By putting it on Github, he surrendered a portion of his right to distribute to Microsoft, and Microsoft did the best course of action to protect their reputation and the interest of their stakeholders.
I see nothing wrong with this.
then pay him? I'd admit that this person didn't really contribute anything really worthy. But please do not require someone to be "professional" when you did not pay him a dime.
So what you do mean is someone had to spend hundreds of hours maintaining some projects you've been using and also should have perfect personality and well behaved enough before you hire him?
You see a build fail, you pin the previous version of that dependency, run the build again and go on with your life.
Asshole move? Sure. Hazardous and dangerous? Don't be dramatic.
vs. an open source developer who’s work benefits companies like Microsoft who have no obligation to pay for that labor. And engages in a single industrial sabotage which causes minor disruptions, and harm which at most costs other developer some time and temporary frustrations.
I feel like we need some sense of relativity when we attribute nouns such as hazardous and dangerous here. Especially when we are talking about Microsoft.
Just like BLM could protest in a remote location or do an online petition. Except that no one would give a fuck about that. The same about a message during the build.
You call it a DoS attack, I call it a brownout warning about unsustainable open source funding. After all old versions are unaffected. No hidden RCE there. Only ones who opted in for pulling a new version without due diligence (aka free shit lovers) experienced a minor inconvenience. He didn’t do anything a malware author would do with such distribution channel.
I would definitely do it some other way, but can’t blame him. If he had put a notice during the build, no one would see it. If he added an unskippable five minute timeout to that message it would a DoS attack as well.
I suffered a similar “DoS attack” myself. By Microsoft. They did one hour brownout of Devops pipelines still using windows server 2016 or something, to warn about unsustainably of supporting them (striking similarity). Right at the moment we had to deploy an urgent hot fix for our client. If there was a notice somewhere, I didn’t read it. No one does. Which is why they do brownouts. He didn’t put an early warning, but that might be a difference between a multibillion company and some random guy on the internet.
He is unprofessional, but well, don’t expect professional behavior from people you don’t have professional relation with. Who I would call unprofessional, are the developers who expect free working shit from some random internet guy and have audacity to complain when he intentionally releases a broken version to protest taking free stuff without giving back.
I’m mildly entertained by the uproar caused by his protest. Reverting to an older version of a library is not an end of the world. I think it is not caused by the minor inconvenience he caused to the lazy devs, but by the threat of the end of relying on free work from open source devs.
We will have to do it ourselves or pay for it. Like in any other industry.
I can't create code with malware. I can't modify my code to make it malware. That's a crime. You're wrong
And the cybersecurity industry would like to have a word with you since you don't believe it's possible to create malware.
https://law.stackexchange.com/questions/966/can-one-be-liabl...
> I can't create code with malware. I can't modify my code to make it malware.
I guess I can appreciate your confusion but I still think I was clear in my previous comment. I'm willing to concede I would have been more clear if I had written:
I can't legally create code with malware to distribute without a warning. I can't legally modify my code to make it malware if I know people are using it.
PS I'm not discussing this further
"1,2,3" Honestly, these ARE better things to do (and probably more effective) than what Marak has done.
"replaced his code with an infinite loop that was a DoS attack" So far I haven't seen anything about this actually causing harm and denying service.
"The fact that his attack wasn't more severe (like, say, encrypting someone's hard drive) doesn't mean it wasn't an actual attack." The fact that his attack wasn't more severe shows that he wanted something that would make an impact without hurting anyone.
" guarantee no legal system is going to let an actual malicious act be defended by a license. " That's the legal system's problem. The license is the license. Somebody's violation of an EULA (because they didn't read it) may be in all ways justified, but that argument probably won't hold up in court.
I wish he did something less controversial while still impactful, but it is incorrect to put it under the same term used to describe real cyberattacks that severely harm and kill innocents.
What he just did is intentionally mess with the society for the heck of it and naturally the society will find ways to fix it and restrict him as necessary, right.
I think this is the crux of it all. I (and many others it seems) disagree with the actions he took and think they're shitty, but also think he has a right to do this with his code that he provides and publishes for free.
1. Pulled down his repo, or replace his repo by whatever message he wanted to send.
2. Output his political message during the build.
3. Heck, all faker.js does is output fake data for things like names and addresses. I think he would have been well within his rights to make this data something like "123 Fascist Way, Fascistville, NY".
But he didn't. He replaced his code with an infinite loop that was a DoS attack. He deliberately released it as a patch version because he knew it would be pulled in by others that follow semver rules. The fact that his attack wasn't more severe (like, say, encrypting someone's hard drive) doesn't mean it wasn't an actual attack.
And for those quoting the "no express or implied warranty" section of the license, I guarantee no legal system is going to let an actual malicious act be defended by a license.