Hacker News Reader

Hacker News

Comment by mirekrusin | Hacker News Reader

Parent Full thread

mirekrusin

Bad faith?

View on HN

"this software comes with no warranties" ?

Adding this kind of disclaimer notice doesn't mean you can do whatever you want.

If you perform action in obviously bad faith, your account will be suspended – it's very simple.

Github's terms of service must have somewhere detailed description about it.

> Github's terms of service must have somewhere detailed description about it.

Please, point me to the part where bugs, intentional or not, are disallowed.

Taking over someone's account is not justified; for this, definitely, but I'd say it's never is. Block the account yes; take over, no.

https://docs.github.com/en/github/site-policy/github-terms-o...

>GitHub has the right to suspend or terminate your access to all or any part of the Website at any time, with or without cause, with or without notice, effective immediately. GitHub reserves the right to refuse service to anyone for any reason at any time.

github owns your account -- if the github company thinks they should terminate your account, they will.

terminate, yes. Ban, yes. Take over the account? No, not even by their own terms.

It appears that all they (github) did is rollback the npm revision so that it pointed at a version that didn't break semvar: https://www.npmjs.com/package/colors?activeTab=versions

note that they didn't do that to faker, since it had a major revision: https://www.npmjs.com/package/faker?activeTab=versions

I'm not very familiar with npm/js, but isn't this policy since left-pad?

Microsoft owns Github... and NPM.

the fact that this is literally a criminal act. he pushed code KNOWING it would crash every server that pulled it. Its NOT a bug, its malware.

Lol. No. It is not "criminal act".

You think pushing malware in a fake app update isn't criminal?

He pushed to his own repo. You can push any code to your own repo.

You are conflating bugs with malicious code. If somebody decides to deliberately create harm, intentions are very clear, there is no point in playing stupid to turn it around into a bug, it doesn't work in courts, it won't work here either. There should be no place for this kind of immature behaviour in github/npm communities. Account suspension and reversal of harmful actions feels like adequate steps taken to protect everybody.

His actions hurt the confidence in all of us - that are open source authors.

I would say that github is actually taking a stance that's reasonable of an "OSS author's union", if it existed - penalize one bad actor to recuperate the standing of all of us.

Reply on news.ycombinator.com