what I found for NY and would be surprised if it doesn't apply in most states and many other countries too:

> Under New York law, a party can waive ordinary negligence, but not gross negligence, reckless conduct, willful/wanton conduct, or intentional acts. See Kalisch-Jarcho v. City of New York, 58 N.Y.2d 377 (1983); See also Restatement (Second) of Contracts § 195 (1981) (“A term exempting a party from tort liability for harm caused intentionally or recklessly is unenforceable on grounds of public policy.”).

This would be like suing a food pantry because they stopped giving out free food.

Marak didn't stop giving out free food. He intentionally poisoned a food delivery without notifying the recipients.

Using your food pantry analogy, it sounds more like he should go to jail.

He didn't deliver food. People picked up whatever they could find cause they felt entitled, and then said... oh look there was a sign here all along.

If we're stressing the analogy, Marak put food out in a park with a sign "Take the food, just tell everyone you got it from Marak, quality not guaranteed".

Then one day the food had laxatives because he felt not enough people put money in the tip jar.

I think that would still be actionable. Most people wouldn't bother, just like I don't think anyone is seriously thinking of taking Marak to court over what is mostly broken CI builds, but maybe the park staff won't let him offer food there anymore.

There was no more "food". An loop in a script isn't malicious, as a user can terminate a script and by running an unknown script they are assuming some liability as well. What you're advocating for is that if an open source developer changes their code, even to say, prompt the user to confirm executing when before they didn't prompt and that somehow breaks automation that the user has built (not the developer) then they should be liable for harm. It sets terrible precedence, and the end result is no on will want to create open source software anymore. I can only hope you are simply playing devils advocate than being serious, cause if you are serious then I hope you reap what you sow.

"By eating food of unknown provenance they are assuming some liability as well" isn't really an argument that would hold up in a court of law if someone intentionally taints the food.

> What you're advocating for is that if an open source developer changes their code, even to say, prompt the user to confirm executing when before they didn't prompt and that somehow breaks automation that the user has built (not the developer) then they should be liable for harm.

We should probably divide the conversation into two threads: one on the tainted-food analogy, and one on the changing-code reality. Because they aren't the same, and one can reach weird conclusions trying to conflate them.

Liability for tainted food is pretty settled law. If someone eats your food and gets sick, it's a problem for you. If they eat it and get sick and can prove you poisoned it, it's a real problem with real legal consequences. Food handlers and preparers go out of their way to avoid both of those scenarios.

Intentionally modifying code knowing you'll break downstream consumers hasn't been tested (to my knowledge) in court, so we can set that aside. But is it immoral? That's going to depend on one's morality, but I have a hard time seeing my way to agreeing with the standpoint "Sure, it's moral. User beware." That principle, written large, creates a strictly worse world, where people are hiding in their digital caves, unable to trust anything outside. A lot of people (including GitHub and NPM's owners) are trying ot build something better than that.

Marak had a right to do what he did, but that doesn't mean it was right, we don't have to agree that "because he could, it was good" (that's just rule-by-power, and almost nobody thinks that's a good moral philosophy), and I applaud the open-source community who stepped in to minimize his harm.

GitHub doesn't = open source community. Quite the opposite actually. It is a closed system designed to take open source software and put it behind a closed-source ecosystem, and apparently to moderate open source developers and taking away their individual freedoms.

How was Marak's individual freedom taken away? They locked his account temporarily (because what happens looked like somebody had stolen his credentials and impersonated him)... Then what happened?

His freedom to post what he wants in his repo does not extend to a freedom to screw users depending on the software he licensed for open source use working. GitHub and npm took steps to protect users from his malicious actions.

Value-add to the people who actually use github to build software, of course. It's fine to discuss license terms and what you should or shouldn't expect when you use github/npm/etc, but in the real-world JS landscape, many projects (commercial and otherwise) use many open-source packages through complex dependency hierarchies.

Your can think what you want about whether that's good or bad, but it's unquestionably our current reality. Protecting JS projects from malicious updates, regardless of whether or not the project license technically permits this by the author, is clearly in the best interest of users of this ecosystem.

No one took steps to protect JS projects from malicious updates. They took action in this one case but did not fix the underlying issue which is with package managers.

It is true that there are some vulnerabilities in the standard design for npm package management. Packages are designed to assume by default sources can be trusted and to pull aggressively. That's a system that's very convenient for developers... Assuming somebody doesn't use it in an extremely malicious way by building our trust with a working package and then pushing a change designed to screw users.

Fortunately, it appears the system has been stress tested now and we can see how that damage can be mitigated. If this kind of attack can be minimized by what is essentially moderation and curation, everything's good.

