It was malicious act to Github's users.

Github first responsibility comes to the community of users it supports, then to any individual user. Free speech/ personal choice / Freedom of expression come secondary to the welfare of its users.

Is it a slippery slope ? Yes, but Github does not have a choice if it cared about the interest its community

> malicious act to Github's users

Usually if I modify my car in my own backyard (aka my property) it is nobody's business to intervene, as long as it's on my property.

Legally speaking, fakerjs was Marak's property and GitHub has no right to intervene with a legitimate user action.

I can see that they "tried their best" but we also have to uphold the law here. If GitHub, say, called him on his phone whether or not his actions were intended...they would've had to restore the account and the "broken" repository as it was before the suspension immediately...which I assume they did.

My point is mostly that there is no legal contract between Marak and the "community", as he was never paid anything. Some might argue about mitigations in between disagreeing parties, but as I said there's nobody forcing you to use his library, just as there was nobody forcing you to update.

It cannot be malicious intent if the other party is free to decide to just ignore it and move on.

This code has never belonged to Marak. This code is ported from other existing projects which had been acknowledged by Marak.

I see it like this. I can't buy a Harry Potter book, translate it to a different language, maybe change some of the character names and then claim ownership while not acknowledging the original work even if I publish it for free.

It's like you and your friends building a Mustang in your backyard, all of you put time, energy, and even money into the project only for you to turn around and claim you invented a new car model built entirely by yourself. No, it's a ford and most of the upgrades were done by others. People that helped you might feel that you are in fact being malicious.

Since we're using analogies, this wasn't his backyard, this is the GitHub's yard.

The ToS of GitHub state that it's not their property, they only claim the license for redistribution. If it would be their property, legal cases (e.g. DMCA) would be against GitHub, not the owners of the repositories. So from their point of view they do not want to be legally responsible for the code they're hosting.

So I'd argue that it wasn't GitHubs backyard. They might be the landlord but they can't take ownership of the things that you build in your (rented?) flat.

Don't get me wrong, I also agree with you. For me this whole situation is kind of a paradox where there's no easy moral (or legal) answer on what to do, and on what society already has agreed upon.

In fact, this action could set a precedent that allows RIAA/MPAA/etc to sue GitHub because it demonstrates they curate and editorialize everyone's code, effectively.

> This code has never belonged to Marak. This code is ported from other existing projects which had been acknowledged by Marak.

Completely irrelevant to the issue at hand, though. The copied code was copied in accordance with an open source license. By this same token, the affected users/companies are free to start their own fork, but they didn't. The developer shouldn't be under any obligation to maintain anything, and GitHub shouldn't be intervening in these kinds of situations as that will simply serve to dull the positive effects these scenarios could have on the dependency landscape (people actually figuring out their shit). This is the package equivalent of a bail-out. At the end of the day it hurts more than it helps.

If you modify your car in your backyard sure, but it wasn't his backyard, it was the public roads, and it wasn't (just) his car, it was his car that he shared with his neighbours. And then he decided to tamper with the brakes as a "prank", knowing full well that others would then use the car.

No. Imagine if all traffic lights were 3D-printed, and that entire infrastructure depended, as an active dependency each time a new traffic light is printed, on some random guy's 3D model that he decided to post on his personal blog years ago. Guy decides to take down the model, now all of a sudden his hosting provider takes control of his site and forces him to put the model back. That is the lens through which you should view this situation.

The people building infrastructure that depends on one guy's 3D model existing on his blog at all times were the ones who made a mistake. If one of your thousands of dependencies breaks, shame on you, make a fork. The dependency owner owes you nothing, and he can change his creation or remove it any time he likes. If you weren't fortunate enough to fork it while it was still up, then too bad.

Instead we as a corporate community are encouraging coddling and ensuring that if you make this mistake, GitHub, NPM, et al will take care of it for you. The downstream effects of this are much worse than the temporary damage of making people actually figure out their dependency chains.

> It was malicious act to Github's users.

I'm not sure why it matters they are Github users. The packages were hosted on npm through Cloudflare - does that allow Cloudflare to take over the packages too? And NS1 since they host the fakerjs domain?

