Open source ‘protestware’ harms Open Source
opensource.org
opensource.org
Recently, I saw a similar pattern with the Svelte REPL adding a pro-Ukraine message.[1] The banner along the bottom is so large that landscape mode becomes unusable, and non-trivial examples are hard to see even in portrait mode. Again, who does this help? (I support Ukraine, so feel like, "yeah, I get it; can I close the banner now?")
The worst part about these patterns is that they can't be disabled and seem to be deployed haphazardly without regard for the overall design.
While these aren't malware, they are still hostile for the majority of users who aren't so gung ho in their support for the current thing.
The purpose of the banner is not to convert anyone, the purpose is to demonstrate that the author of the package subscribes to the correct opinions.
I don't think recognizing that is conflicting at all with a positive outlook, or the choice to be optimistic, or a humanist, etc. You can choose to believe it or choose not to believe it, and still value human life and try to progress humanity forward.
Also don't underestimate the value/incentive of following your conscience, acting out your beliefs etc. Cognitive dissonance (which results from not doing so) is deeply uncomfortable and a good motivator for being "altruistic."
"This is virtue signaling" is more of a dog whistle ingratiating yourself with a certain crowd instead of an argument. Don't know what youre trying to achieve besides that.
Genius move. Any concept that can be used to criticize you is implicitly outing me as part of your out-group. Now you can judge me not on my own merits, but on the merits of people you associate me with. And my posts can well-formulated and thought-out, you disregard them for factors i cannot possibly control.
This is the partisan thinking that i don't want to have business with. This is what i ghost people for. Call it cancelling if you want to, fact is, if you are walking through the world looking for friends, my place is the wrong address.
Judge me by my own merits, not by some other random people you picked.
Edit: After showing this to her, my wife straight out told me that you are psychotic ("einen an der Dattel haben") and that I should not argue with random internet people. Thinking about it, she is right.
So either virtue signaling applies anytime someone expresses an opinion about something moral, in which case it’s a useless truism. Or it’s meant to express doubt or challenge someone to prove that they take action, in which case who owes you proof?
Putting a statement of support for a cause in your open source repo may or may not have any direct impact, but it is personal expression - and in general I am for personal expression.
I’m for signal, not noise. I don’t want stupid personal expressions, I want meaningful or beautiful or somehow useful.
I used to work with a person who would raise their hand in every presentation and say “security is important how is this software secure” even when it wasn’t anywhere remotely relevant. It was counterproductive and distracting and wasted valuable time that we could use to do something better.
I guess I feel that improving our world, ending war, making our society more just and fair, these are meaningful, useful, and beautiful things to do. They might be some of the most meaningful things actually.
> It was counterproductive and distracting and wasted valuable time that we could use to do something better.
This is an argument about context. Security IS important, I imagine we'd both agree, but maybe not in that specific situation. Like if I bring up climate change while we're rushing to the hospital after a car accident. Climate change is a real and important issue, but right now it's a distraction. So is an open source website an inappropriate context to indicate support for movements or disapproval of others? I don't think so, but if you do calling it "virtue signaling" isn't what you mean, and is actually a counterproductive distraction.
This is just false. Some signaling achieves nothing, but there's plenty of signaling that has caused individuals to change their behavior, politicians to pass laws, and corporations to change their products. The thing is it's basically impossible to tell which is the useful signaling and which is shouting into the void, even as the person signaling the signals. Which drop filled the bucket?
You seem to find it annoying because you think it's being done just to SEEM good, rather than to BE good... but when it comes to issues we don't have direct control of, there's not much difference. I can ACT on my belief that texting and driving is a terrible thing to do all I want, but it doesn't stop anyone else from doing it. The only small piece of influence I have over others is to signal that I believe it's wrong whenever it's appropriate. That and lobby for tougher fines (by signaling to politicians) and technological solutions (again, by signaling to corporations).
None of this is to say you can't criticize specific gestures as being empty - but to say signaling is always empty is just false.
I feel that way too. I want all those things. Adding “FreeUkraine” or “BLM” doesn’t do that. I don’t think virtue signaling is that big of a problem, but adding these phrases does nothing more than signal.
I don’t think it’s productive to call out virtual signaling in that I would never submit a PR to complain or remove. But I definitely notice it and it seems stupid. I don’t spend a lot of time thinking about it but a second or two while reading docs doesn’t make me think more highly of someone.