The only reason anything happened cause the developer intentionally crippled their own package which they had the right to do. If someone was modified a package to do something actually malicious you could go months without ever finding out.

I don't disagree that there are degrees of harm and differences in the ease of detecting such harm. But what's the significance of the distinction? Whether it's found out immediately or found out months later, the remedy for the community will likely be the same if the damage is widespread enough... Flag the version as bad in npm, break the connection between npm and the GitHub repo if the damage was purposeful, and the community picks up the package and starts maintaining a non-malicious version.

What you are going to get is people separating out into 2 camps, those that believe in individuality, and those that believe in more collectivism.

This is a divide that extends well beyond programming and this topic.

People that support GitHub actions believe in the concept of "greater good" and believe the actions of GitHub are ethical because it prevented harm to the community

People that oppose GitHub actions reject the idea of "the greater good" and believe this individual should have had the right to do with their property (i,e their code) anything they wanted and the responsibility was upon the people consuming / using that code to vet it before use.

Except that use of GitHub implies you see a benefit to the collectivist use of GitHub's property, which is why you agree to GitHub's terms when using their property.

If I'm leasing a part of my land to you (and others), and your use of your assets on my land has the potential to harm other users of my land - you'll be asked to leave. I have a business to run. You are still free to take your property to your own patch of land and do with it what you will. Your freedom has not been compromised. You just assumed a freedom you did not have - which is the use of my land in an unfettered way.

> What you are going to get is people separating out into 2 camps, those that believe in individuality, and those that believe in more collectivism.

I am extremely individualistic. Github is also an "individual" that has its own private rights.

The author of this library absolutely had the right to write code, change it, etc. He does not have the right to use Github as a delivery mechanism for malware.

Had github simply banned the person, and took down their code I might have even sided with your position

However that is not what github did.

I don't really see it that way -- GitHub is run by a company to (albeit somewhat nebulously) make money. They almost certainly made this call because distributing an obviously malicious package like this was damaging to their brand, not through some philosophical framework.

Expecting a company to have a moral framework is just setting yourself up for disappointment. They will always just do what they think will maximize their long term ROI. Possibilities lay between "enlightened self interest" and "barefaced self interest."

> What you are going to get is people separating out into 2 camps, those that believe in individuality, and those that believe in more collectivism.

I agree wholeheartedly with this statement, but we're diametrically opposed on how these two groups are allocated. I.e., the people you're labelling as collectivists I are in the other group, and vice versa. People who think GitHub did right are a real me-first bunch, not collectivists.

I'm not sure how we get to me-first when the story is one actor using the wide-cast popularity of packages he had admin rights to to intentionally cause harm.

It's a "the needs of the many outweigh the needs of the few" situation.

It's a bit mind-boggling that FOSS authors who give their work away for free are the selfish baddies, and Microsoft of all people, are the communistic heroes in your telling.

> It's a bit mind-boggling that FOSS authors who give their work away for free are the selfish baddies

This is a straw man. No one made this generalization.

Marak, specifically, is a "selfish baddy", and it has nothing to do with FOSS. It has to do with his abuse of Github, npm, and Faker.js (which other people also contributed to) to distribute malware.

None of that can be generalized to a position about FOSS, Microsoft, or any other nonsense you're trying to extrapolate. It's specifically about a bad actor who was removed from a platform.

> or any other nonsense you're trying to extrapolate.

Sorry you were complaining about straw man arguments?

Yes he was, and you were making them.

Are you sure you understood my point?

>> It's a "the needs of the many outweigh the needs of the few" situation.

> It's a bit mind-boggling that FOSS authors who give their work away for free are the selfish baddies, and Microsoft of all people, are the communistic heroes in your telling.

The discussion is about Github - microsoft - undoing the author's changes, the guy I replied to saying that this was good because he felt the author was "doing harm". So he definitely is saying that microsoft are the heroes there defeating "harm". And since he is supposed to be "doing harm" for his own benefit, the FOSS author being overridden by microsoft is the "selfish baddie".

For my edification, if you have a moment you can you help me understand where my comment failed to hew to a valid analysis of that part of the discussion and became some nasty straw manning activity?

I mean, catering to the needs of the many rather than the few has pretty much been npm policy since left-pad-gate:

https://twitter.com/seldo/status/712417019686100992

https://blog.npmjs.org/post/141905368000/changes-to-npms-unp...

Not all FOSS are selfish baddies. Not even most. Not even many.

But Marak specifically is, and Microsoft being the good actor is indicative of how badly he messed up.

If his goal was to make a statement about big corporations taking more than they give to FOSS, arranging things so Microsoft gets to be the hero was a foolish way to go about it.