It’s cool that you’re internet rules-lawyering and all but ultimately he used his free account with intent to harm others, just as surely as if he backdoored his code. Freedom of speech is good, and protest is fine, but why would GitHub amplify the speech of a nutso who abused his position of trust?

>he used his free account

actually, marak has github pro, so it is not a free account

“Your freedom of speech ends at the tip of my nose.” as the saying goes. He took a swing, not just a stand.

> used his free account with intent to harm others, just as surely as if he backdoored his code

There's a huge difference between displaying a message and going in an endless loop and backdooring as in providing an alternative access to control a system you're not supposed to have access to. Words have meaning. This wasn't a backdoor.

There is a difference between robbery and burglary.

There’s a difference between a simile and a metaphor too, but GP is ignoring the fact I used one of those entirely.

They don't have to amplify anything. This is why open source is valuable; if the current maintainer is considered to be unfit or unreliable in some way, the community that disagrees with their rhetoric/leadership can fork the package and keep going like nothing happened. If you don't care/the package is still usable, then ideally no further action has to be taken.

At no point down the road should that involve revoking someone's ownership of a software project, though. Software ownership is sacred, not just because of tradition but because understanding who owns your packages and libraries is paramount to auditing security. Some of the most valuable contributions to computer science have been ones that allow people to verify integrity, be it SHA, TLS or GPG. If Microsoft abuses their position of power to break that chain of integrity, how can we be sure that other repos belong to their respective authors?

I can understand if you, the individual don't find this interesting or consider it inconsequential to your workflow. But other people rely on it, and you can't pretend like an honest chain of custody is somehow valueless.

Amazing you wrote this entire comment without taking a second confirm the premise you're so passionately defending...

No one took away his ownership.

Marak:

https://github.com/marak/Faker.js/

https://www.npmjs.com/package/faker

Post:

https://github.com/faker-js/faker

https://www.npmjs.com/package/@faker-js/faker

Faker.js is not a trademarked term, so someone made a new Faker.js.

In fact multiple people did, and one emerged as the preferred fork: https://twitter.com/faker_js/status/1481918305669627905

-

And to be clear, even if NPM goes and replaces his package with this new fork, it wouldn't take away his ownership.

Github could do the same... doesn't take away his ownership.

His ownership of a Github page is not his ownership of the code.

I don't like this rules-lawyering stuff either, yet this is one time where even if you decide to be purposely inflexible with your understanding of laws/licensing/contracts etc... there's still no issue with how this has been handled.

I see only one of those alleged "nutso's", and that was GitHub.

Everyone else should have been responsibly consuming the dependency. You don't get to call foul when you knowingly use something for something important and don't check to make sure it is okay.

Now that’s just plain victim blaming

As an engineer, part of your responsibility is to foresee this type of thing. Software that does exactly what it should, and is free of defects for it's immediate use case, has no need to be continually updated. As each line is adding more functionality you do not need.

Even if you're trying to keep things rolling forward and buy into taking in updates anyway; you don't do it in such a way as to cause it to leak to production until you are good and certain there is no potential for breakage. If you haven't learned this yet, give a monorepo a try. I assure you, you will be divested of any naivete in this regard.

Setting your package version to allow for minor updates _is_ responsibly consuming the dependency.

This sounds like "I responsibly test in production".

If you do test and isolate testing environment then this kind of breaking update is just business as usual.

That's fair, it does sound like a novice take; but it's still "business as usual" w/r/t what is touted as best practices where it comes to version control. At least that's my slightly above novice take on the matter.

> does that allow Cloudflare to take over the packages too?

Fundamentally cloudflare can do that if they so chose. If your threat model doesn't account for that sort of action then you should reassess.

Can != Should. we're not discussing whether Cloudflare had the physical capability of being able to take over the packages. We're asking if they should. Many people seem to believe that they should have, or would have been justified in doing so, and others disagree.

If the attack had been conducted by retargeting cloudflare at a hostile upstream, maybe so. But the attack originated at GitHub, so they're the ones to take action in response.

People point at github repositories all the time for packages.

Github owns npm.

