Another fun scenario: your project has two dependencies, made by two different developers: `left-pad` and `right-pad`. `left-pad` will format your hard drive if it geolocates you being in a state that allows X. `right-pad` will format your hard drive if it geolocates you being in a state that criminalizes X.

Write a wrapper project that changes your location before any left-pad or right-pad function calls. Or just fork both and fix them how you see fit if they're open source.

Dependency hell but with more politics!

You pretty much summarise what is wrong with the title.

It is not "Protestware" that harms open source. It is politics and ideology harms open source.

And the rate things are going may be Open Source will not only be split between permissive and copyleft, but progressive and libreRight.

Edit: Now I remember Douglas Crockford's "The Software shall be used for Good, not Evil." license. I wonder if there are still any open source that uses it.

> It is politics and ideology harms open source.

The movement towards free and open source software was created in no small part do to activists with a very strong ideology. Open source would not exist to the same extent without the ideology espoused by the FSF. The problem is that abandoning a key tenant of the free software movement, neutrality towards different uses (part of freedom 0 of the free software definition), does far more harm than good and contravenes FLOSS ideology.

> The movement towards free and open source software was created in no small part do to activists with a very strong ideology

They did have a strong ideology and they worked towards building the world they wished to see. Not by breaking existing things to virtue signal their support for "the current thing"

And then all of the effort spent on "building the world they wished to see" gets used to also build a world that goes against everything they wished, against their ideology. Due to openness of their efforts they also don't have an option on influencing that, unlike commercial products who can simply stop doing business with precise companies/people/territories. What if the very idea of open source gets used against itself? What would you advise those people to do? Shut up about "the current thing"?

Yeah, but that means the problem is in fact protestware and not "ideology" in some vague sense.

yeah it's kind of ironic to call for "no politics" in a movement that is essentially based in digital anarchism.

Thanks. Brilliant response I will save ( or Steal it ) it next time the conversation comes up.... which is increasingly common in Open Source.

> The movement towards free and open source software was created in no small part do to activists with a very strong ideology.

This is true, and an argument that keeps getting repeated, but isn't the same issue. The politics of open source software are about software. How it's made and how it's used.

The modern push is about injecting outside ideology into software (and everywhere else). Bringing geo, gender, and racial politics into software is a whole lot different than software politics in software.

Either you or I misread GP, because I don't see any disagreement. GP points out that FLOSS movement was and is inclusive by design, while this modern development is exclusive by design against people who disagree with the person's opinions.

Yep, not disagreeing with them at all on their overall point. I just see this "FLOSS is inherently political" line floated a lot, and wanted to point out that it's a false equivalence. I probably could have made that clearer.

That's exactly what I would write here. FLOSS is basically a political movement against the software industry since 1960...

"protestware" is just malware. The punchline is: do you understand your supply chain? Can you audit your software? Do you have security controls for potentially hostile packages?

This is nothing new: this is a problem which has always existed.

you can't really escape politics and ideology. What you can do, is to not be petty with your public contributions. As the parent example states, while somebody /could/ embed malware into their software that targets Texans, this falls under the pre-existing social doctrine of a "dick move". These things exist on a scale from "exclude government/corporate entities from your software license" to "try to fuck up random people's hard drives" and vary widely in terms of validity.

I think the main problem is that we are increasingly operating with different definitions of "dick move."

To many people, the idea that a small business owner would have their store burned to the ground because someone else in their town (or on the other side of their country) did something bad, is a massive dick move. Yet, this happened numerous times during the summer of BLM in 2020 and it was widely defended with things like, "everything is political" and "not to take a side is to take a side" and "you're either with us or you're against us" and "mostly peaceful protests." There was even a famous "looting is reparations" in articles and at least one book called "In Defense of Looting."

If anybody is defending burning down small businesses as part of BLM, I can promise you they're in the vast minority.

It isn't ideology, it's malware for political purposes.

https://xkcd.com/605/

No, at the rate things are going, OSS will not be as you describe.

Thanks for the perspective and the laugh. It's very easy to see a trend that isn't there in an aberration.

The only good news I have for you is that _perhaps_ in that case the FBI and CISA will investigate, because there will be a US resident victim.

IP-based geolocation is garbage but there aren't many Russian/Belarusian-attributed IPs in the US so the intersection of those with people using node-ipc was empty, and the US Government couldn't be pressured to investigate/enforce.

Putting such trust in state actors in the year 2022 seems optimistic to the point of naievety.

This administration might be D, but the next one might not be. What's the statue of limitations on CFAA?

I have legitimately argued against using NodeJS as the foundation of our next product for this very reason.