I have a feeling bare metal servers, a leased spot in a cage, and self hosted systems is about to become popular. There are just too many stories like this these days.

I’m in the camp that if it was his repo then he can do whatever the eff he wants to it.

Yeah, but most vocal proponents of so-called "individuality" are simply self-centered anti-social assholes who haven't thought through the Libertarian ideologies they parrot deeply enough to realize how extremely dependent on and beneficial from collectivism they actually are, and they continue bitching about "socialism" while sucking the government's tit with their social security and disability benefits and medicare, and driving on the roads in their trucks while "rolling goal" and waving their guns at pedestrians and bicyclists and electric cars, and calling the fire department when their house catches on fire, and calling an ambulance when they accidentally shoot themselves in the dick while "cleaning their gun", and foaming at the mouth and railing against Obamacare for no better reason than the person THEY renamed the ACA after is black, then refusing to self isolate and wear masks and take vaccines, and finally overcrowding the hospitals and cursing at health care workers when they get sick, then running GoFundMe campaigns to pay for their "unexpected" self inflicted illness and funeral, and some even go as far as using projects hosted on github and hosting their own projects on github for free, and then complaining when github takes down the malicious repo of another mentally ill person whose apartment the police had to break into and remove his bomb making supplies.

>>trucks while "rolling goal"

If you are going to insult people at least get the terminology correct, it is rolling coal, not goal.

Further most people rolling coal are not libertarian.

>>d "individuality" are simply self-centered anti-social assholes who haven't thought through the Libertarian ideologies they parrot deeply enough to realize how extremely dependent on and beneficial from collectivism they actually are

Incorrect, Libertarians / Individualists do not reject the concept of society or working in groups to accomplish a goal. However they believe said interactions should be VOLUNTARY, and not forced upon you by 3rd party actors.

>>against Obamacare for no better reason than the person THEY renamed the ACA after is black,

Ohh yes, the only possible reasons someone could oppose ACA is because of racism.

Lord forbid I make a typo. But of course you knew exactly what I meant, and despite your attempt to disown that behavior, those people now OWN your precious Libertarian party just as much as they now OWN the Republican party. When your leaders are kissing Trump's ring, and you refuse to renounce and continue to follow those same leaders, you're kissing Trump's ring, too.

Do you support with the way your glorious Libertarian leader Rand Paul has attacked and endangered Anthony Fauci's family by lying about him, and reject the government's right to mandate vaccination, but support spreading lies about people and endangering their families for political purposes? What ever happened to personal responsibility?

https://www.washingtonpost.com/politics/2022/01/12/how-polit...

>How politically helpful have Rand Paul’s attacks on Anthony Fauci been?

>One of the more remarkable political disputes in recent history involves two doctors.

>One is Sen. Rand Paul (R-Ky.), an ophthalmologist by training. The other is Anthony S. Fauci, the federal government’s top infectious-disease expert. The genesis of their fight is the coronavirus pandemic and, specifically, government recommendations (for which Fauci is a figurehead) that Paul opposes. Over the course of more than a half-dozen hearings centered on the pandemic, the fight has become much more personal, with Paul accusing Fauci of having contributed to the creation of the virus and Fauci forcefully pushing back.

>On Tuesday, there was a new escalation. Obviously expecting Paul to challenge him, Fauci came prepared with an argument he hadn’t made previously: Paul was attacking him and putting his personal safety at risk for Paul’s own political benefit.

>Fauci pointed out that a man had been arrested while on his way to Washington to attack a number of public officials, including himself.

>“I ask myself, why would senator want to do this,” he continued, obviously flustered. “So, go to Rand Paul website, and you see ‘Fire Dr. Fauci,’ with a little box that says ‘Contribute here’ — you can do $5, $10, $20, $100 — so you are making a catastrophic epidemic for your political gain.”

And of course there are possible reasons to oppose the ACA, but most of them don't hold any water because they are based on lies ("It's SOCIALISM!!!", "DEATH PANELS!!!"), and are just cover stories and dog whistles for naked racism. You know that as well as I do, so don't play coy and deny it.

>>those people now OWN your precious Libertarian party

I see you have confused the Libertarian party with libertarianism they are pretty different

>>Do you support with the way your glorious Libertarian leader Rand Paul has attacked and endangered Anthony Fauci's

Aside from the complete falsehood of this statement entirly, I do support elected officials grilling non-elected bureaucrats in the manner used by Rand.

I also believe Fauci unfit to serve in his current role and there are serious questions around his tenure that need to be addressed including the funding of the Wuhan lab.

