Marak's GitHub account suspended after he erased his faker project
twitter.com
twitter.com
Summary from what I can tell: Faker.js is a JavaScript tool for generating realistic test data. Marak is the developer of said tool. He hosts a public version of it on a personal, public GitHub account repository. For some reason he updated the README of this repo to include links to some conspiracy threads on Reddit. Microsoft, owner of GitHub, has suspended his GitHub account. No one seems to know why and whether or how it relates to this action. Various people have opinions and suggestions about this.
For more clarity here, he didn't just update the README. He deleted the repo and replaced it with one that only has the modified readme and no content, and pushed an empty package to npm as the latest version (npm has removed the latter).
You seem to be treating the "THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND" section of the MIT license as a blanket "well it says they can do whatever so it's fine", but not giving the "Administrators at npm reserve the right to delete content hosted on the npm Services that they deem unacceptable" term the same leeway.
Either we can expect some sort of implied good faith from both parties despite their legal terms and licenses disavowing such, or we can simply expect the exact text of the licenses. To have one set of expectations on Marak, and another on npm is unreasonable.
Would rather live in the universe where people just re-upload the original under a different maintainer or (gasp) actually pay the guy for all the work he's done over the years, than the world in which certain npm packages become "too big to fail" so we never get to see the actual dynamics of failure, that are supposed to happen, come into play.
> The freedom to distribute copies of your modified versions to others (freedom 3). By doing this you can give the whole community a chance to benefit from your changes. Access to the source code is a precondition for this.
One of the tests for the Debian Free Software Guidelines:
> "The Tentacles of Evil test". Imagine that the author is hired by a large evil corporation and, now in their thrall, attempts to do the worst to the users of the program: to make their lives miserable, to make them stop using the program, to expose them to legal liability, to make the program non-free, to discover their secrets, etc. The same can happen to a corporation bought out by a larger corporation bent on destroying free software in order to maintain its monopoly and extend its evil empire. To be free, the license cannot allow even the author to take away the required freedoms.
By these standards, if NPM could not do this (or could only do this by virtue of their TOS), then faker.js and colors.js would not qualify as free software.
Most free software definitions are focused on preserving the freedoms of the user first, other wishes of the author like "being paid" or "printing ascii American flags" are secondary
A more distributed network benefits everyone. So if this rubs you the wrong way, why not take the opportunity to consider defaulting to alternatives (even just a smaller player), or even self-hosting?
Marak develops this very useful tool and gives it away for free, receives praise but no money. After realising that there is no money in giving stuff for free with no further plan down the road, gets cranky as others are not giving Marak free services and don't accept applause as a payment method, says that someone needs to pay for it or take over the development. Declares that will no longer do free work for corporations[0] but corporations seems to be unimpressed that the free worker will no longer work.
Since no one seems to be interested to pay for work offered for free, Marak launches SaaS of the tool as fakercloud.com, which is a popular strategy and sometime can actually work.
Unfortunately, according to Marak[1], engineers from Retool copy the SaaS platform and launch it as a part of Retool. Marak realising what has happened offers the CEO of Retool to sell the fakercloud.com to them. The CEO ghosts Marak, maybe because doesn't want give evidence for a lawsuit or maybe doesn't see the point of purchasing a product that the internal engineers already build.
As a result, Marak gets angry and deletes everything and posts conspiracy theory memes and links everywhere. As this tool is a popular one and people depend on it, NPM suspends Marak's account and continues to provide lates working version that Marak gave them for free.
Honestly, I feel for Marak. What a talented engineer and romantic businessman.
[0] https://news.ycombinator.com/item?id=25032105
[1] https://web.archive.org/web/20211030075524/https://marak.com...
If you tried to "un-release" some OSS, not only would that not work, it would be abundantly clear to you that it wouldn't, and moreover that would be clear to you well before you even published the first version, so you wouldn't feel like you were tricked or didn't have the chance to think this through.
With the new world of GitHub and NPM and such and especially tools like Go that pull directly from GitHub, the role of the distributor is basically n more than the role of GeoCities: they provide hosting for you, but it's in your account. So you can take things out of GitHub and NPM just as easily as you can un-publish a web page. (In fact an analogy could be made here to blogs, where you can un-publish, vs. newsgroups/mailing lists, where you can't.) There could be mirrors, certainly, but there aren't necessarily mirrors, and the social norms on both ends are against them: you aren't explicitly asking people to mirror your code and distribute it independently from you, and other people may feel that it is rude/inappropriate to continue to distribute code that you've chosen to stop distributing.
There are certainly very strong advantages in scale of participation (and in the loss of a certain gatekeeping that could not scale) in this new world, but it does seem like it would be good to recapture this one feature of the old world.
Sort of. faker.js has an open collective [0] which receives some money each year. However, living off a single open source package - even one widely used like faker - is very difficult even in lower cost of living areas.
1. If I publish a library somewhere, I expect to have control over its future versions, even if I want to effectively break it. If you have not pinned its version in a lockfile or vendored it, it’s your problem if the new version breaks the API. If you have forked it, you can republish it license permitting, but my thing is my thing. If NPM and GitHub allow themselves to take that control away from me, that sounds like news.
