> malicious act to Github's users

Usually if I modify my car in my own backyard (aka my property) it is nobody's business to intervene, as long as it's on my property.

Legally speaking, fakerjs was Marak's property and GitHub has no right to intervene with a legitimate user action.

I can see that they "tried their best" but we also have to uphold the law here. If GitHub, say, called him on his phone whether or not his actions were intended...they would've had to restore the account and the "broken" repository as it was before the suspension immediately...which I assume they did.

My point is mostly that there is no legal contract between Marak and the "community", as he was never paid anything. Some might argue about mitigations in between disagreeing parties, but as I said there's nobody forcing you to use his library, just as there was nobody forcing you to update.

It cannot be malicious intent if the other party is free to decide to just ignore it and move on.

This code has never belonged to Marak. This code is ported from other existing projects which had been acknowledged by Marak.

I see it like this. I can't buy a Harry Potter book, translate it to a different language, maybe change some of the character names and then claim ownership while not acknowledging the original work even if I publish it for free.

It's like you and your friends building a Mustang in your backyard, all of you put time, energy, and even money into the project only for you to turn around and claim you invented a new car model built entirely by yourself. No, it's a ford and most of the upgrades were done by others. People that helped you might feel that you are in fact being malicious.

Since we're using analogies, this wasn't his backyard, this is the GitHub's yard.

The ToS of GitHub state that it's not their property, they only claim the license for redistribution. If it would be their property, legal cases (e.g. DMCA) would be against GitHub, not the owners of the repositories. So from their point of view they do not want to be legally responsible for the code they're hosting.

So I'd argue that it wasn't GitHubs backyard. They might be the landlord but they can't take ownership of the things that you build in your (rented?) flat.

Don't get me wrong, I also agree with you. For me this whole situation is kind of a paradox where there's no easy moral (or legal) answer on what to do, and on what society already has agreed upon.

In fact, this action could set a precedent that allows RIAA/MPAA/etc to sue GitHub because it demonstrates they curate and editorialize everyone's code, effectively.

> This code has never belonged to Marak. This code is ported from other existing projects which had been acknowledged by Marak.

Completely irrelevant to the issue at hand, though. The copied code was copied in accordance with an open source license. By this same token, the affected users/companies are free to start their own fork, but they didn't. The developer shouldn't be under any obligation to maintain anything, and GitHub shouldn't be intervening in these kinds of situations as that will simply serve to dull the positive effects these scenarios could have on the dependency landscape (people actually figuring out their shit). This is the package equivalent of a bail-out. At the end of the day it hurts more than it helps.

If you modify your car in your backyard sure, but it wasn't his backyard, it was the public roads, and it wasn't (just) his car, it was his car that he shared with his neighbours. And then he decided to tamper with the brakes as a "prank", knowing full well that others would then use the car.

No. Imagine if all traffic lights were 3D-printed, and that entire infrastructure depended, as an active dependency each time a new traffic light is printed, on some random guy's 3D model that he decided to post on his personal blog years ago. Guy decides to take down the model, now all of a sudden his hosting provider takes control of his site and forces him to put the model back. That is the lens through which you should view this situation.

The people building infrastructure that depends on one guy's 3D model existing on his blog at all times were the ones who made a mistake. If one of your thousands of dependencies breaks, shame on you, make a fork. The dependency owner owes you nothing, and he can change his creation or remove it any time he likes. If you weren't fortunate enough to fork it while it was still up, then too bad.

Instead we as a corporate community are encouraging coddling and ensuring that if you make this mistake, GitHub, NPM, et al will take care of it for you. The downstream effects of this are much worse than the temporary damage of making people actually figure out their dependency chains.

> It was malicious act to Github's users.

I'm not sure why it matters they are Github users. The packages were hosted on npm through Cloudflare - does that allow Cloudflare to take over the packages too? And NS1 since they host the fakerjs domain?

It’s cool that you’re internet rules-lawyering and all but ultimately he used his free account with intent to harm others, just as surely as if he backdoored his code. Freedom of speech is good, and protest is fine, but why would GitHub amplify the speech of a nutso who abused his position of trust?

>he used his free account

actually, marak has github pro, so it is not a free account

“Your freedom of speech ends at the tip of my nose.” as the saying goes. He took a swing, not just a stand.

> used his free account with intent to harm others, just as surely as if he backdoored his code

There's a huge difference between displaying a message and going in an endless loop and backdooring as in providing an alternative access to control a system you're not supposed to have access to. Words have meaning. This wasn't a backdoor.