This is an opinion you can have, but it's far from clear that it's an obvious or inherent one. What is the Github "community"? Who constitutes it? If I use Github for a personal project, and share the link with my friend, are we "part of the Github community"? How were we harmed by this incident? Did anyone say "We should shut Github down because they're irresponsibly hosting someone who would use his public JavaScript libraries to make a political statement"?

How was Github's community, specifically, harmed? A lot of developers were inconvenienced, but they would have been just as inconvenienced if he pushed the code to NPM from his local git repo, and never touched Github at all. Where does Github come into this?

It sounds like you’re looking for very clear lines which can and can’t be crossed. Whereas others see a blurry grey area in which GitHub makes judgement calls, and then individuals decide whether or not to use GitHub.

Mm, not really. There are lots of cases much more blurry and questionable then this one. What I'm looking for is 1) a recognition that Github would be in the wrong to suspend Marak for doing whatever he wanted with his own open source project, and 2) an acknowledgement that it's important for Github to be transparent about why they took the actions they did and what motivated their actions.

I still keep failing to see how it's malicious to gh users and I've red all your comments.

If I ever get hacked someday and my repo gets defaced, I hope GitHub acts just as they did to Marek. GitHub can’t tell the difference between an authorized and an unauthorized defacement, and I’d rather they err on the side of caution in this regard. It protects me against attackers, and the only risk of false positives is having to reauth and verify to support that I’m an authorized user when I’m trying to deface my work.

Github will not allow you to use your personal corner of the platform to propagate malware, and hasn't allowed it for many years.

Exactly this. The changes were intentional malware, designed to break the usage of these two modules. GitHub is under no obligation to assist you in hosting malware. The fact that these changes were intended by the original author has no bearing in this situation.

I don't get how people don't understand this.

Breaking a build in a way that is trivially rolled back is not in the same league as pushing code that harvests email addresses, CCs and mines bitcoin.

I'm disappointed to see this kind of comparison made.

Deliberately breaking people's applications? It's malware.

Appreciate it can be confusing to the layperson, but a build is not quite the same thing as an application.

A build will often reach out, download and install new and potentially breaking software components and it is part of its function to prevent breaking software components from reaching the application where it could cause material harm.

It was a bit of code printing ascii art in a loop, with a preceding comment "don't commit this", and we have bo information about whether it was put into the release on purpose or malicious intent afaik. Is it really malware?

If I set up a nice shopfront and invite customers in, and then start kneecapping everybody who walks through the door, you gonna bet the city will have something to say about it. I'm not kneecapping the city, just its citizens, so why should they care - and I'm doing it on my own property which they voluntarily entered after seeing my "dollar store" sign out the front - so it's their own damn fault for believing my sign.

There is a fundamental difference between physical violence like kneecapping and industrial sabotage which causes a minor temporary disruption in production, which is why the former is punishable by most national laws, while the latter isn’t.

> industrial sabotage

> causes a minor temporary disruption in production

pick one

ETA: if someone created a virus that would just display the text "you've been hacked!" and then that virus infected thousands of computers around the world, that someone would have a visit from the FBI with very serious charges. I don't see how this is different.

> Pick one

I don’t understand. Industrial sabotage is an act of vandalism with the intended purpose of causing disruption in productivity. This incident in particular only caused a relatively minor disruption not much bigger then e.g. a partial github outage.

> I don't see how this is different.

The difference is in 1) the intended targets. This incident was targeted against particular industry. The worm you are describing would be indiscriminate and would have the potential to be 2) much larger scale and therefor you could deduce the 3) intention of your hypothetical attacker would not be to cause disruptions of productivity withing a particular industry, but rather to prank random strangers. The difference is rather obvious.

GitHub's market is developers. They want to do everything they can to protect that community, and if a developer uses their service to damage other developers, they aren't going to stand for it.

> It was a malicious act to the users of his project, sure. But how was it a malicious act to GitHub?

You can't use GitHub to perform malicious acts, even if the victim isn't GitHub. GitHub isn't obligated to support anyone's malicious acts with their platform.

> If DHH decided that Rails was contributing more harm to the world then good, and tried to remove it from GitHub, would GitHub lock his account and restore his repos "on behalf of the community", to side with the smooth operation of the open source ecosystem over a user's personal decisions? To what extent has GitHub decided that they "know best" for the open source community?

