> By putting them on a social network, like Github, he is submitting to their whims. He doesn't have any legal right to stay on that site if they want to kick him off of it.

Of course, legally speaking, Github can do whatever they want with their website, but we're not talking about the legal aspect.

The developer community has put some trust on Github not to do whatever they want. It's an implicit, non-legal, non-enforceable, social agreement that Github is going to "respect" our user accounts on their platform as long as we don't break the TOS.

They could delete all existing repositories tomorrow, and replace them with pornographic images, and they would probably be in their legal right, but that doesn't mean that we can't critizice them for it.

I trust GitHub more based on their actions in this case. They acted to prevent further attacks and gave him access back after it was mitigated.

> but we're not talking about the legal aspect

Yes we are. I was responding to someone[1] who was alluding to the legal aspect using legal terms s/he clearly doesn't understand.

> > "What GitHub policy did he violate? The really outrageous thing is that the developer going "rogue" was actually him expressing his freedom of speech..."

1. https://news.ycombinator.com/item?id=29961662

GitHub acted reasonably to mitigate harm. They didn’t delete his older commits or “replace it with porn”. They acted reasonably unlike Marak.

FWIW, GitHub's actions here have in no way damaged my trust in them.

They interpreted a developer's attempt to harm the community via abuse of the trust the community had placed in him as damage and mitigated it in the short run. That's a value-add.

Value add in to who? It sounds like you believe open source developers owe something to someone which simply isn't the case. You should evaluate the license(s):

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

I don't see where this license obligates github to distribute future versions.

Also if we're expecting people to do the bare minimum specified in their license, github's license gives them all the leeway they needed for their actions too.

GitHub is under no obligation to distribute further versions. Neither is Marak under any obligation to maintain and upkeep the repository. While in bad faith of the community, you are the consumer who CHOSE to use his software, free and at no cost to yourself. You have no right to dictate how that repository is used, especially if you never donated or contributed to the project itself.

> While in bad faith of the community, you are the consumer who CHOSE to use his software, free and at no cost to yourself. You have no right to dictate how that repository is used, especially if you never donated or contributed to the project itself.

Either we're going by a legalistic interpretation of the terms in which case Marak was free to fuck up his project and github was free to kick him off npm for it, or we're agreeing that people can be held to moral standards apart from legal ones.

If we agree that moral standards about bad faith should prevent npm/github/microsoft from taking control of something that Marak has put work into, then we should also be able to agree that moral standards should prevent Marak from releasing a deliberately broken version of a package as a fuck you to corporate users. Even that action of Marak's I think is wrong, but the backlash also landed on many open source projects.

I don't have a problem with GitHub or NPM taking down his project. Just like I don't have a problem with him poisoning it if he so chose. I do have a problem with people here whining about their own selfish wants. Again not one person is obligated to use faker.js, if you wanted the security that parts of your code base would not be tampered with, then you probably shouldn't have been using a third party library that wasn't under your control in the first place. Common sense is all too lacking here across the first world.

At the end of the day, open source is built on trust. Even the more paranoid-architected flows outside of npm (checksums via side-channel, curated package distributions maintained by a third-party such as debian) don't protect the end-user from actual malicious action on the part of the trusted source. Consider the story of how Univesity of Minnesota got banned from adding patches to Linux (https://www.theverge.com/2021/4/30/22410164/linux-kernel-uni...). In that case, they were caught. But if they weren't caught (or if a critical mass of Linux maintainers went rogue and were in on it)? Enough malicious actors with the right credentials can publish and checksum a damaging package in any system that allows code reuse. It is, perhaps, riskier to rely on a system with one maintainer. If that's the case, moving Faker .js to community controlled was a great first step in restoring trust in the package; it's harder to compromise a group.

We can sit here and cluck our tongues and say "Should have known better than to trust someone else's code," but that's just victim-blaming. Marak broke trust. He took advantage of a system with a vulnerbility and he exploited it. And everybody uses a system that is vulnerable in some way.

Because he did this, the system interpreted his actions as damage and routed around them. The system may change to make this attack harder in the future. And the result will be more complex and have more failure modes, and everything will be slightly worse as a result because we have to replace with process what we were previously able to do with human-to-human trust. "Nice job breaking it, hero."