2. My attitude to OSS is “help yourself, then help others”: find income (consult, make a business, join a business, etc.), then contribute when you’re comfortable. If you contribute to the extent that it causes you financial ruin, please don’t contribute.
On the other hand, the alleged copying of author’s SaaS is unequivocally bad if true. One could sue in response, but presumably it might be difficult depending on local laws, and especially if the thief is in another country.
That's the thing. When will people realize these obvious downsides when they decide to use these big, centralized platforms to distribute their software?
You are using someone else's computer and this has some actual consequences. If your thing being your thing is important to you, make it so?
I know the problem might be hard for NPM, but noting forces you to use GitHub.
Then NPM reverted the last version to unbreak things probably suspecting his account had been hacked. Fair enough.
Now what happens when the author declares it was him? Is it his right to push a broken version? Is it his right to delete the npm package entirely? I'm sure there are some npm terms of service around this, but it's an interesting scenario.
NPM's terms of service indicate they can refuse service for any reason, and the package's own license of GPL indicates that NPM legally can distribute it without the author's consent otherwise. Even if the package was not license as such, NPM's terms of use indicate you grant them an irrevocable license to distribute what you upload. Unlike some social media platforms, they don't reserve the right to sublicense it, but they do require you agree they aren't the ones liable if someone they distribute it to breaches the license.
Why would it break people's builds? I can only see this happening if they upgraded faker.js.
Besides, best practice says to check each package's repo before upgrading because of 1) malware, and 2) potentially breaking changes.
Also, many forks exist, and you can point to GitHub versions of a package.
apt install git parallel jq -y;
TOKEN=xxxxxxxxxxxxxxxxxxxxx; ORG=yyyyyyyyyyyyyy; page=1; while links=($(curl -H "Authorization: token ${TOKEN}" -s "https://api.github.com/orgs/${ORG}/repos?per_page=100&page=$..." | jq -rc '.[] | {ssh_url} | .ssh_url')); [[ "$links" ]] do GIT_TERMINAL_PROMPT=0 parallel git clone --depth=1 {} ::: "${links[@]}" ((++page)) done
your ssh public key should be added on github for it to work
Should github get involved in this like they did? If they thought his account got hacked, maybe yes. But he did it on purpose, so what happens now? Are they gonna reinstate the empty repo?
With all our code so dependent on external sources nowadays, this kind of situation could happen more and more.
Because if it’s only related to FakerJS then that’s really fucked up.
That sounds like malicious activity. That's normally against most terms of service
He didn't do anything wrong. You should have local mirrors of stuff you rely on.
Pulled, not pushed.
The account appears to be there, so either the suspension was temporary, or its visibility is not related to his access to it?
This is probably Github doing damage control / fixing up build pipelines for everyone while they figure out next steps.
What does any of this have everything to do with GitHub?
The usual conspiracy crowd however are trying to connect it to their old favourite, pizzagate, where they assume basically every left wing figure of note is involved in a satanic child sex cult operating out of a fake pizza shop in DC. They're also implying Aaron Schwartz was murdered to cover it up, rather than driven to suicide by overzealous prosecution of academic journal piracy.
When Marak deleted faker.js, he replaced everything with links to reddit conspiracy threads containing the same allegations.
They're also inactive for >1yr.
Important context for people who aren't going to read further.
It seems unlikely the early reddit admins would not know who maxwellhill is, whether they were Ghislaine or not.
That said, it seems to me maxwellhill (again, whoever they are) did absolutely not "promote pedophilia". The worst they've been able to find is some questions about age of consent laws.
I can absolutely see how people would be pulled deeply into conspiracy webs by this stuff.
That said, I wonder what the ToSs say on GitHub and NPM on basically taking over an account that pushes content they don’t personally agree with.
The right thing to do is for someone to properly fork the project and then they can spend the time and money providing a repo for the world to freeload on.
If someone can’t update references quickly, that’s a serious problem they need to fix with their own pipeline if they’re pointing to random third party libraries.
If the content wasn’t illegal the owner has every right to do what they want with it. They have no duty of care or warranty implied or otherwise on their own repo under that license. That’s the whole point! The whole point of pulling the rug out was an important protest on people freeloading on this person’s work.
To now freeload so badly that they effectively cancel the protest and takeover the account is certainly indicative of how ethically bankrupt the freeloaders truly are.
Judge for yourself: https://reddit.com/r/conspiracy/comments/r45a5n/here_is_the_...
I guess I should do my own research.
It handles about 60 types of data.
It was previously a source of controversy in the open source funding debate when Marak posted a fuck you, pay me where he refused to make any more updates until some of the corporate users started sponsoring the project, which Godaddy eventually did.
Data-mining 1980s/early 90s alt.sex and its subgroups would provide interesting insights. In the Wild West days of Usenet, internationally criminal explicit content was being passed along the university backbones. Epstein & Maxwell would have had excellent access to their respective university’s unfiltered Usenet feed. I think it would be relatively easy to identify communication networks in which they and their peers were involved.
YOUR ACCOUNT IS NOT YOUR ACCOUNT BUT SOME PROPERTY OF GITHUB (or Microsoft).
Since the cloud services (not only GitHub) are increasingly unreliable these days, maybe we should think more before choose to use them.