And just to be clear: by "grilling" you mean lying about and endangering the families of non-elected bureaucrats for the purposes of political fundraising. You're exhibiting and defending precisely the behavior I mean when I say Libertarians are "self-centered anti-social assholes".

You are not pretty different yourself, since you believe and spread the same conspiracy theories, and support Rand Paul's attack of complete falsehoods against Fauci and his family. Rand Paul's statements were mendacious lies, yet you support him and his lies and threats against Fauci for the sole purpose of fundraising.

I'm glad you don't incorrectly disagree with the fact that most of the arguments proffered against ACA are just lies and racist dog whistles, but I certainly don't agree with you that it's a valid tactic, the ends justify the means, or that using racism and lies and threats and spreading misinformation against people's families to grab power and raise money is in any way ethical or justified, or a "great tactic" and that "misinformation works", as Rand Paul himself says.

https://www.insider.com/old-video-resurfaces-rand-paul-telli...

>An old video has surfaced of Sen. Rand Paul telling students that spreading misinformation is a 'great tactic'.

https://boingboing.net/2022/01/13/watch-rand-paul-tells-stud...

>Watch: Rand Paul tells students "misinformation works" in resurfaced 2013 video

>>I'm glad you don't incorrectly disagree with the fact that most of the arguments proffered against ACA

Just because I choose not to respond to all of our unhinged conspiracy laced non-sense claims that everything you disagree with is a dog whistle to racism does not in anyway imply I support said statements. '

I choose not argue with crazy people on the internet, and clearly President Trump broke your mind and I hope for your sake you get professional help.

>> since you believe and spread the same conspiracy theories,

Sorry information released from government records pursuant to a FOIA request is not "conspiracy", I am sure you so biased in favor of your lord and savior (Dr Fauci) that you probably have one of those candles or figurines on your desk devoted to him so you will never believe anything negative however reality does not require your faith.

He is mid rate bureaucrat thrust in the lime light by circumstance and this hero worship of him is insane.

Further at no point did Rand threaten him or his family. The attempt to shift any real or imaged danger there is due to public backlash is a very dangerous game, tell me do you apply the same standard to Democrats who inflame AntiFa and other violent groups? Are these democrat politics to blame for all the violence, riots, etc they "cause" (and to be clear I do not believe they cause it, but you world view dictates we place this violence at their feet, i am judging you by your own standard)

Somehow I bet you will be hypocritical

In no way do I "worship" Fauci. You're projecting your own hero worship of Trump onto me. You're the one who believes and spreads unfounded conspiracy theories, and whose mind Trump broke, if it was not already broken before. It's you foaming-at-the-mouth Trump-worshiping Fauci-haters who are the deranged ones injecting disinfectants, popping horse dewormer pills, and drinking your own urine, instead of wearing masks and getting vaccinated. Get a grip on reality and stop parroting lies and drinking Trump's piss flavored kool-aid. The rampant racism in the US and the fact that Trump exploits it is not a conspiracy, it's a historical fact that you can't deny. You fanatical Trump supporters are spreading ridiculous unfounded and totally disproven conspiracy theories that it was actually AntiFa who attacked the US Capitol to make Trump look bad, when we all know because we saw with our own eyes that they were racist Confederate Flag brandishing Trump supporters, egged on and organized by Trump himself. So do you also believe the election was stolen from Trump, too, like MOST Republicans do? Or do you just pretend to believe those lies and conspiracy theories as performance art trolling, the same way you go out of your way to purposefully mis-spell "democrat politics"? Then Popehat's Law of Goats applies:

https://www.urbandictionary.com/define.php?term=Popehat%27s%...

>Popehat's Law of Goats

>He who fucks goats, either as part of a performance or to troll those he deems has overly delicate sensibilities is simply, a goatfucker.

>He claimed he was just pretending to be racist to trigger the social justice warriors, but even if he is telling the truth, Popehat's Law of Goats still applies.

You are the only unhinged person here. I am having a calm conversation where you are ranting and raving... It is sad really

>>In no way do I "worship" Fauci.

Press X for doubt

>>You're projecting your own hero worship of Trump onto me.

Never voted for the man... I disagreed with him about 50% of the time, however I saw in real time the lies and misinformation the media was putting out.

>>It's you foaming-at-the-mouth Trump-worshiping Fauci-haters who are the deranged ones injecting disinfectants, popping horse dewormer pills, and drinking your own urine, instead of wearing masks and getting vaccinated.

Fully vaccinated, just do not support the mandates

//and for the record Trump also supports the Vaccines.. Much to the chagrin to part of his base

Also calling on of the most widely distributed human drugs, a drug that won accolades for saving peoples lives across the world a "horse dewormer" is unhinged conspiracy, and medical misinformation. Sure it may not be a treatment for COVID, that however does not change the reality that is a human drug, proscribed by doctors all over the world, and is infact on the WHO list of essential drugs...

