Hacker News Reader

Comment by aikah | Hacker News Reader

People are dealing with a lot of negativity in their life, they shouldn't have to deal with that entitled bull-crap online, especially when doing unpaid work. Should the maintainer have been more cautious? no, he should have straight out closed the project and just ask people to fork it or use something else. If you are not going to maintain something anymore, don't even bother worrying about passing the torch. That way nothing is your responsibility anymore. The people who complain, insult the maintainer in Github issues right now will be at the root of a shift of mindset from contributors that will end the "golden age of open source".

View on HN

I think this is the clearest, easiest, correct answer. If you no longer have the time and motivation to maintain a project, and are also not in a position to hand over control to someone you have good reason to trust, the easy, safe answer is to retire it, and have others fork.

Then in the original project you can say “the last version of this project is N.N; here are some possible candidate successor forks, which have not been vetted”.

This way no one who is merely keeping up with version numbers will accidentally step off of a reasonably good package on to a fraudulent package.

I 100% guarantee you that if he did that, he'd be getting a lot of static about how he should have handed the package over to some contributor.

“You can please some of the people all of the time, you can please all of the people some of the time, but you can’t please all of the people all of the time”

Which other similar situations are you thinking of?

left-pad

left-pad was a very different situation. The maintainer unpublished the module from npm. I forget the reason, but I want to say it was some sort of rage quit.

he had a package called kik, which npm dropped for the benefit of kik the company (though I don't know whether they requested they do so). In response the author unpublished everything from npm.

This is mitigated if enough notice can be given in advance.

>I think this is the clearest, easiest, correct answer. If you no longer have the time and motivation to maintain a project, and are also not in a position to hand over control to someone you have good reason to trust, the easy, safe answer is to retire it, and have others fork.

To prescribe some preventative advice based on this: it's probably not a good idea if your project gets popular to continue being a solo developer in open source. So plan ahead based on your popularity.

And your project isn't likely to explode in popularity over-night and be a dependency for 1000+ other projects, so you should be able to see this coming.

Of course, this is super-easy to prescribe in hindsight.

I'm being naive probably, but I have a hard time believing that this controversy would be so big had it been a case of an abandoned library. Users do whine a bit in the Github Issues for dead projects, but at least they can tell the project's dead and/or broken. In this case, the maintainer, who is a security professional, made the active decision to give ownership to an untrusted party. He shouldn't be held liable in any legal/financial sense, but why wouldn't users be alarmed/unhappy?

I agree that's what he should have done. Isn't that being more cautious?

> People are dealing with a lot of negativity in their life, they shouldn't have to deal with that entitled bull-crap online, especially when doing unpaid work.

They are practicing resume driven development. While this is unpaid, it's not completely altruistic.

Reply on news.ycombinator.com