There is a difference between robbery and burglary.

There’s a difference between a simile and a metaphor too, but GP is ignoring the fact I used one of those entirely.

They don't have to amplify anything. This is why open source is valuable; if the current maintainer is considered to be unfit or unreliable in some way, the community that disagrees with their rhetoric/leadership can fork the package and keep going like nothing happened. If you don't care/the package is still usable, then ideally no further action has to be taken.

At no point down the road should that involve revoking someone's ownership of a software project, though. Software ownership is sacred, not just because of tradition but because understanding who owns your packages and libraries is paramount to auditing security. Some of the most valuable contributions to computer science have been ones that allow people to verify integrity, be it SHA, TLS or GPG. If Microsoft abuses their position of power to break that chain of integrity, how can we be sure that other repos belong to their respective authors?

I can understand if you, the individual don't find this interesting or consider it inconsequential to your workflow. But other people rely on it, and you can't pretend like an honest chain of custody is somehow valueless.

Amazing you wrote this entire comment without taking a second confirm the premise you're so passionately defending...

No one took away his ownership.

Marak:

https://github.com/marak/Faker.js/

https://www.npmjs.com/package/faker

Post:

https://github.com/faker-js/faker

https://www.npmjs.com/package/@faker-js/faker

Faker.js is not a trademarked term, so someone made a new Faker.js.

In fact multiple people did, and one emerged as the preferred fork: https://twitter.com/faker_js/status/1481918305669627905

-

And to be clear, even if NPM goes and replaces his package with this new fork, it wouldn't take away his ownership.

Github could do the same... doesn't take away his ownership.

His ownership of a Github page is not his ownership of the code.

I don't like this rules-lawyering stuff either, yet this is one time where even if you decide to be purposely inflexible with your understanding of laws/licensing/contracts etc... there's still no issue with how this has been handled.

I see only one of those alleged "nutso's", and that was GitHub.

Everyone else should have been responsibly consuming the dependency. You don't get to call foul when you knowingly use something for something important and don't check to make sure it is okay.

Now that’s just plain victim blaming

As an engineer, part of your responsibility is to foresee this type of thing. Software that does exactly what it should, and is free of defects for it's immediate use case, has no need to be continually updated. As each line is adding more functionality you do not need.

Even if you're trying to keep things rolling forward and buy into taking in updates anyway; you don't do it in such a way as to cause it to leak to production until you are good and certain there is no potential for breakage. If you haven't learned this yet, give a monorepo a try. I assure you, you will be divested of any naivete in this regard.

Setting your package version to allow for minor updates _is_ responsibly consuming the dependency.

This sounds like "I responsibly test in production".

If you do test and isolate testing environment then this kind of breaking update is just business as usual.

That's fair, it does sound like a novice take; but it's still "business as usual" w/r/t what is touted as best practices where it comes to version control. At least that's my slightly above novice take on the matter.

> does that allow Cloudflare to take over the packages too?

Fundamentally cloudflare can do that if they so chose. If your threat model doesn't account for that sort of action then you should reassess.

Can != Should. we're not discussing whether Cloudflare had the physical capability of being able to take over the packages. We're asking if they should. Many people seem to believe that they should have, or would have been justified in doing so, and others disagree.

If the attack had been conducted by retargeting cloudflare at a hostile upstream, maybe so. But the attack originated at GitHub, so they're the ones to take action in response.

People point at github repositories all the time for packages.

Github owns npm.

This is an opinion you can have, but it's far from clear that it's an obvious or inherent one. What is the Github "community"? Who constitutes it? If I use Github for a personal project, and share the link with my friend, are we "part of the Github community"? How were we harmed by this incident? Did anyone say "We should shut Github down because they're irresponsibly hosting someone who would use his public JavaScript libraries to make a political statement"?

How was Github's community, specifically, harmed? A lot of developers were inconvenienced, but they would have been just as inconvenienced if he pushed the code to NPM from his local git repo, and never touched Github at all. Where does Github come into this?

It sounds like you’re looking for very clear lines which can and can’t be crossed. Whereas others see a blurry grey area in which GitHub makes judgement calls, and then individuals decide whether or not to use GitHub.

Mm, not really. There are lots of cases much more blurry and questionable then this one. What I'm looking for is 1) a recognition that Github would be in the wrong to suspend Marak for doing whatever he wanted with his own open source project, and 2) an acknowledgement that it's important for Github to be transparent about why they took the actions they did and what motivated their actions.

I still keep failing to see how it's malicious to gh users and I've red all your comments.