>> disproven conspiracy theories that it was actually AntiFa who attacked the US Capitol

Where did I say that? There is clear evidence AntiFa violence all through out 2019, 2020, and 2021 with out having to talk about 1/6 protest turned riot.

>> So do you also believe the election was stolen from Trump, too, like MOST Republicans do?

Stolen in the sense you are talking about... No. However I do believe many states governors (on both sides) inappropriately (and IMO illegally) used their executive powers to change election laws under the guise of "emergency" to manipulate election turn out and other factors for their (or their parties) political advantage.

I also do not believe or support the narrative that voter ID is a threat to democracy, nor do I support or believe the narrative that the US has the most "secure" elections in the world.

>>Popehat's

Ahh yes... Ken White. another famous person broken by Trump. The one famed free speech advocate now fully supporting Censorship of all manner.

Github is still in theory a place to collaborate on code - its not a blogging platform. I think a reasonable argument could be made that he violated the "spirit" of github.

> No, it wasn't. It was Github's corner of the internet and then it was Microsoft's. If he just wanted a place to publish his personal projects, he could have put them on a personal, self-hosted website.

Exactly. Marak's defenders are quick to argue that he had every right to do what he did based on the repo's license. It's inconsistent to then blame GitHub for suspending him from their platform.

> I strongly encourage you to stop making false allegations.

I encourage you to find out the definition of Trojan[1] and then find out what Marak did to sabotage his code.

To qualify as a Trojan, Faker.js needed to be:

- advertised as being for a certain purpose

- coded to do something to damage the person who installs it (even if it still does the thing it advertises that it does)

In this case, Marak allowed people who thought they were installed Faker.js and tricked them into installing something that ran an infinite loop, which would break a lot of CI/CD servers and build processes.

In some circumstances, this could easily lead to economic harm. In the worst circumstances, it could take down a vital service (like a health app) and cause people to be seriously harmed.

1. https://en.wikipedia.org/wiki/Trojan_horse_(computing)

2. https://www.theverge.com/2022/1/9/22874949/developer-corrupt...

> Marak allowed people who thought they were installed Faker.js and tricked them into installing something that ran an infinite loop

They were installing a legitimate new version of Faker.js though - which just happened to be running an infinite loop. It's users who trusted Faker.js author to not pull this kind of stuff off and it turned out they were wrong to do that.

A throwaway line in Wikipedia that does not cite a source ... versus the Jargon File.

http://www.catb.org/jargon/html/T/Trojan-horse.html

If it isn't security-breaking, it isn't a Trojan. I have not seen any evidence that this prank, immature as it may be, resulted in an actual security breach.

The term is derived from the ancient Trojan Horse. It doesn’t have to involve security breaches because the only requirement is a breach of trust through deceit.

> It doesn’t have to involve security breaches

Then it isn't a Trojan. By definition.

"A malicious security-breaking program that is disguised as something benign"

That's BS. Mark didn't just remove it or make it "non-functional". He deliberately changed the code to run in a infinite loop and halt any code that pulled it in. That seems exactly like the definition of a Trojan to me.

I wouldn't call that a trojan. It is being an asshole though.

It's a DoS attack disguised as other, useful software. That's exactly what a Trojan is.

It isn't disguised as anything. If you included a random module in your application package manager, and allowed it to update itself and run scripts then liability is on you for not verifying it and checking the license to see if they provided any warranty.

But is this really a "warranty" issue? Sounds more like a fraud issue (ianal).

Given it was done with the intention of messing up other people's computers which the maintainer did not have legit access to - maybe its even a CFAA criminal hacking issue (ianal).

Anyways, there's a huge difference between accidentally doing something and doing something with the specific intention of hurting someone else. Sure you can disclaim responsibility for accidents & negligence, but i'm pretty sure you can't disclaim responsibility for intentionally malicious conduct in a contract, certainly you wouldn't be able to do so if it was criminal conduct (IANAL).

Funny how well that has worked until one person comes along and uses it to break people's software intentionally.

At the very least, Marak is an example of why we can't have nice things. None of us are obligated to applaud him for that.

If someone hands out free food on the corner with a sign that says you aren't entitled to it and so you get used to getting free food there. In fact, you've found ways to save on your budget because of it. You also optimized your route home from work to get there at the most convenient time.

One day, you show up and they have a sign up that says... No more free food, vote for Bernie. Are you really the type to complain that now you have to pay for food again or find someone else to give you free food, and throw a fit that their vote for Bernie sign is a trojan?