I think cynically it just seems like people say this instead of doing meaningful things.
They would be, if they actually made meaningful strides to accomplish those objectives beyond stroking the dev's ego.
I’m not saying that security reviews shouldn’t be performed. They should. Security should be part of design and code review. But it’s not a relevant question in every single situation.
However, I've gotten a lot of feedback from friends of mine that signalling my support for their cause or identity has made them feel more comfortable in the world.
That's both useful and beautiful.
That's the implication. But I'm pretty sure the critics would be even angrier if the open source project had taken action.
The virtue in this case being an implied rejection of groupthink.
You can always dismiss what they say by saying they don’t actually care, it’s just to look good.
It tells more about _your_ beliefs and what _you_ stand for than anything.
It seems a lot of HNers don’t stand for freedom too much. They stand for not being annoyed by the fallouts of this war.
Plus, demonstrating what opinions are held is not the whole point. Part of it is telling others who support those causes that they're not alone. And it's also partially a "fuck you" to those who are triggered by mentions of causes like Black Lives Matter.
If they had a banner saying "Trump 2024" or "The AZOV Battalion are Nazis" I might not agree with them, but at least they are taking some personal risk of cancellation.
So if it's empty, so is commenting on HN, I'd extrapolate. Otherwise, it's gotten the attention of the sort of people who comment on HN, and that's something.
1. These political threads always bring out the most ideologically strident folk
2. Developer time/experience is impacted by these changes.
While I personally think these banners are fine and good to raise awareness, I do agree that there's a moral grandstanding element as well. I'm often puzzled why it's so controversial a belief to have. I don't see why folks are so annoyed at these banners though because I've been annoyed for years and years at crappy ASCII/figlet drawings that libraries/apps output that are garbled in my terminal's width/encoding and yet people still add those.
But mostly I'm wondering why it matters if they're taking a personal risk or not. How is that relevant to anything?
I think this is an outgrowth of the "use whatever power you have to push for change" culture. It has been highly effective in the past, particularly with gay marriage, and I think those victories gave it enough gas to run for many years even without success. There's also the social points that one gets from it as well. I know of at least one project that added a BLM banner to their site because of social pressure, even though they felt that much of the protesting had gone too far (burning businesses, looting, blocking traffic, etc). The whole "not to take a side is to take a side" is a powerful social pressure to conform. I know of one other project that added a BLM banner so they could get on an "awesome list of BLM supporting software" or something like that which drove them a lot of traffic. Anyway my point is that there are lots of motivations for such, and I suspect many if not most aren't because the person has a deep and abiding passion for the cause (though without a doubt, some do).
Really, even that doesn't have much to do with open source, since companies exist that develop entirely open source products but offer paid support and enterprise contracts with warranties and guarantees. What this really damages is the reputation of ecosystems that rely upon foundational libraries made by hobbyists and one-man operations as weekend side projects.
Profession - "A professional is a member of a profession or any person who earns a living from a specified professional activity. "
If you want professional behavior, pay the person.
If you want free, you get whatever the person wants to give you for free.
No one is required to do any work for an open source project, but they are expected to behave in a professional manner and plenty of people have been rightly criticized here when they acted inappropriately as part of an open source team.
Its debatable whether OP is right, but there's at least a case to be made that taking down documentation that was not costing any money to host for the sole purpose of making an unrelated statement (not one targeted at their customers, just society in general) does damage the professional reputation of the team and its product.
If you don't care, then do whatever the hell you want of course.
Anyway, if we ignore for now the circularity of that definition of "professional" and take it at face value, then swapping out your open-source docs for a political message would fail the definition of professional, not just based on the "earn a living" part, but also on the "specified professional activity" part. Assuming we're using their repo because it's, like, for programming computers and shit, we might be surprised to find out they had changed their profession from computer-programmer and computer-program-explainer, to worked-up self-important opinion-haver. Which even fewer people would pay money for, by the way.
I don’t require them to be smart and professional, but they should be or will lose users. Thanks to OSS, I can just fork. But being OSS doesn’t mean you can suck and be random and still stay useful to people.
Of course if it’s your project, you’re free to do whatever you would like.
Counterpoint: much of our industry is often described as being in the business of disruptive technology.
It's been educational for me to watch how developers are reacting when they're on the receiving end of the disruption.
It’s like those people who do 50 commits instead of one to look busy. Just put that mental energy into real stuff.