IANAL but i highly doubt that that license would protect you if you were being intentionally malicious (as opposed to say grossly negligent).

I'm just as much an armchair lawyer as the most of the rest of HN but my understanding is that liability waivers aren't considered enforceable if malicious intent or gross negligence is involved. Anybody with more legal expertise want to clarify?

I am also not a lawyer, but this is what I found for NY and would be surprised if it doesn't apply in most states and many other countries too:

> Under New York law, a party can waive ordinary negligence, but not gross negligence, reckless conduct, willful/wanton conduct, or intentional acts. See Kalisch-Jarcho v. City of New York, 58 N.Y.2d 377 (1983); See also Restatement (Second) of Contracts § 195 (1981) (“A term exempting a party from tort liability for harm caused intentionally or recklessly is unenforceable on grounds of public policy.”).

This would be like suing a food pantry because they stopped giving out free food.

Marak didn't stop giving out free food. He intentionally poisoned a food delivery without notifying the recipients.

Using your food pantry analogy, it sounds more like he should go to jail.

He didn't deliver food. People picked up whatever they could find cause they felt entitled, and then said... oh look there was a sign here all along.

If we're stressing the analogy, Marak put food out in a park with a sign "Take the food, just tell everyone you got it from Marak, quality not guaranteed".

Then one day the food had laxatives because he felt not enough people put money in the tip jar.

I think that would still be actionable. Most people wouldn't bother, just like I don't think anyone is seriously thinking of taking Marak to court over what is mostly broken CI builds, but maybe the park staff won't let him offer food there anymore.

There was no more "food". An loop in a script isn't malicious, as a user can terminate a script and by running an unknown script they are assuming some liability as well. What you're advocating for is that if an open source developer changes their code, even to say, prompt the user to confirm executing when before they didn't prompt and that somehow breaks automation that the user has built (not the developer) then they should be liable for harm. It sets terrible precedence, and the end result is no on will want to create open source software anymore. I can only hope you are simply playing devils advocate than being serious, cause if you are serious then I hope you reap what you sow.

"By eating food of unknown provenance they are assuming some liability as well" isn't really an argument that would hold up in a court of law if someone intentionally taints the food.

> What you're advocating for is that if an open source developer changes their code, even to say, prompt the user to confirm executing when before they didn't prompt and that somehow breaks automation that the user has built (not the developer) then they should be liable for harm.

We should probably divide the conversation into two threads: one on the tainted-food analogy, and one on the changing-code reality. Because they aren't the same, and one can reach weird conclusions trying to conflate them.

Liability for tainted food is pretty settled law. If someone eats your food and gets sick, it's a problem for you. If they eat it and get sick and can prove you poisoned it, it's a real problem with real legal consequences. Food handlers and preparers go out of their way to avoid both of those scenarios.

Intentionally modifying code knowing you'll break downstream consumers hasn't been tested (to my knowledge) in court, so we can set that aside. But is it immoral? That's going to depend on one's morality, but I have a hard time seeing my way to agreeing with the standpoint "Sure, it's moral. User beware." That principle, written large, creates a strictly worse world, where people are hiding in their digital caves, unable to trust anything outside. A lot of people (including GitHub and NPM's owners) are trying ot build something better than that.

Marak had a right to do what he did, but that doesn't mean it was right, we don't have to agree that "because he could, it was good" (that's just rule-by-power, and almost nobody thinks that's a good moral philosophy), and I applaud the open-source community who stepped in to minimize his harm.

GitHub doesn't = open source community. Quite the opposite actually. It is a closed system designed to take open source software and put it behind a closed-source ecosystem, and apparently to moderate open source developers and taking away their individual freedoms.

How was Marak's individual freedom taken away? They locked his account temporarily (because what happens looked like somebody had stolen his credentials and impersonated him)... Then what happened?

His freedom to post what he wants in his repo does not extend to a freedom to screw users depending on the software he licensed for open source use working. GitHub and npm took steps to protect users from his malicious actions.