It's software, not consumable carbohydrates. Easily copied infinitely once created. Nobody is arguing he doesn't have to stop making it. Nobody is even arguing he doesn't have the right to delete his tepos. What he did was intentionally poison the templates to trigger automated updates to break other people's software, and that's just not okay. Forget the machines... It's simply misanthropic behavior.

But he didn't withdraw his offering he sabotaged it.

I guess the metaphor would be if you gave out free food all the time with a sign saying people aren't entitled to it, and then one day decided to add laxatives to it because you felt the people were ungrateful.

Which would land you in jail for a long time no matter what the sign said.

No, the person giving free free food here did not go up to people's houses saying here is free food still, eat it cause it is yummy and safe. The people getting the free food showed up cause they felt entitled, grabbed whatever they could find and said... oh, this isn't the free food that I'm used to getting here... oh, and I forgot to read the sign that has been there all along.

This analogy doesn't work the way you want it to. What you are describing would be literally illegal.

The person who put up the free food and the sign, after it was proven that they willfully poisoned the food (which is the only way I can interpret intentionally encoding an infinite loop in your testing library), would be liable for assault. You cannot just put up a sign that says "taker beware" to indemnify yourself from liability, especially after establishing the pattern that the food is safe.

If you ever wondered why grocery stores throw out perfectly good food (and sometimes padlock their dumpsters) rather than donate it to shelters, it's because this is how society works. They have to be clear that even food being thrown away is not intended to be free for the taking because if a pattern becomes established of people eating safe food out of a grocery store dumpster and one day that food is not safe, the grocery store can be held liable for injuries. Even if the grocery store never wanted anyone to use that food. The hard part would be proving the store intentionally poisoned it... But if that proof were made, the law is clear on who is responsible for the harm caused, and it's not the people eating out of the dumpster.

The underlying philosophical principle that underpins all of this legal precedent is "Don't intentionally cause harm." Marak broke that principle. Thank God Marak was only writing npm libraries and didn't own a grocery store.

This entire story, from the initial changes through the breakages through third parties intervening to mitigate their services being used to cause the breakages through other third parties stepping in to take responsibility to continue maintaining the code that had become vital, is one big open source community success story. The community interpreted intentional harm as damage and routed around it. And that was always one of the intended benefits of the open source approach, right? That the creator of the software can't ruin your day because they feel like it? Whether that creator is an evil corporation refusing to open their proprietary code, or a rogue actor deciding to take a sledgehammer to the pipeline... Open source mitigates the harm caused by both.

> That seems exactly like the definition of a Trojan to me.

Link to even one report of Marak getting inside someone else's system.

You seem to be misunderstanding what a Trojan is. From Wikipedia:

> In computing, a Trojan horse is any malware that misleads users of its true intent. The term is derived from the Ancient Greek story of the deceptive Trojan Horse that led to the fall of the city of Troy.

> Trojans generally spread by some form of social engineering; for example, where a user is duped into executing an email attachment disguised to appear not suspicious (e.g., a routine form to be filled in), or by clicking on some fake advertisement on social media or anywhere else.

Marak disguised his malicious DoS attack as previously released useful software. I am completely baffled why people are defending his actions, at all. He could have easily just pulled down his repo, that would have been totally within his rights. Releasing malicious software under the guise of something else is not.

And the fact that people are quoting the license of "no implied warranty" is irrelevant. The law does not look kindly on those that act with malicious intent, regardless of what a license agreement says. For example, if he changed the repo to instead encrypt your hard drive, I guarantee he'd be going to jail. While thankful this was just a DoS attack and not something more serious, it was attack all the same.

> You seem to be misunderstanding what a Trojan is. From Wikipedia...

Wikipedia doesn't define industry terms, especially in one-off throwaway lines without citations.

The Jargon File clearly defines a Trojan as something that (1) breaks your security and (2) is disguised as something benign.

http://www.catb.org/jargon/html/T/Trojan-horse.html

Unless you can show Marak Squires breached these folks security systems, it simply is not a Trojan.

(As a separate point, a claim that something distributed as source code is "disguised" simply cannot be in good faith.)

By claiming it is a Trojan, you are accusing Marak Squires of a potential felony by accessing a computer system without authorization. Making serious accusations like that should require some evidence. I don't see any.

They didn't disguise anything. It was MIT licensed, so you could have forked it long ago. You got used to the source you were using being useful, and so you felt entitled that they would maintain it in a way that was appropriate for your standards based on what you felt entitled to. The thing is with open source projects like this, no one owes you anything but it is too hard to admit that for many people.