Something tells me that they don't want to actually fix anything and are just virtue signalling on HN.
https://github.com/isomorphic-git/isomorphic-git.github.io/i...
Please, tell me what else I am "virtue signalling on HN" about.
Also, SQLAlchemy is badass, rockstar tech, but in a good way. Only DB abstraction layer I've used that doesn't feel like a leaky, kludgy mess.
It sounds like the underlying issue is insufficient testing of the UI layout with the new content, not the fact that there is new content.
Agree. I often have to click around to figure out why the black bar has shown up.
> less likely to stoke heated division amongst its users
This is interesting. Why does #BlackLivesMatter stoke heated division among HN users? And what does that say about the community that has been built here?
> and more relevant to the content of the site
I'm sure I don't agree. As the world moves further into automation, machine learning, machine analysis, and sousveillance, the interaction between technology and minorities in our communities is of vital importance to what we do. Questions of interaction between minority developers, customers, users, and community members and the majorities in those spaces impact on questions like hiring policy, behavior analysis and prediction (and the benefits and drawbacks of those tools), unequal treatment laid bare when the cameras are in the hands of the many and not the few (and the consequences of that knowledge), software that only works for a subset of users optimally because it was designed with only those users in mind, and other topics.
Software is growing to touch every part of human existence, and it's probably actually dangerous for hackers to traipse through life ignorant of that fact. We build things that impact people in a huge way, and if some groups are structurally invisible to the builders of those things, we really risk baking inequalities into the very engines of our society.
Simply because it is a political issue, on which people might have different opinions. And since that specific issue is not related to tech at all, it just causes conflict without any benefit.
While honoring the death of some generally respected figure in our field is hopefully less controversial and more informative.
Black Lives Matter is heavily interwoven with the sousveillance effect... As cameras have moved from a luxury to a ubiquity, control of the narrative of how policing works has fallen out of the hands of the people who do it. It doesn't matter why multiple black men and women were shot to death... People have seen it happen, and they feel in their guts it was wrong. It's hard to get to that gut-level effect without visual stimulus; people have been writing for decades about the negative effects of violent-response-authorized policing.
Now that we know this, how will things change? Will people try to make the cameras go away, will procedures change to account for everyone having a camera, will we all adapt to being seen more often in public? And at present people generally know when they're being filmed... What of the near future, where the tech to film something could be attached to a drone flying too high or too quietly to see?
It's very, very hard to slice a clean cut between technology and its effect on societies.
https://www.wtkr.com/news/technologys-role-in-the-black-live...
It would stoke heated division because different users see that slogan has having different connotations. What it says about the community is that it's actually a fairly diverse community, at least in terms of their beliefs (and very likely in other respects).
> ...Software is growing to touch every part of human existence, and it's probably actually dangerous for hackers to traipse through life ignorant of that fact...
HN does not need to hang up a #BLM banner in a cheap act of virtue signaling for us as hackers to grapple with the impact we have on society. Indeed, such an act would impede productive conversations.
It would be fine if the banner was close-able or displayed once a day or something along the lines of that. The problem isn't that they're showing support. It's doing it a completely obnoxious way that's the issue.
If you are one of the people doing this, look around you. Literally everyone slapped a BLM banner on their website, when everyone has done that yours literally adds nothing. Sure, put that message up there, but make it close-able. Not something that takes up valuable screen real-estate permanently.
People get killed and a HNer is annoyed by a gap around a banner.
The OSI is specially calling out an incident where someone actually put malware in their code which targeted Belarus and Russia. Totally unacceptable and not a form of protected protest at all, and arguably not speech.
It’s not a trendy thing, it won’t go away because of some random trendy thing.
HNers annoyance couldn’t be more irrelevant. And people are still getting killed because the world has decided that this war , as bad as it is, shouldn’t interfere with business too much.
People are still getting killed because we don’t want our precious little irrelevant easy lives to be disturbed too much.
The world still hasn’t waked up. We should be alarmed and fully supporting freedom. But the world is just annoyed. I thought moral values were important to open source.
Politics doesn't belong in software. Some software can be political, sure, but the only purpose of these banners is good PR and virtue signalling.
Our lives are going to change. Depending on how concerned and committed western people will be, we'll have to face a major energy crisis, or give up our democracies for cheap oil & gas. If trump is re elected, I see nothing good coming for the west. We are living crucial times, fascism is back in full force, our medias and politicians are being bought one by one with dirty russian money. And fascists don't feel the need to hide anymore.