Value-add to the people who actually use github to build software, of course. It's fine to discuss license terms and what you should or shouldn't expect when you use github/npm/etc, but in the real-world JS landscape, many projects (commercial and otherwise) use many open-source packages through complex dependency hierarchies.

Your can think what you want about whether that's good or bad, but it's unquestionably our current reality. Protecting JS projects from malicious updates, regardless of whether or not the project license technically permits this by the author, is clearly in the best interest of users of this ecosystem.

No one took steps to protect JS projects from malicious updates. They took action in this one case but did not fix the underlying issue which is with package managers.

It is true that there are some vulnerabilities in the standard design for npm package management. Packages are designed to assume by default sources can be trusted and to pull aggressively. That's a system that's very convenient for developers... Assuming somebody doesn't use it in an extremely malicious way by building our trust with a working package and then pushing a change designed to screw users.

Fortunately, it appears the system has been stress tested now and we can see how that damage can be mitigated. If this kind of attack can be minimized by what is essentially moderation and curation, everything's good.

The only reason anything happened cause the developer intentionally crippled their own package which they had the right to do. If someone was modified a package to do something actually malicious you could go months without ever finding out.

I don't disagree that there are degrees of harm and differences in the ease of detecting such harm. But what's the significance of the distinction? Whether it's found out immediately or found out months later, the remedy for the community will likely be the same if the damage is widespread enough... Flag the version as bad in npm, break the connection between npm and the GitHub repo if the damage was purposeful, and the community picks up the package and starts maintaining a non-malicious version.

What you are going to get is people separating out into 2 camps, those that believe in individuality, and those that believe in more collectivism.

This is a divide that extends well beyond programming and this topic.

People that support GitHub actions believe in the concept of "greater good" and believe the actions of GitHub are ethical because it prevented harm to the community

People that oppose GitHub actions reject the idea of "the greater good" and believe this individual should have had the right to do with their property (i,e their code) anything they wanted and the responsibility was upon the people consuming / using that code to vet it before use.

Except that use of GitHub implies you see a benefit to the collectivist use of GitHub's property, which is why you agree to GitHub's terms when using their property.

If I'm leasing a part of my land to you (and others), and your use of your assets on my land has the potential to harm other users of my land - you'll be asked to leave. I have a business to run. You are still free to take your property to your own patch of land and do with it what you will. Your freedom has not been compromised. You just assumed a freedom you did not have - which is the use of my land in an unfettered way.

> What you are going to get is people separating out into 2 camps, those that believe in individuality, and those that believe in more collectivism.

I am extremely individualistic. Github is also an "individual" that has its own private rights.

The author of this library absolutely had the right to write code, change it, etc. He does not have the right to use Github as a delivery mechanism for malware.

Had github simply banned the person, and took down their code I might have even sided with your position

However that is not what github did.

I don't really see it that way -- GitHub is run by a company to (albeit somewhat nebulously) make money. They almost certainly made this call because distributing an obviously malicious package like this was damaging to their brand, not through some philosophical framework.

Expecting a company to have a moral framework is just setting yourself up for disappointment. They will always just do what they think will maximize their long term ROI. Possibilities lay between "enlightened self interest" and "barefaced self interest."

> What you are going to get is people separating out into 2 camps, those that believe in individuality, and those that believe in more collectivism.

I agree wholeheartedly with this statement, but we're diametrically opposed on how these two groups are allocated. I.e., the people you're labelling as collectivists I are in the other group, and vice versa. People who think GitHub did right are a real me-first bunch, not collectivists.

I'm not sure how we get to me-first when the story is one actor using the wide-cast popularity of packages he had admin rights to to intentionally cause harm.

It's a "the needs of the many outweigh the needs of the few" situation.

It's a bit mind-boggling that FOSS authors who give their work away for free are the selfish baddies, and Microsoft of all people, are the communistic heroes in your telling.

> It's a bit mind-boggling that FOSS authors who give their work away for free are the selfish baddies

This is a straw man. No one made this generalization.

Marak, specifically, is a "selfish baddy", and it has nothing to do with FOSS. It has to do with his abuse of Github, npm, and Faker.js (which other people also contributed to) to distribute malware.