No one reads licenses lol. The intent is the same as a trojan: making software malfunction for the intent of either economic gain or geopolitical goals. Intent matters; there is a fundamental difference between shipping crappy code for fun, and making good code break without warning for thousands of users.

> The intent is the same as a trojan

A Trojan is where the attacker gains direct access to a protected system. It is a back door disguised as an innocuous file. The whole point of the Trojan Horse was the Greeks hiding inside of it to get into Troy.

Where is your evidence that Marak Squires gained access to any of the systems that downloaded and used his packages?

I think there is two aspects of the word "trojan", but it does not imply "remote command and control", it's often that, but more broadly it means something that is disguised as one thing, but is not.

For example, one of the first trojans was: https://en.wikipedia.org/wiki/EGABTR

Chalk maintainer here. I said before I wouldn't comment on Marak but I don't want to stand by and watch him profit from this like he is, monetarily or otherwise, nor should GitHub receive ANY hate for their actions.

He's not banned. It was most likely an initial response to a suspected compromised account situation. Once they determined the actions were carried out by the account holder, they reinstated it.

There are MANY reasons to be annoyed with GitHub but this isn't one of them. Github's actions here helped, not hurt. I would hope they'd suspend my account if they too thought it was compromised and pushing out malicious updates to packages.

The security of users is of the utmost importance.

Marak needs professional medical help. It is clear he's having a mental break and the people defending him and egging him on are only making things worse. He has a history of erratic behavior (dating back to almost a decade ago) and needs to find healing, not accolades.

Since this whole fiasco, Marak has garnered loads of followers and has increased his sponsor count dramatically. We should not be rewarding this behavior. If you at all dig into this, you'll find not a stable, perhaps loud individual, but a troubled, erratic, unpredictable, and hurting one. He is not martyr. He's not a patriot or a revolutionist. He's an abuser, potential "freedom fighter", malicious OSS maintainer and a beggar.

Please. Let's end this and not give any more attention to Marak. He needs help, and we're all collectively making things worse.

Thank you for stepping up and commenting on this.

maybe community should claim his personal account and get hold of those sponsors as well. in order to help marak and the whole community of course.

This is a bad faith argument and a complete misinterpretation of what it is I've said.

Freedom of speech doesn’t mean you can do whatever you want on someone else’s server. The project was hosted on GitHub, so GitHub can take significant action to protect the community. He can host his project elsewhere if he doesn’t agree with GitHub’s actions

Of course, no one is saying GitHub wasn't allowed to do what they did. What people are saying is GitHub shouldn't have done that.

What about somebody else's internet connection? If we apply the same logic to ISPs then the future of the internet would look quite bleak.

If we applied your logic everywhere, moderation wouldn't be allowed. That also seems pretty bleak.

I think ISPs should be a utility, but I don’t think git websites should

Whether you agree or disagree with it, ISPs have the right to fire you as a customer. However, I don't usually see that exercising that right unless it's for piracy.

> But GitHub claims to be your home for public hosting of your own personal code.

Github claims to be a home for developers to publicly host code of public use. Any benefit to an individual developer is incident to that overriding purpose and they are clear about that in their use policies.

> What GitHub policy did he violate?

https://docs.github.com/en/github/site-policy/github-accepta... gives their acceptable use policies.

I think they could easily make claims on any or all of sections 2, 3, 4 and 10.

Section 10 in particular notes that Github is a service run for a mass of users and will favor users as a whole over individual privileges.

> expressing his freedom of speech, again on his own personal GitHub account, in his own personal (not organization) repositories.

Was he running his own Github server instance and I missed it somehow? The flipside to Github paying to run your git repo, issue tracker, etc. is that you agree to abide by their terms of use, and these terms are written for Github's benefit.

If a million Github users are impacted by this package breaking their code then why are you surprised that Github took action to protect their users?

Marak could have hosted his own git repo if he wanted to ensure his malicious code couldn't be intercepted by others. That's the tradeoff you have to choose.

> He spoke about his thoughts about open source, businesses, and economics. Defending this type of political speech [snip]

Inserting infinite loops into packages isn't "political speech" and trying to claim as such just waters down the entire argument...

Yes, I'm also curious about GitHub's justification for this. It feels like they should have made some sort of statement about why the account was suspended, for the sake of transparency in such a large controversy. It's perfectly imaginable that Marak used his GitHub account to spam/harass other projects, or engage in some other type of speech that went against GitHub's guidelines, but there needs to be more clarity so that this doesn't seem like a case of "You annoyed me, so you're gone". As you said, it really can give the appearance of GitHub siding with the commercial use of open source for their own self-interest, even if I have enough trust in GitHub to know that that's probably not what they intended to do.