NodeJS' culture is very much "move fast and break things", and "all software is political". Look at the TSC drama. Leftpad.js.

This isn't an ecosystem that you want to build and maintain a product on.

Basically all big js front ends have the same issue. Most of them had banners or whole pages for the BLM movement which made no sense to anyone outside of the US like myself.

I mean a framework or library with a global audience shouldn't push american politics. Vue, React, Preact, Nodejs, Ember (had a whole page and made documentation unavailable for some time), Go lang, ExpressJS (still has the banner up), Typescript, a lot of python projects etc etc. The list can be made very long.

I try to avoid any framework and library that pushes political agendas onto their sites because that signals what type of people are in charge of them. They must think that their political views are so important it must infiltrate every aspect of life even if the thing has nothing to do with it. Unfortunately, there is such a large amount of them doing this it's practically impossible to avoid it.

The funny thing is, now when Russia has invaded Ukraine there is no banners on the same websites so it's obvious some lives matters more than others in their views..

> Most of them had banners or whole pages for the BLM movement which made no sense to anyone outside of the US

pretty sure they made sense to quite a few people outside the US:

https://blacklivesmatter.uk/

https://tribunemag.co.uk/2020/06/frances-black-lives-matter-...

https://www.americamagazine.org/politics-society/2020/06/22/...

Comparing europe with the US when it comes to the police killings is ridicolous. Sure there was attempts to bring it to europe but that is besides the point. There are a lot of countries in the world, many without any issues in which the BLM protested against. Why should we get pushed american politics for? What is the point?

The UK as an example had something like 6 people killed that year when protests arrived. Most of which wasn't black if I remember correctly. Do you really think it's comparable to the issues that exists in the US?

My critique is still valid tho, doesn't ukrainian lives matter? Why are there no banners for them?

> The funny thing is, now when Russia has invaded Ukraine there is no banners on the same websites so it's obvious some lives matters more than others in their views..

Supporting one issue publicly does not mean you think it's more important than every issue you don't support publicly.

It would seem to.

That was literally the whole thing of "inclusive language" right? It wasn't about what the words actually mean, just how people felt about them. If they felt the word was discriminatory, then it should be fixed.

If you're going to throw up banners on every JS site for one cause and not another, you're saying very loudly you don't care as much about the other. You, under the logic of "discriminatory language" even be engaging in discrimination.

> Supporting one issue publicly does not mean you think it's more important than every issue you don't support publicly.

There is a big difference with war and people being systematically killed and a potential unjust legal system. War is obviously many times worse in every aspect and I think it's hilarious on what these people publicly support and what they don't.

It's hypocritical, unfair which makes it a big irony since that was what the BLM movement was all about (unfair treatment).

> Most of them had banners or whole pages for the BLM movement which made no sense to anyone outside of the US like myself.

It isn't limited to JS frameworks. I remember seeing banners on Kubernetes docs too.

It's not even that a software project can't (or shouldn't) have political causes that it supports.

It's the arrogant attitude that "if you aren't for me, then you're against me". That their views are so righteous, that the only people who could possibly object are bad actors.

Again, you’re calling this “political” because it doesn’t matter to you, and it certainly sounds like it doesn’t personally affect you. To other people, BLM is a serous existential threat. You’d lose your mind if someone chalked the question of your existence up to “politics”. You’re really showing your hand. And no, I’m not American either, but that doesn’t somehow make me blind to the fact that BLM is a big deal.

So why doesn't the same sites have banners for Ukrainian lives? Russias invasion is for sure a bigger existential threat to them since they got invaded by a foreign state.

I think you're showing your hand, I am arguing for treating everyone the same and that the people in charge of these sites appears to care more about American lives than Ukrainian ones.

If you're gonna have banners, then having them for ukraine is an obvious choice for me. OR.. maybe you could decide not to involve politics into tech with a global audience at all and skip all this bullshit.

It’s a problem in any ecosystem. It’s not like there haven’t been attacks in nuget packages or the recently famous Log4j vulnerability. I’m not going to pretend there aren’t some pretty deep flaws with nested dependencies in Node modules, but it’s really more an issue with unprofessionalism in my eyes.

I’ve never worked a place that would auto-magically roll out things like windows or chrome updates without having them vetted first. If you can’t trust those, then you certainly can’t trust some random NPM package, and if your organisation doesn’t have a strategy for how you handle something that unsafe then you really need to step up your professionalism.

I personally consider NPM packages to be sort or nice, in the very cynical way, that the community tends to beta test updates for you much faster than with any other dependency system.