GitHub hasn't done any of these things with faker.js.

Marak deleted the code and replaced it with a non-functional repo that has a README.md that just says "What really happened with Aaron Swartz?" (Reference to a conspiracy theory)

It's still here. You can still see it: https://github.com/Marak/faker.js

Exactly - that really looks like malware. If the same sort of replacement happened with rails, I imagine the same course would happen there - but if there were some corresponding blog post or reasoning in the Readme, GitHub would leave it to the community to let the drama play out (maybe still investigating to see if the login was suspicious in any way).

I would say colors.js definitely can be considered malware. He in effect intentionally spinlocked a lot of packages either directly or indirectly via transitive dependencies, and also intentionally bypassed common semvar rules to maximize the damage.

whether or not those packages should have been affected is another discussion, but it appear it probably had more of an effect on other open source packages and perhaps the work of small mom and pop companies rather than huge corporations.

To an automated protection system that detects “repo deletion + index.html rant” commits, deleting the codebase and updating the README would red flag instantly except for the different filename, and catch lots of garden-variety intrusions.

The deletion here was more complex, and most likely a human was assigned to review user reports to GitHub Security, who accurately determined it was a defacement from someone claiming to be the author’s credentials.

Turns out the author was the attacker, and with that confirmed, it appears that their access was restored so they could proceed with it.

> Turns out the author was the attacker, and with that confirmed, it appears that their access was restored so they could proceed with it.

I suspect this is how it played out as well. In fact, there was a lot of people on Twitter who were questioning whether the author really got suspended since he was posting to github a day or two after he posted his suspension picture.

Like I said above: if that really was how it happened, I would be totally okay with that, and it's completely understandable. But without a public statement from Github on such a visible and public controversy, we're left to speculate on their motives. Many people here disagree about why and whether Github should have or did suspend Marak. I would say that your view is the maximally charitable view to Github themselves. And frankly it's very likely to be true. But it seems like a lot of people believe that Github should have suspended his account, and I disagree with that.

People don't just believe his account should have been suspended, they feel that he should be prosecuted and charged with civil tort given the comments. I think they are ridiculous Karens who would destroy open source in a heartbeat given the opportunity.

> GitHub isn't obligated to support anyone's malicious acts with their platform.

Github isn't obligated to support anyone's anything, your relationship with Github is entirely at-will. And yet, I believe that there are moral boundaries on how Github should act, and that different people can disagree on where those boundaries are. I do not believe that "updating a popularly used library to break it's core functionality" is harmful enough to the other users of Github-the-code-hosting-site that it necessitates intervention from the owner of the platform. I think specifically that the way in which Github came to the determination that this change was "malicious" is unclear, and that Github very clearly has a conflict of interest when it comes to determining which sorts of political speech are "malicious", and which sorts are allowed.

> GitHub hasn't done any of these things with faker.js.

Correct, that's why it's a hypothetical question. If Github is willing to intervene against "malicious behavior" on behalf of "the community", then the obvious question is "which behavior, and which community?"

As another hypothetical example, the https://996.icu/ website is hosted on Github. Chinese browser manufacturers have implemented a pop-up that calls it a "illegal and fraudulent site" if you navigate to the repo. Is this "malicious" behavior? Many in China would think so, and definitely the browser manufacturers seem to believe that it's malicious behavior targeted at Chinese tech companies. Should users be allowed to use Github to perform this "malicious" act, even if the victim isn't Github itself? If Microsoft was criticized for their Chinese offices' working conditions on the site, do you think this would change their viewpoint on whether the repo should stay up? Personally, I would hope that those within Github who are responsible for making such a decision wouldn't take such personal matters into consideration.

> Reference to a conspiracy theory

I'll be honest, I didn't know this was in reference to a conspiracy theory. Aaron Swartz was driven to suicide by the relentless and cruel prosecution of the United States government, and the inaction of the MIT administration. That incident is tragic and sad enough as is, and I hope it goes without saying that don't agree with anyone attempting to co-opt that tragedy for their own conspiracy theories about Qanon. But I don't think Github should be responsible for making the call on whether something is "good" enough political speech to be worth protecting.

I completely agree with this take.