EDIT: I'm glad to hear from a sibling comment that GitHub has since unsuspended his account, since TFA and this comment made me think he was still suspended. Still, it feels like a misstep for GitHub not to have made some sort of comment here.

I get what you are saying, but I feel like this applies:

Not your domain/site, not your corner of the internet.

Is domain enough? I doubt it. You probably also need your own server in your own rack in your own building with your own peering to other networks. Once you've done all of that, you can probably credibly keep your site up counter to corporate interests.

Well, if you have your own domain then you can at least move it around between providers. But yeah, if you are doing anything truly unpopular then I don't think there's much you can do to stay online.

As a network, the internet will tend to favor the interests of large groups acting coherently. Sometimes we call those "corporations." But yes; control online is a two-way street because it's a communications network and it always takes at least two to communicate.

The fact that the conversation is happening at all is a sign that GitHub reputation is damaged. As anyone would point out they are certainly within their rights to terminate any account for any reason.

But certainly not beyond repair (as injecting adware in your package).

Also it is certainly a reminder for everyone that GitHub should not be treated as an archive of your code, and more like a collaboration space.

I don't like GitHub much but their handling of this situation actually won points for me.

>"The really outrageous thing is that the developer going "rogue" was actually him expressing his freedom of speech, again on his own personal GitHub account, in his own personal (not organization) repositories. He spoke about his thoughts about open source, businesses, and economics. Defending this type of political speech is especially important and GitHub banning his account and censoring this type of speech(whether you agree with it or not) is especially shameful."

This Tuesday is the 10-year anniversary of the SOPA/PIPA blackout [0,1]. Half of the tech internet crippled their own functionality for a day, in an act of political speech. (Was GitHub part of that?)

Tech culture has surely changed since then!

[0] https://en.wikipedia.org/wiki/Protests_against_SOPA_and_PIPA

[1] https://hn.algolia.com/?q=sopa

He wasn't crippling his own functionality though, he was deliberately crippling the functionality of everyone who trusted him.

your GitHub account is not yours but GitHub's property, they just do not claim that before they ban your account.

All cloud services do the similar things.

This isn’t how it works at all. It’s not how copyright law works, it’s not how property law works, and it’s certainly not how cloud services work.

What isn’t yours is your “right” to use the service.

Have you read the project’s license? That is literally how it works. It’s not even an original project by Marak, as it’s clearly shown in there.

The only fault here is cutting the owner out of the repo, but given the security breach it’s strange that he isn’t permanently banned at all.

And yeah, adding an infinite loop is a DoS attack.

> not how cloud services work.

Try placing a virus on S3 and let me know how that works out.

I’m not defending the author. GitHub is in their right to do what they did. But certainly not because of the nonsense GP claims. And yes you can host viruses on S3. What you can’t do is use Amazon’s network to do illegal shit (such as distribute viruses without consent).

Obviously I mean to distribute viruses via S3, which is what’s happening here. Your account is guaranteed to be flagged as soon as they find out. The update here was distributed to every subscriber.

What's your point? That doing illegal shit will strip you of your rights?

You know, I hear that if you go around stabbing people, you lose the right to not spend a bunch of time in prison, too.

not to mention that in the case of colors.js he actually owned less copyright than other contributors. they had actually changed more of the code.

he did it to protest billion dollar tech companies making money off open source, which is Github's entire business model. His protest was an existential threat to them so of course they are going to crack down

I believe that none of the billion dollar tech companies were affected by this in any way as they tend to have proper process in place for managing dependencies, the only ones who suffered were small developers and other open source projects which have limited manpower and just pull in updated versions without verifying them. Saying that this is an "existential threat" is ridiculous - megacorps can and do have procedures that won't be bothered much even if you'd have a case like that every single day.

Whatever his intentions were, acts like this threaten the open source community, but do not actually threaten the big companies at all.

This is such a bad take I don't even know where to begin. Please, read up on FOSS licenses and check which one colors.js uses. That's just the first of about five flaws with your argument.

Unbelievable that now almost all people is discussing "how" marak's action caused results. Not try to figure out "why" this happens. Just like seeing something wrong, and discuss it. DO NOTHING!! CHANGE NOTHING. ALL meanless. unless you figure out all stuff, change something. What I do? I think GitHub is wrong, so I take action, delete all repos on GitHub. F*K it, that what I do. At least I have an action. So what you did? Talking is cheap.

It takes long time to delete them all! I don't like GitHub, so I delete my repos. Is there any problem? I can manage my repos, of course Marak can too. https://twitter.com/numbchild/status/1482625168032022532

I didn't know about this before, is there a link for context?