> Did that guy make a mistake? Obviously. Was it in good faith? It seemed so.

Adding unwitting users' computers to a proxy network by default is so obviously and blatantly unethical, it beggars belief. I'm not angry at the creator, because they seem oblivious. I am, however, extremely saddened and frustrated by their obliviousness. Like in no universe is it ever OK to do this even if nobody responds to your discord poll. It takes a real failure in responsible, ethical upbringing to get here. It takes a lack of consideration and empathy for other people to believe that including this isn't an act of aggression towards everyone who encounters the software.

I personally have a very hard time believing they are oblivious. It’s a literal caricature of malware. There is no way one could think it wouldn’t cause this kind of reaction. The best one could hope for is that people don’t notice.

I want to be able to agree with you, but too much of the world is poisoned by toxic "me before you" society. There's a high probability that this person just never learned to recognize and challenge behaviors like this. So, maybe, but also maybe not. Either way it's sad.

> Like in no universe is it ever OK to do this even if nobody responds to your discord poll

As far as I can tell, they didn't even really make a Discord poll.

The first mention of "spider" (or "IP" or "proxy" or any related words) is from the release announcement of a version which already contains Spider, which got negative reactions: https://i.imgur.com/gLKce8W.png

It's very deceptive wording since "I made an announcement to poll people's reaction" is technically true, but it wasn't a poll or before the changes were made as is implied. Same with "There were very little comments", which leaves out the fact the comments they did get were negative and the low quantity is just from it being a small unknown Discord server.

Looking at how he named the commit that introduced it.. it just stinks, looks like it's trying to go in unnoticed.

Or sadly, that commit log standards are nonexistent and don't have to describe the changes and be misleading, it's one of those.

The guy deceptively enlisted thousands of users into a botnet without notification and likely through auto-update mechanisms (such as the Windows app store). That sounds criminal.

It’s not auto updated on windows, it’s an annoying pop up suggesting you go download a latest version, thankfully

From the guy:

> ImageGlass Store version is not affected.

Does the Windows Store not allow you to sneak in proxies to user machines?

It's paid for, so I guess it would be in bad taste to have that included. At least the free one you can argue it's ad-supported or whatever.

"ad-supported" and "malware" are not the same thing.

Maybe the author is located in a country with weak cyber crime laws (and does not intendl to leave it).

IIRC the author is from and lives in Vietnam.

Shipping malware is not a mistake. The amount of people simping for this guy is unreal.

"Poor guy doing open source takes dumb decision because they need money" is a sorry excuse I've been hearing too much lately.

And quite distasteful when many people have collaborated on your software. If you deserve some compensation, what about all of them? Will you share whatever you earn from it?

> And quite distasteful when many people have collaborated on your software. If you deserve some compensation, what about all of them? Will you share whatever you earn from it?

Most contributions are from drive by contributor's that may not even use the project.

Neither those nor the maintainer are entitled to compensation, but open source is a cruel environment where people want to use what you made but they wouldnt give you a dime unless they had to

Maybe it’s time we re-examine the value prop for open source authors

Everyone knows their value prop going in: unless you are able to monetize the complement like RedHat or Google, payment is in experience, reputation, and a fun challenge.

Very idealistic people might not realize this as they start working on their project.

I wish it was otherwise, people, but it's usually "build it and they WON'T come" ("they" being the funds needed to make a living.)

Payment can also appear in the form of collaborators helping improve a tool you want for yourself, especially if you choose the right license.

Hell no it was not in good faith - if this makes you think that you shouldn't do open source because of people having malware patched into their system to profit some guy, please, never do it.

The author added malware to the project. That's about as user hostile as it gets, and hostility breeds hostility.

A reverse hostility sandwich, if you will

xD fixed the typo

How do you conclude that quietly integrating malware into an image viewer was done "in good faith"? Because the author didn't twirl their mustache when they did it and claimed surprise that people were mad?

This is not a 'good faith' action. It is a way to try to monetize your users bandwidth in a way that exposes them to liability. It is so far across the line that it is sad that that needs to be explained.

You have it backwards. Open source is the reason why it was detected. Closed source would have made it extremely hard to find.

For the poster you're responding to, I get the impression that their main goal is to avoid dealing with angry users, so people not noticing the change would have been a feature, not a bug.

>Was it in good faith?

On what planet could this be considered good faith?

I was struck by the stark difference in tone among so few commenters. There were firm, constructive, factual feedbacks, and aggressive, inflammatory personal attacks (“how can anyone trust you?”). Laid bare like that, it is so obvious which approach is better and most effective. Obviously the maintainer made a terrible decision, but there’s a right way and a wrong way to suggest correction.

We need more martinlindhes in open source and fewer Yakabuffs.

Well, it's a good question. How can you trust someone who thought this was okay? Even if they're just too ignorant to realize what they were doing, that's also a good reason not to trust them. What else will they think is a good idea?

These are all legitimate questions, but when you phrase them that way and address them to the maintainer, consider how the message will be received. He is likely to consider it an attack, and will be tempted to mount a defense. Now, instead of a constructive problem-solving discussion, you have a destructive battle—one that does not move things forward towards the goals: removing the change and preventing further bad decisions.

There is no constructive criticism possible and no possible further relationship. If I'd been a user of this project, I'd be reformatting my PC and restoring from backups, and the nasty message I'd leave on github would only be intended to warn others away from this toxic person's code.

If someone conspired to enroll my computer in a botnet, constructive problem solving would not be the first thing on my mind, and in fact I don't see how it could be my responsibility. If I fuck up very badly and people are mad and unconstructive, that's unpleasant but the problem is my fuckup, not people being mad about it in the wrong way.

It seems to me that it's up to the author to explain why the project can still be trusted, they can't just do this and expect that people will still trust them just because they reverted it.

You are right.

everyone makes a mistake at some point and the fact that the dev used the ip hijacking service's name in the commit message to me signals that he wasn't aware of how shady it is

Even if he was, a comment like "I don't think this is acceptable and will fork" is a lot more appropriate than "don't talk shit"