Not all ecosystems are the same in the extent to which auditing and maintaining dependency chains is a burden. All of Linux from Scratch consists of something like less than 90 distinct dependencies, for instance. When I went to add a token-replacement library to mdbook so I can interpolate variables in a book, Cargo pulled in 287 dependencies. For better or worse, the newer, hotter languages of the day seem to be predicated on extremely small, something single-function, libraries, and thus enormous and arguably intractable dependency trees.

All things are inherently "political" just not always significant enough to be worth considering.

The trite ways to say it (ie: "we live in a society" or "actions have consequences") don't really capture the full complexity of human interaction but do somewhat describe the notion that everything you do as an individual affects and is affected by everything everyone else does. Being "political" really means just believing that those effects are too significant to ignore.

What makes everything political? Of course something I do or say can influence others, but it is still not political in the vast majority of instances. Not even non-significantly.

Political action is shaping my environment to my desire. Via compromise or war perhaps. What is your definition of it that it applies to everything?

That's just action. What makes it political is if happens to have an effect outside of your home. (And technically even those restricted to the inside will usually end up having some sort of effect outside of your home.)

Hm, I disagree that any effect has to be political. If so the word seems to have little intrinsic meaning.

Isn't this mostly a problem of auto-updating and non-pinned dependencies? If you vendor and audit your dependencies this isn't really a problem.

Yes true but have you audited your thousands of modules? If you have a build tool that wasn’t born in 2020 chances are it pulls a hundred dependencies from 20 separate vendors.

I saw this as a JS developer who scarily runs npm installs multiple times a day.

I’ll be using Deno for new projects from now on.

That reminded me of the whole Ayo.js thing: https://github.com/ayojs/ayo

The NodeJS community somehow tends to attract the worst kind of people.

again, nothing blocks you to have a better supply chain to your software:

Download all dependencies and freeze them, fork the dependencies and groom your fork or have dependantbot or depfu managing your dependencies for you and keep a delay between merging the PRs, have manual review, etc..

You shouldn't be pulling stuff from internet and pushing to production without take a look into that anyway...

So you’re basically saying, don’t use X tool chain because the 3rd party software doesn’t move on your pace? Or they have different “views” than yours? I don’t see how that makes any sense. Why do you have to be beholden 3rd party developers and the pace they work at?

I'm not sure if you being purposely obtuse, but the idea that you'd build your software on top of a technology or platform that might introduce instability due to the whims or politics of its stewards is absolutely and obviously a risk worth considering.

Did you read the parent article?

But, in at least one case—the peacenotwar module in the node-ipc package—an update sabotages npm developers with code intended to wipe data stored in Russia and Belarus. In a March 16 blog post on the malicious code, Liran Tal at Snyk said, “This security incident involves destructive acts of corrupting files on disk by one maintainer and their attempts to hide and restate that deliberate sabotage in different forms.”

This has nothing to do with pace of development, or even the political views of the developers. It has to do with inserting what is essentially malware into open source packages that affect users based on geo-location.

OK, and how is this something unique to the Node.js package ecosystem? What's stopping someone on PyPI/some other PM from doing the same thing? I personally view these more as malicious copycat acts than anything inherent with the ecosystem. Should NPM start manually reviewing all of the packages that go through them, because the handful of abusers? I'm not so sure. The situation on languages without a widely used package manager/ecosystem like C++ I don't think is any better.

I use software to build stuff, not to subscribe to a set of political ideologies.

A small, extremely loud, and extremely sanctimonious part of the population will not accept that. They will consider your lack of political motivation for your work distasteful and eventually immoral. You'll be asked to support movements, participate in ritual, and publicly proclaim your allegiance. Eventually, they'll demand it.

“Of all tyrannies, a tyranny sincerely exercised for the good of its victims may be the most oppressive. It would be better to live under robber barons than under omnipotent moral busybodies. The robber baron's cruelty may sometimes sleep, his cupidity may at some point be satiated; but those who torment us for our own good will torment us without end for they do so with the approval of their own conscience. They may be more likely to go to Heaven yet at the same time likelier to make a Hell of earth. This very kindness stings with intolerable insult. To be "cured" against one's will and cured of states which we may not regard as disease is to be put on a level of those who have not yet reached the age of reason or those who never will; to be classed with infants, imbeciles, and domestic animals.” - C.S. Lewis

Oh there's no eventually. They've been demanding it for years. There's a very good reason why some software on my machines is already pinned to specific versions, and will not under any circumstances be upgraded.