None of that can be generalized to a position about FOSS, Microsoft, or any other nonsense you're trying to extrapolate. It's specifically about a bad actor who was removed from a platform.

> or any other nonsense you're trying to extrapolate.

Sorry you were complaining about straw man arguments?

Yes he was, and you were making them.

Are you sure you understood my point?

>> It's a "the needs of the many outweigh the needs of the few" situation.

> It's a bit mind-boggling that FOSS authors who give their work away for free are the selfish baddies, and Microsoft of all people, are the communistic heroes in your telling.

The discussion is about Github - microsoft - undoing the author's changes, the guy I replied to saying that this was good because he felt the author was "doing harm". So he definitely is saying that microsoft are the heroes there defeating "harm". And since he is supposed to be "doing harm" for his own benefit, the FOSS author being overridden by microsoft is the "selfish baddie".

For my edification, if you have a moment you can you help me understand where my comment failed to hew to a valid analysis of that part of the discussion and became some nasty straw manning activity?

I mean, catering to the needs of the many rather than the few has pretty much been npm policy since left-pad-gate:

https://twitter.com/seldo/status/712417019686100992

https://blog.npmjs.org/post/141905368000/changes-to-npms-unp...

Not all FOSS are selfish baddies. Not even most. Not even many.

But Marak specifically is, and Microsoft being the good actor is indicative of how badly he messed up.

If his goal was to make a statement about big corporations taking more than they give to FOSS, arranging things so Microsoft gets to be the hero was a foolish way to go about it.

I have a feeling bare metal servers, a leased spot in a cage, and self hosted systems is about to become popular. There are just too many stories like this these days.

I’m in the camp that if it was his repo then he can do whatever the eff he wants to it.

Yeah, but most vocal proponents of so-called "individuality" are simply self-centered anti-social assholes who haven't thought through the Libertarian ideologies they parrot deeply enough to realize how extremely dependent on and beneficial from collectivism they actually are, and they continue bitching about "socialism" while sucking the government's tit with their social security and disability benefits and medicare, and driving on the roads in their trucks while "rolling goal" and waving their guns at pedestrians and bicyclists and electric cars, and calling the fire department when their house catches on fire, and calling an ambulance when they accidentally shoot themselves in the dick while "cleaning their gun", and foaming at the mouth and railing against Obamacare for no better reason than the person THEY renamed the ACA after is black, then refusing to self isolate and wear masks and take vaccines, and finally overcrowding the hospitals and cursing at health care workers when they get sick, then running GoFundMe campaigns to pay for their "unexpected" self inflicted illness and funeral, and some even go as far as using projects hosted on github and hosting their own projects on github for free, and then complaining when github takes down the malicious repo of another mentally ill person whose apartment the police had to break into and remove his bomb making supplies.

>>trucks while "rolling goal"

If you are going to insult people at least get the terminology correct, it is rolling coal, not goal.

Further most people rolling coal are not libertarian.

>>d "individuality" are simply self-centered anti-social assholes who haven't thought through the Libertarian ideologies they parrot deeply enough to realize how extremely dependent on and beneficial from collectivism they actually are

Incorrect, Libertarians / Individualists do not reject the concept of society or working in groups to accomplish a goal. However they believe said interactions should be VOLUNTARY, and not forced upon you by 3rd party actors.

>>against Obamacare for no better reason than the person THEY renamed the ACA after is black,

Ohh yes, the only possible reasons someone could oppose ACA is because of racism.

Lord forbid I make a typo. But of course you knew exactly what I meant, and despite your attempt to disown that behavior, those people now OWN your precious Libertarian party just as much as they now OWN the Republican party. When your leaders are kissing Trump's ring, and you refuse to renounce and continue to follow those same leaders, you're kissing Trump's ring, too.

Do you support with the way your glorious Libertarian leader Rand Paul has attacked and endangered Anthony Fauci's family by lying about him, and reject the government's right to mandate vaccination, but support spreading lies about people and endangering their families for political purposes? What ever happened to personal responsibility?

https://www.washingtonpost.com/politics/2022/01/12/how-polit...

>How politically helpful have Rand Paul’s attacks on Anthony Fauci been?

>One of the more remarkable political disputes in recent history involves two doctors.

