>he used his free account

actually, marak has github pro, so it is not a free account

“Your freedom of speech ends at the tip of my nose.” as the saying goes. He took a swing, not just a stand.

> used his free account with intent to harm others, just as surely as if he backdoored his code

There's a huge difference between displaying a message and going in an endless loop and backdooring as in providing an alternative access to control a system you're not supposed to have access to. Words have meaning. This wasn't a backdoor.

There is a difference between robbery and burglary.

There’s a difference between a simile and a metaphor too, but GP is ignoring the fact I used one of those entirely.

They don't have to amplify anything. This is why open source is valuable; if the current maintainer is considered to be unfit or unreliable in some way, the community that disagrees with their rhetoric/leadership can fork the package and keep going like nothing happened. If you don't care/the package is still usable, then ideally no further action has to be taken.

At no point down the road should that involve revoking someone's ownership of a software project, though. Software ownership is sacred, not just because of tradition but because understanding who owns your packages and libraries is paramount to auditing security. Some of the most valuable contributions to computer science have been ones that allow people to verify integrity, be it SHA, TLS or GPG. If Microsoft abuses their position of power to break that chain of integrity, how can we be sure that other repos belong to their respective authors?

I can understand if you, the individual don't find this interesting or consider it inconsequential to your workflow. But other people rely on it, and you can't pretend like an honest chain of custody is somehow valueless.

Amazing you wrote this entire comment without taking a second confirm the premise you're so passionately defending...

No one took away his ownership.

Marak:

https://github.com/marak/Faker.js/

https://www.npmjs.com/package/faker

Post:

https://github.com/faker-js/faker

https://www.npmjs.com/package/@faker-js/faker

Faker.js is not a trademarked term, so someone made a new Faker.js.

In fact multiple people did, and one emerged as the preferred fork: https://twitter.com/faker_js/status/1481918305669627905

-

And to be clear, even if NPM goes and replaces his package with this new fork, it wouldn't take away his ownership.

Github could do the same... doesn't take away his ownership.

His ownership of a Github page is not his ownership of the code.

I don't like this rules-lawyering stuff either, yet this is one time where even if you decide to be purposely inflexible with your understanding of laws/licensing/contracts etc... there's still no issue with how this has been handled.

I see only one of those alleged "nutso's", and that was GitHub.

Everyone else should have been responsibly consuming the dependency. You don't get to call foul when you knowingly use something for something important and don't check to make sure it is okay.

Now that’s just plain victim blaming

As an engineer, part of your responsibility is to foresee this type of thing. Software that does exactly what it should, and is free of defects for it's immediate use case, has no need to be continually updated. As each line is adding more functionality you do not need.

Even if you're trying to keep things rolling forward and buy into taking in updates anyway; you don't do it in such a way as to cause it to leak to production until you are good and certain there is no potential for breakage. If you haven't learned this yet, give a monorepo a try. I assure you, you will be divested of any naivete in this regard.

Setting your package version to allow for minor updates _is_ responsibly consuming the dependency.

This sounds like "I responsibly test in production".

If you do test and isolate testing environment then this kind of breaking update is just business as usual.

That's fair, it does sound like a novice take; but it's still "business as usual" w/r/t what is touted as best practices where it comes to version control. At least that's my slightly above novice take on the matter.