Thankfully the field of software development has stagnated to the point that there really hasn't been any significant improvements to actual non-web software in about 15 years, so I'm looking forward to the brand new world with a stack of ancient machines, a bunch of boxes of capacitors, and a few hard drives' worth of abandonware, because frankly, fuck that noise THE AMISH WERE RIGHT.

not every politics-adjacent thread needs to devolve into "the wokes are coming for us all". You can disagree with the actions of progressives without making it this all-encompassing threat. Hell, I'm pretty left-wing and I'm fairly critical of some of the factions.

Either way, I can't see anybody putting "must add a BLM banner to their website" to the licensing conditions of their FOSS code.

That would be a wonderful thing to able be do, if the woke brigade wasn't screaming "YOU'RE WITH US OR YOU'RE AGAINST US" a parent over. ;) Ignoring that isn't an option, unfortunately, believe me, that's been tried.

Yeah but so what? Disagreements are going to happen in politics. Other people disliking your politics and vice-versa is not an existential threat.

Anybody who legitimately makes a "liberals only" stand in their license will get forked and their usage will drop off.

>yeah but so what

Being silent about shitty behavior is the same as condoning it, don't you know? Just because you don't like the playbook doesn't mean it doesn't work.

>Anybody who legitimately makes a "liberals only" stand in their license will get forked and their usage will drop off.

Considering that the developer just pulled a "no russians" stand with their software...

> Being silent about shitty behavior is the same as condoning it, don't you know? Just because you don't like the playbook doesn't mean it doesn't work.

my point is that it doesn't matter. Condemn or not, regardless you can still fork earlier versions. Materially, it's not a threat to you.

> Considering that the developer just pulled a "no russians" stand with their software...

Yeah and look at how much shit they're catching for it. People are forking and freezing earlier versions, he's getting raked through the coals, etc. Is this really the outcome conservatives are afraid of?

>materially it is not a threat to you

Kind of crappy whataboutism there don't you think? What if I'm a VPN user and my hard drive was wiped?

>Conservatives

What does this have to do with conservatives?

> Kind of crappy whataboutism there don't you think? What if I'm a VPN user and my hard drive was wiped?

Yeah it obviously sucks to be a victim of this behaviour, but the developer is being roundly condemned by everybody. I thought you were worried about this type of behaviour being encouraged by progressives?

> What does this have to do with conservatives?

Just a guess, it's usually conservatives that hand-wring this much about "woke" people.

Well, do you think doing what you said is a bad policy? It looks pretty sane and effective to me.

> Why do you have to be beholden 3rd party developers and the pace they work at?

You don't "have to", you only are beholden to them if you use their software.

Is those laws that you should airstrike California? If not, why are you downplaying the significance of what's happening in Ukraine? Context matters in how proportional a response can be.

What about Californians throwing Molotov at your house?

My point is analogy is not a valid tool of criticism when talking about policies, because their inputs and outcomes are not simple bool -> bool functions.

Would you be satisfied with 1000000 years on average as the answer?

I have long argued that there are things that should remain agnostic of politics ( as hard it may sometimes be ). This trend is genuinely destructive to opensource and I can't help but wonder if it is not done to undermine it by design.

“Politics” Is often what people call serous issues that don’t affect them. So, maybe you’d just like open-source to be the domain of privileged people.

I dislike this characterization ("privilege") as it is part of the new double-speak that is intended to stop the conversation, because, after all, how do you argue against that.

Yeah, I can do some things some people can't, but I can't do some people can. You can make a reasonable argument that everything is politics, but it is slippery slope, because tomorrow I might find myself with files deleted, because I did not read fine print with vegan inclinations of the developer and his stance on this subject.

It can bad really fast. It is already bad. Previously dumb pipes are being coerced to be 'smarter' and it is breaking the basic foundations of society. It is a privilege to live in a society. I think it would help if some naive activist did not undermine its foundations.

Or that someone in Texas would come after Californians.

"I'm not a biologist."

It's an answer good enough for the Supreme Court of the United States, but I'll bet it wont be good enough for Wokeware.

In a perfect world, everybody's hard drive gets reformatted.

I think this recent comment is relevant here:

>I don't want to hear anyone in this country [the US] complain about the Electoral College or gerrymandering the next time we decide to pull another Iraq War but they're opposed to it.

>Just like, overthrow the government - it's so easy!

>And if you don't have the guts - well, don't be mad when someone deletes all your files, you collaborator!

https://news.ycombinator.com/item?id=30727720

The problem is the logic goes both ways so there is no "just do <x>" because <x> differs per group.

It's your fault for not giving me the money. If you had done that sooner you'd still have your brain intact.

Congratulations, you're part of the problem. Enjoy creating a world in which open source cannot be relied upon for any purpose: https://www.gnu.org/philosophy/programs-must-not-limit-freed...

I'm sure your state/country has not a single unjust law on the books.

You are part of the problem