>One is Sen. Rand Paul (R-Ky.), an ophthalmologist by training. The other is Anthony S. Fauci, the federal government’s top infectious-disease expert. The genesis of their fight is the coronavirus pandemic and, specifically, government recommendations (for which Fauci is a figurehead) that Paul opposes. Over the course of more than a half-dozen hearings centered on the pandemic, the fight has become much more personal, with Paul accusing Fauci of having contributed to the creation of the virus and Fauci forcefully pushing back.

>On Tuesday, there was a new escalation. Obviously expecting Paul to challenge him, Fauci came prepared with an argument he hadn’t made previously: Paul was attacking him and putting his personal safety at risk for Paul’s own political benefit.

>Fauci pointed out that a man had been arrested while on his way to Washington to attack a number of public officials, including himself.

>“I ask myself, why would senator want to do this,” he continued, obviously flustered. “So, go to Rand Paul website, and you see ‘Fire Dr. Fauci,’ with a little box that says ‘Contribute here’ — you can do $5, $10, $20, $100 — so you are making a catastrophic epidemic for your political gain.”

And of course there are possible reasons to oppose the ACA, but most of them don't hold any water because they are based on lies ("It's SOCIALISM!!!", "DEATH PANELS!!!"), and are just cover stories and dog whistles for naked racism. You know that as well as I do, so don't play coy and deny it.

>>those people now OWN your precious Libertarian party

I see you have confused the Libertarian party with libertarianism they are pretty different

>>Do you support with the way your glorious Libertarian leader Rand Paul has attacked and endangered Anthony Fauci's

Aside from the complete falsehood of this statement entirly, I do support elected officials grilling non-elected bureaucrats in the manner used by Rand.

I also believe Fauci unfit to serve in his current role and there are serious questions around his tenure that need to be addressed including the funding of the Wuhan lab.

And just to be clear: by "grilling" you mean lying about and endangering the families of non-elected bureaucrats for the purposes of political fundraising. You're exhibiting and defending precisely the behavior I mean when I say Libertarians are "self-centered anti-social assholes".

You are not pretty different yourself, since you believe and spread the same conspiracy theories, and support Rand Paul's attack of complete falsehoods against Fauci and his family. Rand Paul's statements were mendacious lies, yet you support him and his lies and threats against Fauci for the sole purpose of fundraising.

I'm glad you don't incorrectly disagree with the fact that most of the arguments proffered against ACA are just lies and racist dog whistles, but I certainly don't agree with you that it's a valid tactic, the ends justify the means, or that using racism and lies and threats and spreading misinformation against people's families to grab power and raise money is in any way ethical or justified, or a "great tactic" and that "misinformation works", as Rand Paul himself says.

https://www.insider.com/old-video-resurfaces-rand-paul-telli...

>An old video has surfaced of Sen. Rand Paul telling students that spreading misinformation is a 'great tactic'.

https://boingboing.net/2022/01/13/watch-rand-paul-tells-stud...

>Watch: Rand Paul tells students "misinformation works" in resurfaced 2013 video

>>I'm glad you don't incorrectly disagree with the fact that most of the arguments proffered against ACA

Just because I choose not to respond to all of our unhinged conspiracy laced non-sense claims that everything you disagree with is a dog whistle to racism does not in anyway imply I support said statements. '

I choose not argue with crazy people on the internet, and clearly President Trump broke your mind and I hope for your sake you get professional help.

>> since you believe and spread the same conspiracy theories,

Sorry information released from government records pursuant to a FOIA request is not "conspiracy", I am sure you so biased in favor of your lord and savior (Dr Fauci) that you probably have one of those candles or figurines on your desk devoted to him so you will never believe anything negative however reality does not require your faith.

He is mid rate bureaucrat thrust in the lime light by circumstance and this hero worship of him is insane.

