It's difficult to trust NPM after node-ipc. After all, it's pretty close to a software eqivalent of warcrime. Imagine a hospital used node-ipc and got its files deleted.

I really hope no hospital did use node and npm to store important medical information or on critical systems.

But if they did, people might die for real, if suddenly important information about patients is gone or manipulated. Or a important operation had to be canceled because of it. How can one critizise bombings of hospitals and then potentially do the same on a software level?

Oh no, indeed, how could someone possibly object to killing civilians in cold blood with the full military force of an arguably-developed nation, while themselves committing such horrible crimes as - gasp! - deleting files? patterns of bits have human rights too!

Get over yourself.

> patterns of bits have human rights too!

I think the main concern of the OP was with _human_ collateral damage that can result from the deleted bits. Having worked for years in EMRs, I can definitely say that sustained IT outages in modern hospital systems can and often do lead to increased deaths.

Other things that lead to increased deaths: the Russian military intentionally bombing civilians.

I usually oppose “whataboutism” but I can’t bring myself to do it here. This is a war where the nation of Russia has decided to murder Ukrainians. Means to interfere with Russia’s blood-soaked campaign must be viewed not in isolation, but in the context of what they are attempting to stop.

To be clear, I am not making a general purpose “the end justifies the means” argument. I am making a narrow and specific “the circumstances justify extreme behavior with severe externalities” argument.

What ends were achieved? Has sabotaging node-ipc made any measurable progress towards stopping the war? The danger when you let the ends justify the means is that when you don't achieve your ends, then you haven't justified your means.

This fails the 'proportionality' test. Contrary to popular knowledge, it does not refer to number of civilians killed*, but to whether any legal goal could reasonably be achieved proportionate to the hurt.

Now, there's nothing this action could achieve aside from making people angry, becoming Russian propaganda-fodder, reducing trust in NPM, etc, in any remotely likely scenario. So any damage is a crime, and arguably even the possibility of damage is a crime.

* A strike on head of ISIS while being surrounded with a class of children might pass this test. Similarly even if one side (say ISIS supporters) has more civilians killed that does not imply a crime by itself.

"Other things that lead to increased deaths: the Russian military intentionally bombing civilians."

Yes, this is a warcrime. But the proposed solution is to react with a warcrime?

I do not agree.

This is a really important thing to bring up.

Because the first time was about money, and the second time was about ethics?

If you really think that in security of open-source people should tolerate a malware attack because the author says ‘oh, I'm fighting those Russians’, then I sure hope I'll never have to use any of your software.

I’m very sympathetic to the attacker here, but I can’t imagine an argument for why there’s an ethical obligation to delete random Russian users’ files, much less why that duty should outweigh the NPM project’s general duty of good stewardship.

I’m not suggesting it’s right. Just speculating on what makes it different.

Because there is an obligation to stop the war by any means available. Since Putin will not stop voluntarily, he must be rendered unable to continue. Every possible tool to drain the resources and undermine the tenuous stability of Russia is necessary and appropriate.

War sucks for civilians. It sucks less for the civilians who get some files deleted than for the civilians who get their houses shelled by Russian and Belarusian artillery.

Does the NPM project have a general duty of good stewardship? Of course. Does the NPM project have a duty to interfere with a developer who chooses to increase the misery and pressure applied to a nation that has been committed to a path of an unjust war of aggression, which is deliberately bombing civilians? Fuck no.

I don't agree with the premise that every tool is appropriate and I struggle to believe you do either. If your boss told you that you need to work unpaid until further notice because they're donating everyone's salary to Ukraine, you wouldn't object to that? You wouldn't have concerns if you came home one day to find your stuff on the curb because your landlord wanted to make room for refugees? A lot of tools are appropriate that wouldn't be appropriate for most international disputes, but when you're fortunate enough to not be in the warzone, you can't go crazy and start smashing random people's root directories.

"Since Putin will not stop voluntarily, he must be rendered unable to continue."

Regardless of one's positions on the Ukraine war, I don't see how manipulating node packages could, for example, stop a Russian hypersonic missile or fortify Ukrainian barracks.

By the way, if you look at the damage to Ukraine's infrastructure and human capital, it has already lost the war. Also evident by repeated calls from Zelensky to resume negotiations. He badly miscalculated from the start...