But people fail to see why this war isn't yet another political, social or economical "issue". I looks like we're in for a very dark age...
It’s legitimate to ask what did all the Internet angst add to the solution? The answer it would seem is very little. I do hope it is different for Ukraine but I’m not holding my breath.
I see a lot of ambiguous statements these days, from too many people. People not wanting to "take sides", but in reality not yet willing to say they only stand for their personal interests, if not for a return to the law of the fittest.
What do you stand for?
"Hm, maybe if I put malware into a community-trusted module that destroys files of people in a certain geopolitical region, the countless innocent citizens that are affected will realize what they did wrong! Wait, who am I actually targeting again?"
Arguments like this are similar to the BLM protest that try to equate property with human lives.
Could be. But by whom? To what effect?
One of the downsides of losing credibility as a nation state is the concepts of deference, retaliation and proportionality lose weight. There is no indication that the facts on the ground would affect whether Putin deems something a cyber attack. Worse, one's own policing actions are likely to cause more damage as propaganda pieces than ignoring the issue.
Yes, in an international law framework this would be prosecuted in the U.S. But in that framework Russia wouldn't be in Ukraine. Add to that it's tacit approval of its own hackers, and it's difficult--in a realpolitik frame--to find support for doing anything about this other than minor finger wagging.
The general public. I speculate that publicity was one of the main objectives behind this operation to draw attention to his political grievances and maybe demands.
Perhaps we should focus more on the issue of bragging rights. The perpetrator probably thinks he's some kind of a hero having conducted this operation and it was some kind of a heroic feat sticking up to Putin when he in fact is more of a lousy vandal destroying some poor guy's store window than an epic warrior conquering foreign lands and subduing evil emperors.
The more people realize this and esp. people who are prone to commit these acts, the more innocent people would be spared the damage incurred by those reckless attacks.
Weaponizing open source is such an awful precedent. There are extremist groups of every shade who harbor ill intent towards some other group or institution. For a rather mundane example: "My malicious npm module detects you are running the Brave browser? The evil Brendan Eich runs that, say goodbye to your filesystem!" Never mind if you are part of a group that is mired in controversy, chief among them at this time being Russian.
And in this case the 'horrible act' is not wanting your free labour to be used in another country.
Yeah, but the problem with this is that, taken to its logical conclusion, you end up with a nihilistic view that's basically "do you support The Cause? if yes then any protest action is acceptable, if no then any minor transgression should be cracked down by law enforcement". This works especially well when The Cause is something that could plausibly affect tens of millions of people, so you can excuse quite a lot of damage.
I believe the crux of the political theory is that in a representative democracy, nobody has no influence over the issue.
If you burn down people's houses, you will be arrested and go to jail.
In case you haven't checked, both targeted countries are authoritarian regimes where any kind of civil protest is ignored at best or actively suppressed at worst. And violent regime changes (aka revolutions) coming from the people don't work, at least not without the support of part of the governing elites (which aren't impacted by that kind of actions)
If you left your car running while you ran into the store you don't have the right to shoot the guy in the back as he drives off. You file a police report and potentially sue for damages.
You definitely don't have the right to shoot someone for burning down your local Target.
A) IP geolocation is far from perfect, quite a few completely unrelated people could have been affected.
B) There was a chance of massive collateral damage to stuff like hospitals, water company, etc. and therefore affecting civilians, including children. If you think Putin wouldn't use that to rally Russia and launch a massive war, you haven't observed Putin for long.
We got very lucky this software equivalent of a warcrime was stopped early. Yet the punishment was absurdly light. I will staying away from NPM after that.
Do you believe that node-ipc would do this but the current vastly more impactful sanctions regime wont?
Also, everybody capable of thinking understands that Russia isn't capable of launching another "massive war" when it already has almost all of its conventional combat power committed to Ukraine.
If you think Putin would launch a nuclear war over wiper malware, you're an idiot. There's no other kind of "massive war" he could launch at this point.
> this software equivalent of a warcrime
Why not call it software holocaust if we're gonna go there? What's wrong with you?
>There's no other kind of "massive war" he could launch at this point.
Russian society isn't anywhere near enthusiastic. That's why Putin has been searching for ever dumber excuses. Give him an actual indefensible incident to rally society around, and he'll get a lot more manpower. That could expand the war to Odessa and Moldova, and also 'retaliatory' cyberwar in the West.