Further at no point did Rand threaten him or his family. The attempt to shift any real or imaged danger there is due to public backlash is a very dangerous game, tell me do you apply the same standard to Democrats who inflame AntiFa and other violent groups? Are these democrat politics to blame for all the violence, riots, etc they "cause" (and to be clear I do not believe they cause it, but you world view dictates we place this violence at their feet, i am judging you by your own standard)

Somehow I bet you will be hypocritical

In no way do I "worship" Fauci. You're projecting your own hero worship of Trump onto me. You're the one who believes and spreads unfounded conspiracy theories, and whose mind Trump broke, if it was not already broken before. It's you foaming-at-the-mouth Trump-worshiping Fauci-haters who are the deranged ones injecting disinfectants, popping horse dewormer pills, and drinking your own urine, instead of wearing masks and getting vaccinated. Get a grip on reality and stop parroting lies and drinking Trump's piss flavored kool-aid. The rampant racism in the US and the fact that Trump exploits it is not a conspiracy, it's a historical fact that you can't deny. You fanatical Trump supporters are spreading ridiculous unfounded and totally disproven conspiracy theories that it was actually AntiFa who attacked the US Capitol to make Trump look bad, when we all know because we saw with our own eyes that they were racist Confederate Flag brandishing Trump supporters, egged on and organized by Trump himself. So do you also believe the election was stolen from Trump, too, like MOST Republicans do? Or do you just pretend to believe those lies and conspiracy theories as performance art trolling, the same way you go out of your way to purposefully mis-spell "democrat politics"? Then Popehat's Law of Goats applies:

https://www.urbandictionary.com/define.php?term=Popehat%27s%...

>Popehat's Law of Goats

>He who fucks goats, either as part of a performance or to troll those he deems has overly delicate sensibilities is simply, a goatfucker.

>He claimed he was just pretending to be racist to trigger the social justice warriors, but even if he is telling the truth, Popehat's Law of Goats still applies.

You are the only unhinged person here. I am having a calm conversation where you are ranting and raving... It is sad really

>>In no way do I "worship" Fauci.

Press X for doubt

>>You're projecting your own hero worship of Trump onto me.

Never voted for the man... I disagreed with him about 50% of the time, however I saw in real time the lies and misinformation the media was putting out.

>>It's you foaming-at-the-mouth Trump-worshiping Fauci-haters who are the deranged ones injecting disinfectants, popping horse dewormer pills, and drinking your own urine, instead of wearing masks and getting vaccinated.

Fully vaccinated, just do not support the mandates

//and for the record Trump also supports the Vaccines.. Much to the chagrin to part of his base

Also calling on of the most widely distributed human drugs, a drug that won accolades for saving peoples lives across the world a "horse dewormer" is unhinged conspiracy, and medical misinformation. Sure it may not be a treatment for COVID, that however does not change the reality that is a human drug, proscribed by doctors all over the world, and is infact on the WHO list of essential drugs...

>> disproven conspiracy theories that it was actually AntiFa who attacked the US Capitol

Where did I say that? There is clear evidence AntiFa violence all through out 2019, 2020, and 2021 with out having to talk about 1/6 protest turned riot.

>> So do you also believe the election was stolen from Trump, too, like MOST Republicans do?

Stolen in the sense you are talking about... No. However I do believe many states governors (on both sides) inappropriately (and IMO illegally) used their executive powers to change election laws under the guise of "emergency" to manipulate election turn out and other factors for their (or their parties) political advantage.

I also do not believe or support the narrative that voter ID is a threat to democracy, nor do I support or believe the narrative that the US has the most "secure" elections in the world.

>>Popehat's

Ahh yes... Ken White. another famous person broken by Trump. The one famed free speech advocate now fully supporting Censorship of all manner.

Github is still in theory a place to collaborate on code - its not a blogging platform. I think a reasonable argument could be made that he violated the "spirit" of github.

> No, it wasn't. It was Github's corner of the internet and then it was Microsoft's. If he just wanted a place to publish his personal projects, he could have put them on a personal, self-hosted website.

Exactly. Marak's defenders are quick to argue that he had every right to do what he did based on the repo's license. It's inconsistent to then blame GitHub for suspending him from their platform.

> I strongly encourage you to stop making false allegations.

I encourage you to find out the definition of Trojan[1] and then find out what Marak did to sabotage his code.

