News for hackers. Stuff that matters.
Re:On the Weaponisation of Open Source by ajross on Friday March 18, 2022 @04:58PM (#30727439)
> In my opinion, these changes are effectively supply-chain attacks in their execution. That would make them bad regardless of how correct their expressed positions are about the Ukraine war.

Well, yeah. War is bad. On the spectrum of war badness, obviously, these pranks are pretty mild. But they're bad. It's a bad situation. When at war, people are forced to do bad things to prevent worse things. That's why starting wars is very bad.

Now, sure, you can argue about the semantics about "who" is at war, or whether these npm authors are "really" at war, or why they "think" they're at war, or whether they "should" be at war. You could also get into a discussion about whether or not this tactic is effective (and I'd agree it's hurting more than helping, btw). Go nuts.

But that doesn't change the fact that this is an action in support of a war effort. In wars, principled stands don't win. If you want a particular outcome, you have to pick a side.

Re:On the Weaponisation of Open Source by hulitu on Friday March 18, 2022 @05:52PM (#30728017)
> But that doesn't change the fact that this is an action in support of a war effort. In wars, principled stands don't win. If you want a particular outcome, you have to pick a side.

I picked a side. I will take care that npm is not installed on my computers. Take your political sh*t out of my computer.

Re:On the Weaponisation of Open Source by ajross on Friday March 18, 2022 @07:32PM (#30729002)
Perfect segue to that famous Clausewitz quote!

The premise behind your position is clearly that "politics" is some kind of meaningless distraction to the "real" business of shipping software. But... isn't that backwards? It's a war. People picked a side.

The idea that unilateral military invasion is merely "politics"[1] is... very strange to lots of people.

[1] In the sense of triviality you clearly intended, c.f. Clausewitz again.

Re:On the Weaponisation of Open Source by azangru on Saturday March 19, 2022 @09:36AM (#30733588)
> I will take care that npm is not installed on my computers

Easy to say if you are not a frontend engineer.

Re:On the Weaponisation of Open Source by fauigerzigerk on Saturday March 19, 2022 @04:56AM (#30732265)
>Well, yeah. War is bad

You're implying that wars have no rules. This is very much not true, not legally and not morally. You should read the 4th Geneva Convention to disabuse yourself of this dangerous misconception: https://ihl-databases.icrc.org/applic/ihl/ihl.nsf/INTRO/380

>In wars, principled stands don't win

And excessively unprincipled stands can get you sent to The Hague to be prosecuted for war crimes.

Now, I'm not saying that deleting some files is a war crime. What I'm saying is that your reasoning for why it is legitimate is flawed.

I even doubt that you would agree with your own reasoning given some other examples. E.g., would you not agree that while we can ask McDonalds to stop doing business in Russia, it would be a crime for them to start poisoning their Russian customers?

Re:On the Weaponisation of Open Source by klibertp on Saturday March 19, 2022 @06:11AM (#30732564)
> And excessively unprincipled stands can get you sent to The Hague to be prosecuted for war crimes.

Unless you're from the US, in which case the US will invade Netherlands to get you out of there. Apparently, there is a law (from 2002 IIRC) which allows the US to do this legally.

Same goes for Russia, China, Iran, Saudi Arabia, and a lot more countries that did not sign (or ratify) the Rome Statute.

> One of the principles of international law is that a treaty does not create either obligations or rights for third states without their consent, and this is also enshrined in the 1969 Vienna Convention on the Law of Treaties.[149] The co-operation of the non-party states with the ICC is envisioned by the Rome Statute of the International Criminal Court to be of voluntary nature.[150]

For Russia, China, and the US there's literally nothing that can be done: while the "members of UN Security Council" are "compelled to co-operate" with the ICC, these members can veto anything that comes up.

In other words, if you're from one of non-signatories, you can willfully kill, torture, subject to inhumane treatment, perform biological experiments, steal and destroy property, take hostages, unlawfully confine, transfer, and deport, and even willfully cause great suffering without fear of any kind of prosecution.