Now, there's a level of escalation I'm fine with risking - say, over stationing peacekeepers in parts of Ukraine. Stuff that actually helps Ukrainians. But over an self-appointed idiot's personal action which doesn't help anyone and nobody asked for? $#@! no.
>Why not call it software holocaust if we're gonna go there? What's wrong with you?
It's attacking civilians as to influence their government (except Russia is a dictatorship and the government doesn't even care). I have more pointed comparisons in mind, but I'll spare the thread.
Also, Russia is relatively self-sufficient foodwise. There'll be shortages but no starvation. I'm sure though that if starvation was serious possiblity the West would exclude food imports.
Ah yes, because seizing Russian assets overseas is the same as "not trading with them".
Your bank account is held under terms. There are cases where freezing withdrawals is allowed.
If you wish to avoid that, you are entitled to store your money under your mattress (or use the latest crypto fad and be subject to absurd exchange rate variations).
Nobody was forcing Russia's ruling class to have all their money in overseas bank accounts.
That's just absurd fanfic. Sending in untrained "manpower" with no equipment would not help advance Russian goals.
"Cyberwar"? Russia has never before needed any excuses to unleash wiper worms like NotPetya onto the whole world.
>It's attacking civilians as to influence their government
Exactly like sanctions. Are you against sanctions too? If not, how do you explain that inconsistency?
Some of them probably have military training, and quantity has a quality of its own. Regardless, Russia will not be able to subdue Ukraine, but there's nothing good coming from a more enthusiastic Russian society.
>"Cyberwar"? Russia has never before needed any excuses to unleash wiper worms like NotPetya onto the whole world.
Our tolerance for that was absurd. As is our tolerance for this action.
>Exactly like sanctions. Are you against sanctions too? If not, how do you explain that inconsistency?
I'm for sanctions. It's not inconsistent. There's a law for these things. That law allows sanctions but not attacking random civilians. It also prefers actions by legitimate authorities and not random vigilants. It also states that any possible harm to civilians must be incidental to the method, and that any harm be proportional to the possibility of achieving a legitimate goal (kicking Russia out).
This action was by a random person (not even an Ukrainian), unauthorized by anyone (definitely not any Ukrainian authority), and was at best counterproductive (nobody has given me any way where this advances kicking Russia out), so any possibility of civilian harm is criminal.
You are mistaken if you believe that Russian society isn't already enthusiastic. But this isn't a country with the warrior culture US has, dying for your country isn't cool in Russia, it just means that you were too poor and/or stupid to dodge the draft.
> There's a law for these things. That law allows sanctions but not attacking random civilians.
Which law is that?
> It also states that any possible harm to civilians must be incidental to the method
Many of the sanctions are specifically targeting civilians, civilian businesses.
> and that any harm be proportional to the possibility of achieving a legitimate goal (kicking Russia out).
Oh no, you're deeply mistaken. The sanctions will not go away even if Russia gets kicked out of Ukraine, they're very much intended to be punitive.
It's a society where showing up for what the authorities do is common.
>Which law is that?
A long codicil of war conventions (Geneva, Hague) and anti-terrorism conventions. What I wrote is a common exegesis.
>Many of the sanctions... The sanctions will not go away.
As I wrote, there's a difference between 'we won't trade with you' and actively harming someone. Also, if Russia withdraws completely and lets Ukraine join NATO, I'm pretty sure the West will drop sanctions. There'll be no point in maintaining them - if you want to change Russia, you'll need a finer instrument.
For a variety of reasons much of my circle of friend consists of Russians living abroad, you're mistaken if you believe that they support Russian leadership out of fear of what might happen if they didn't.
>A long codicil of war conventions (Geneva, Hague) and anti-terrorism conventions. What I wrote is a common exegesis.
But sanctions do exactly that. Attack random civilians.
> As I wrote, there's a difference between 'we won't trade with you' and actively harming someone.
It's not "we won't trade with you", that's a dishonest way of putting it. It's "we won't allow others to trade with you", which is very much actively harming someone.
"yeah but countless ukranian women and children are getting murdered by russians! surely a few wiped hard drives is worth it to raise awareness?"
/s of course, but people who hold this view sincerely isn't hard to find.
And people could go by bus, subway, ride share, so less oil and gas needed for transportation.