To qualify as a Trojan, Faker.js needed to be:

- advertised as being for a certain purpose

- coded to do something to damage the person who installs it (even if it still does the thing it advertises that it does)

In this case, Marak allowed people who thought they were installed Faker.js and tricked them into installing something that ran an infinite loop, which would break a lot of CI/CD servers and build processes.

In some circumstances, this could easily lead to economic harm. In the worst circumstances, it could take down a vital service (like a health app) and cause people to be seriously harmed.

1. https://en.wikipedia.org/wiki/Trojan_horse_(computing)

2. https://www.theverge.com/2022/1/9/22874949/developer-corrupt...

> Marak allowed people who thought they were installed Faker.js and tricked them into installing something that ran an infinite loop

They were installing a legitimate new version of Faker.js though - which just happened to be running an infinite loop. It's users who trusted Faker.js author to not pull this kind of stuff off and it turned out they were wrong to do that.

A throwaway line in Wikipedia that does not cite a source ... versus the Jargon File.

http://www.catb.org/jargon/html/T/Trojan-horse.html

If it isn't security-breaking, it isn't a Trojan. I have not seen any evidence that this prank, immature as it may be, resulted in an actual security breach.

The term is derived from the ancient Trojan Horse. It doesn’t have to involve security breaches because the only requirement is a breach of trust through deceit.

> It doesn’t have to involve security breaches

Then it isn't a Trojan. By definition.

"A malicious security-breaking program that is disguised as something benign"

That's BS. Mark didn't just remove it or make it "non-functional". He deliberately changed the code to run in a infinite loop and halt any code that pulled it in. That seems exactly like the definition of a Trojan to me.

I wouldn't call that a trojan. It is being an asshole though.

It's a DoS attack disguised as other, useful software. That's exactly what a Trojan is.

It isn't disguised as anything. If you included a random module in your application package manager, and allowed it to update itself and run scripts then liability is on you for not verifying it and checking the license to see if they provided any warranty.

But is this really a "warranty" issue? Sounds more like a fraud issue (ianal).

Given it was done with the intention of messing up other people's computers which the maintainer did not have legit access to - maybe its even a CFAA criminal hacking issue (ianal).

Anyways, there's a huge difference between accidentally doing something and doing something with the specific intention of hurting someone else. Sure you can disclaim responsibility for accidents & negligence, but i'm pretty sure you can't disclaim responsibility for intentionally malicious conduct in a contract, certainly you wouldn't be able to do so if it was criminal conduct (IANAL).

Funny how well that has worked until one person comes along and uses it to break people's software intentionally.

At the very least, Marak is an example of why we can't have nice things. None of us are obligated to applaud him for that.

If someone hands out free food on the corner with a sign that says you aren't entitled to it and so you get used to getting free food there. In fact, you've found ways to save on your budget because of it. You also optimized your route home from work to get there at the most convenient time.

One day, you show up and they have a sign up that says... No more free food, vote for Bernie. Are you really the type to complain that now you have to pay for food again or find someone else to give you free food, and throw a fit that their vote for Bernie sign is a trojan?

It's software, not consumable carbohydrates. Easily copied infinitely once created. Nobody is arguing he doesn't have to stop making it. Nobody is even arguing he doesn't have the right to delete his tepos. What he did was intentionally poison the templates to trigger automated updates to break other people's software, and that's just not okay. Forget the machines... It's simply misanthropic behavior.

But he didn't withdraw his offering he sabotaged it.

I guess the metaphor would be if you gave out free food all the time with a sign saying people aren't entitled to it, and then one day decided to add laxatives to it because you felt the people were ungrateful.

Which would land you in jail for a long time no matter what the sign said.

No, the person giving free free food here did not go up to people's houses saying here is free food still, eat it cause it is yummy and safe. The people getting the free food showed up cause they felt entitled, grabbed whatever they could find and said... oh, this isn't the free food that I'm used to getting here... oh, and I forgot to read the sign that has been there all along.

This analogy doesn't work the way you want it to. What you are describing would be literally illegal.

The person who put up the free food and the sign, after it was proven that they willfully poisoned the food (which is the only way I can interpret intentionally encoding an infinite loop in your testing library), would be liable for assault. You cannot just put up a sign that says "taker beware" to indemnify yourself from liability, especially after establishing the pattern that the food is safe.