Does Geneva Convention make a difference? I only learned about ICC and Rome Statute, and it was disheartening enough for me to stop reading, so it's a genuine question.

Re:On the Weaponisation of Open Source by fauigerzigerk on Saturday March 19, 2022 @06:28AM (#30732644)
>Does Geneva Convention make a difference?

Yes I think it does. Whatever the limits of enforcement, it means something that all the countries you mention are signatories to the Geneva Conventions I - IV.

Even if these countries refuse to extradite their citizens to The Hague, it doesn't necessarily protect war criminals from prosecution in their own countries. They are still breaking the law.

Re:On the Weaponisation of Open Source by klibertp on Saturday March 19, 2022 @10:05AM (#30733779)
Right, and apparently all signatories to the Convention have an obligation to prosecute people who commit "grave breaches" of the conventions, no matter their nationality and the place the crime took place. So, if a commander from X commits the crime, and the X refuses to prosecute him, he can be legally captured and tried as soon as he visits another signatory country. This is better than just the ICC, definitely (if I understand it correctly).
Re:On the Weaponisation of Open Source by the_why_of_y on Saturday March 19, 2022 @09:46AM (#30733659)
Several countries have implemented some form of Universal jurisdiction for severe crimes like genocide, meaning their courts may prosecute regardless of nationality of the accused or country where the supposed crime happened.

Of course the practical problem is getting hold of the suspected war criminals.

https://en.wikipedia.org/wiki/Universal_jurisdiction

https://www.justiceinfo.net/en/39791-international-crimes-sp...

Re:On the Weaponisation of Open Source by AnonCoward4 on Saturday March 19, 2022 @05:28AM (#30732386)
> E.g., would you not agree that while we can ask McDonalds to stop doing business in Russia, it would be a crime for them to start poisoning their Russian customers?

In the current climate I am not sure anymore that people would disagree with poisoning Russians. Here in Germany they started to purge everything Russian (except people) and also agitating against Russians in general. It feels like we learned nothing from WW2.

From what I've seen there seem to be worldwide movements in that regard, that are even overboard for cold war propaganda.

edit: added "except people"

Re:On the Weaponisation of Open Source by z1nc on Saturday March 19, 2022 @02:53PM (#30736576)
I've seen a few people in the media specify that the war's about Putin's aggression, rather than Russian aggression. But I doubt that they're the majority. Russophobia sells better. We've got people vandalizing businesses [1] and sending threats in the US as well. That doesn't help anyone in Ukraine, if that's really their goal. It certainly doesn't affect Russia's economy if a restaurant in another country takes a dive. The point of the sanctions is to hurt Russia's government (and therefore their military). There's a cost to sanctions as well for Russian citizens who have nothing to do with the war, but I've yet to see an alternative solution beyond escalating the conflict.

[1] https://www.axios.com/russian-businesses-us-vandalism-threat...

Re:On the Weaponisation of Open Source by efitz on Saturday March 19, 2022 @02:38AM (#30731696)
I think you have it completely backwards. You should not involve yourself in any war that you don’t personally want to fight and maybe die in. You do NOT have to take a side. You can oppose the war, or one or both sides, even vocally, without entangling yourself in the war.

If you choose to become an actor in a war, then you also open yourself up to being attacked. There is only one kind of actor in a war- combatant.

Consider the maintainer who did the “delete all files on servers with Russian IP addresses.” This could be construed as an act of war against Russia. Would Russia be wrong to commit acts of war against this person? If the server performed some life critical task like operating hospital equipment or air traffic control or whatever, this change could have resulted in loss of life (so many mistakes in using JavaScript in such cases but set that aside for a moment). If lives were lost as a result, would Russia be wrong to use lethal force against the maintainer?

Disclaimer (sad that you have to add this these days; it should go without saying): I only use this as an example. I think Putin is a thug and I think that it goes against most westerners’ values, mine included, for nation states to preemptively invade other nation states. I’m not apologizing for or justifying any act by Russia. I have deep sympathy for people in Ukraine who just want to live their lives and not be killed or have their stuff destroyed.