And energy intensive industries could close for a while. Is it really more important to continue producing more cars, for example, than to try to stop the war?
What if everyone wrote to their politicians (in one's respective country) and said that they'd happy wear extra clothes indoors
They're probably worried about stated preference vs revealed preference. People say that they stand with ukraine and they're willing to make tremendous sacrifices to help ukraine/hurt russia. That might be true, but they might not be willing to actually pay the cost (eg. higher gas prices).
Maybe in some cases, people won't know until afterwards, if they actually want more sanctions or not -- until after they've gotten to try it and discover how it was. Especially problems with transportation could cause anger, I suspect. Whilst extra clothes is maybe simpler.
Now I start thinking that more buses and bike lanes in a way can be seen as part of a military defense strategy, hmm. (If the population does mostly ok without oil)
German policy of the last decade in a nutshell. Green feel-good crap for the masses while building more pipelines to Russia, literally planned to enable gas delivery even in case of conflict in Eastern Europe.
That's the theory. Here is probably what would happen in practice: all the people that have disposable income will swallow the cost. All the people who can't swallow the cost will pour in their last savings for a few more hours of warmth. Those who can't will start rioting, especially when their children start coughing. It's hard to tell your child "put on a jacket, dad can't pay to keep you warm" when little Jimmy next door goes to a Safari next easter. There is only so much inequality you can accept before resorting to violence. I think it's better to ensure everyone can - at least - eat, sleep, keep warm and get some access to some entertainment.
> And people could go by bus, subway, ride share, so less oil and gas needed for transportation.
In practice, many people just can't do that. Either because those transport options do' not work or aren't ready yet. Think of Mr. Electrician who goes around the city in his van fixing peoples home. If he is forced to take the bus, he needs to reduce his client base to what's accessible by bus, he can do less client per day. Or he can pay for the gas and keep his activity. Or he can just let it go and ask for welfare, increasing the burden on social security for someone who is perfectly willing, able and qualified to work if not for high gas prices. Many low earning workers will have to make a choice between going to work, and going to unemployment. We have already started to see people making that choice with the current gas prices.
Of course, highly qualified profile who are already well paid will negotiate with their employers so that the companies swallow those added costs. Most companies will have no choice but to agree. So the people on the roads will be in the "already rich" category.
All in all, this would just increase the disparity between the upper and lower class. The upper class will swallow those cost by just saving a bit less, but generally keeping their lifestyle. The lower class will be hit the hardest, by having their spending power reduced and/or being moved to unemployment. One of these groups will benefit more of the economic recovery if/when prices goes down - you can guess which one.
> people who can't swallow the cost will pour in their last savings for a few more hours of warmth
Where I live, people aren't that short sighted. They bought all the toilet paper, planning months ahead.
> Those who can't will start rioting,
Eh, no. Not when they know the higher prices are for saving people in Ukraine.
But if they didn't know why, then, yes maybe.
> It's hard to tell your child "put on a jacket, dad can't pay to keep you warm" when little Jimmy next door goes to a Safari
It's easy. The parents tell the kids: "we're doing this, to save the lives of people in Ukraine, who are hiding in basements without food and water. This is how we build a society -- taking care of each other and others, as best we can."
If the politicians make it clear that it's for stopping the war, then, there'd be some social pressure for saving energy.
> > could go by bus, subway, ride share, so less oil and gas needed for transportation.
> In practice, many people just can't do that.
Seems I wasn't detailed enough.
There would be subsidies for people on the countryside, who needed their cars (no buses or subways nearby). And for farmers and public transport, and other for society important things, like, like you mentioned, electricians. And ambulances, plumbers, some others.
But most people aren't farmers or electricians.
> Many low earning workers will have to make a choice between going to work, and going to unemployment.
I wonder where you live. If it's in the US? In Europe, there are more buses and subways, and fewer people have cars.
> would just increase the disparity between the upper and lower class
Yes a bit. You could say that about the covid restrictions as well -- hit poor restaurant workers.
Seems like insignificant, a luxury problem, __compared to__ tens of thousands dying in the war.
1. While I acknowledge that people you talk about exist, I suspect that they're predominantly middle class, not the poor (ie. "people who can't swallow the cost"). If you don't have a baseline amount of wealth, then it's hard to have a car to go to costco to buy those 48 packs of toilet paper, and if your home is a shoebox 1bd apartment, you'll have a hard time finding place to store all the stuff you bought in advance.