If you ever wondered why grocery stores throw out perfectly good food (and sometimes padlock their dumpsters) rather than donate it to shelters, it's because this is how society works. They have to be clear that even food being thrown away is not intended to be free for the taking because if a pattern becomes established of people eating safe food out of a grocery store dumpster and one day that food is not safe, the grocery store can be held liable for injuries. Even if the grocery store never wanted anyone to use that food. The hard part would be proving the store intentionally poisoned it... But if that proof were made, the law is clear on who is responsible for the harm caused, and it's not the people eating out of the dumpster.

The underlying philosophical principle that underpins all of this legal precedent is "Don't intentionally cause harm." Marak broke that principle. Thank God Marak was only writing npm libraries and didn't own a grocery store.

This entire story, from the initial changes through the breakages through third parties intervening to mitigate their services being used to cause the breakages through other third parties stepping in to take responsibility to continue maintaining the code that had become vital, is one big open source community success story. The community interpreted intentional harm as damage and routed around it. And that was always one of the intended benefits of the open source approach, right? That the creator of the software can't ruin your day because they feel like it? Whether that creator is an evil corporation refusing to open their proprietary code, or a rogue actor deciding to take a sledgehammer to the pipeline... Open source mitigates the harm caused by both.

> That seems exactly like the definition of a Trojan to me.

Link to even one report of Marak getting inside someone else's system.

You seem to be misunderstanding what a Trojan is. From Wikipedia:

> In computing, a Trojan horse is any malware that misleads users of its true intent. The term is derived from the Ancient Greek story of the deceptive Trojan Horse that led to the fall of the city of Troy.

> Trojans generally spread by some form of social engineering; for example, where a user is duped into executing an email attachment disguised to appear not suspicious (e.g., a routine form to be filled in), or by clicking on some fake advertisement on social media or anywhere else.

Marak disguised his malicious DoS attack as previously released useful software. I am completely baffled why people are defending his actions, at all. He could have easily just pulled down his repo, that would have been totally within his rights. Releasing malicious software under the guise of something else is not.

And the fact that people are quoting the license of "no implied warranty" is irrelevant. The law does not look kindly on those that act with malicious intent, regardless of what a license agreement says. For example, if he changed the repo to instead encrypt your hard drive, I guarantee he'd be going to jail. While thankful this was just a DoS attack and not something more serious, it was attack all the same.

> You seem to be misunderstanding what a Trojan is. From Wikipedia...

Wikipedia doesn't define industry terms, especially in one-off throwaway lines without citations.

The Jargon File clearly defines a Trojan as something that (1) breaks your security and (2) is disguised as something benign.

http://www.catb.org/jargon/html/T/Trojan-horse.html

Unless you can show Marak Squires breached these folks security systems, it simply is not a Trojan.

(As a separate point, a claim that something distributed as source code is "disguised" simply cannot be in good faith.)

By claiming it is a Trojan, you are accusing Marak Squires of a potential felony by accessing a computer system without authorization. Making serious accusations like that should require some evidence. I don't see any.

They didn't disguise anything. It was MIT licensed, so you could have forked it long ago. You got used to the source you were using being useful, and so you felt entitled that they would maintain it in a way that was appropriate for your standards based on what you felt entitled to. The thing is with open source projects like this, no one owes you anything but it is too hard to admit that for many people.

No one reads licenses lol. The intent is the same as a trojan: making software malfunction for the intent of either economic gain or geopolitical goals. Intent matters; there is a fundamental difference between shipping crappy code for fun, and making good code break without warning for thousands of users.

> The intent is the same as a trojan

A Trojan is where the attacker gains direct access to a protected system. It is a back door disguised as an innocuous file. The whole point of the Trojan Horse was the Greeks hiding inside of it to get into Troy.

Where is your evidence that Marak Squires gained access to any of the systems that downloaded and used his packages?

I think there is two aspects of the word "trojan", but it does not imply "remote command and control", it's often that, but more broadly it means something that is disguised as one thing, but is not.

For example, one of the first trojans was: https://en.wikipedia.org/wiki/EGABTR