Re:On the Weaponisation of Open Source by rosndo on Sunday March 20, 2022 @03:29AM (#30740843)
>Would Russia be wrong to commit acts of war against this person?

>If lives were lost as a result, would Russia be wrong to use lethal force against the maintainer?

Yeah, unless they want to admit that they’ve been waging war against the entire western world by allowing their homegrown ransomware groups to operate with impunity.

If we go by your logic, Western countries should have turned Moscow into a giant glass parking lot after NotPetya, a destructive wiper worm released by the Russian government targeting the entire world.

Luckily you’re alone with your thinking.

Re:On the Weaponisation of Open Source by efitz on Monday March 21, 2022 @08:19PM (#30761449)
Apparently not, guy got swatted. [1]

And there are levels of warfare between "nothing" and "nuclear", in case you hadn't noticed. And North Korea and China are doing state-sponsored attacks against US targets, commercial and government and military. It's not clear to me that NoPetya was state sponsored, it's ransomware. The RF is not a bastion of law enforcement and justice; I agree that they do a terrible job of controlling organized crime activities, both cyber and non-cyber.

[1] https://www.vice.com/en/article/dypeek/open-source-sabotage-...

Re:On the Weaponisation of Open Source by twaw on Saturday March 19, 2022 @03:57AM (#30732042)
RF kills people for any or no reason. Why you worry about that? If you think that when you don't attack RF, then they don't attack you, you are wrong. You are member of rotten West, your country is a member of evil NATO, you are speaking non-russian language, and you are spreading anti-russian propaganda. You are danger to Russian Civilization. They will kill you, but their ressources are limited, so stay in line.
Re:On the Weaponisation of Open Source by jacobsenscott on Saturday March 19, 2022 @01:39AM (#30731418)
But none of these people picked a side in any of the other currently ongoing unjust occupations, or any of those in the recent past. So clearly you don't need to pick a side.
Re:On the Weaponisation of Open Source by jollybean on Friday March 18, 2022 @05:18PM (#30727650)
"principled stands don't win."

Fighting against bad actors is definitely a 'principled decision'.

Ignoring the situation and not taking action is an 'unprincipled decision'. Though it might disguised as principled action, on the basis of supporting some other principle, such 'open source', but ignoring one at the expense of another implies serious lack of self awareness.

This war, plus COVID, and the recently released documents indicating a planned invasion of Taiwan (though we don't know for sure) - represent major geopolitical shift of the order of WW1/WW2/End of Cold War, the stakes and consequences are enormous.

Re:On the Weaponisation of Open Source by ajross on Friday March 18, 2022 @05:32PM (#30727817)
That's sort of a semantic argument. To be clear: I was contrasting "choosing a side" (in this case by senselessly pranking your npm customers) as being a "practical" choice, vs. the "principled" stand taken to avoid the conflict out of a general sense of open source decorum. Obviously in some sense all decisions are based on "principle".

And the point is that it's a war. We've crossed the "bad things are going to happen" Rubicon already. You can't make principled arguments like that against people who have chosen to engage in a war out of the hope or desire for one side to win. They already did that moral calculus. It's like telling someone they shouldn't defend their home because pacifism is more important. You might be right, but you won't change anyone's mind.

Re:On the Weaponisation of Open Source by DocTomoe on Saturday March 19, 2022 @05:39AM (#30732434)
Your argument creates dangerous implications. If a programmer creates targeted malware as an act of war - wouldn't that make him a valid military target? Would Russia be legitimised to carpet bomb wherever that programmer is supposed to live in retaliation? If not, would they be legitimised to capture and execute him - because he certainly isn't a legitimate combatant?
Re:On the Weaponisation of Open Source by sokoloff on Saturday March 19, 2022 @08:27AM (#30733222)
I surely wouldn’t bet my life that the targeted country would consider it a mere prank.