2. there's only so much you can do "planning months ahead". You can hoard toilet paper but not gas.
>Eh, no. Not when they know the higher prices are for saving people in Ukraine.
>But if they didn't know why, then, yes maybe.
see my other comment on revealed preferences vs stated preferences https://news.ycombinator.com/item?id=30794396
>If the politicians make it clear that it's for stopping the war, then, there'd be some social pressure for saving energy.
Why's that not happening right now?
>I wonder where you live. If it's in the US? In Europe, there are more buses and subways, and fewer people have cars.
Doesn't that argument work in the opposite direction? ie. "there are more buses and subways, and fewer people have cars", so people are already taking public transit. From there, it's pretty hard to reduce fuel consumption even further as the people who are driving probably really need it?
>> They bought all the toilet paper
> 1. While I acknowledge that [...]
> 2. You can hoard toilet paper but not gas.
Yes that's true. Actually my comparison here wasn't totally serious. But you're right that the state and energy companies, and the citizens, would need to co-operate a bit for this to work. Or the state could raise the gas and oil prices, for a household that has used too much. And the state could calculate the prices, so heating would work out okay I believe. Combined with jeans and sometimes a jacket and winter cap, indoors.
>> [People wouldn't get angry when] they know the higher prices are for saving people in Ukraine
> see my other comment on revealed preferences vs stated preferences
Hmm. Two things: 1) revealed preferences, for example by saying one would care about the environment, but continuing buying environmentally destructive things. This is "passive aggressive", in that they aren't actively trying to sabotage anything -- they're just continuing life as usual, in the old more comfortable ways, not doing what they said they would.
Or 2) revealed preference, by actively protesting against the new policies -- demonstrations, even riots and smashing windows etc. But this is lots of effort. Personally, I'd be surprised if people were willing to spend time demonstrating, instead of just accepting the fact: gas and oil now cost more, so I'll put on another jumper. -- If they go outdoors to protest, they'll need to put on even more clothes! And travel somewhere. That's more work.
Meaning, raising the gas prices, and explaining why, could work pretty well I'm thinking. -- Even if people are dissatisfied, although they said they were ok with it, they are unlikely to protest or riot -- because that's more work, than just accepting the new situation?
>> If the politicians make it clear that it's for stopping the war, then, there'd be some social pressure for saving energy.
> Why's that not happening right now?
I don't think people see a relationship between their cars and indoor temperature, and how much bombs Putin has. Most humans are already poor at abstract thinking and seeing anything else than what's in front of their nose -- and this, with cars and bombs, is a slightly complex relationship? Plus, humans being a bit lazy and selfish, they wouldn't want to think in this direction at all?
I think the government and newspapers, would need to explain for and motivate the people.
>> In Europe, there are more buses and subways, and fewer people have cars.
> Doesn't that argument work in the opposite direction? ie. "there are more buses and subways, and fewer people have cars", so people are already taking public transit. From there, it's pretty hard to reduce fuel consumption even further as the people who are driving probably really need it?
I'd think it's simpler to reduce fuel consumption -- there're subway lines built already, and possible to increase the subway train frequency, without having to spend 20 years building new subway lines.
Most, or everyone, I know with a car, use it for convenience, to save time. Probably I'd done this me too, if I had kids to drive from and to school. And I would have been happy if the city where I live, introduced school buses, or built a ride sharing website, so I could let others go with me in my car and save fuel.
(I also replied to a sibling comment of yours, maybe you're interested: https://news.ycombinator.com/item?id=30803577 -- did you know that there's just 1.1 - 1.2 people on average, in a car on the way to work. But if people shared their cars, 50% or more fuel could be saved.)
Where you live, people chose to ensure that their comfort would be safeguarded, above all else, even if that lead to shortages for other people. "I don't care if I have too much and other people don't have enough, as long as I am confortable" was their motto. That has to tell you something.
> Not when they know the higher prices are for saving people in Ukraine.
Some might care, and some will accept that. Many won't. It's easy to accept some sort of disturbance when overall you don't need to worry about putting food on the table, or when a few less degrees means putting your thermostat on 21 instead of 23. When it means not being able to sleep because of cold, your view change quickly. And you start wondering why Ukraine just doesn't accept Putin offer, which after all does not sound that bad. Are people in Crimea that much worse ? And do you care so much ?
> It's easy.
No, it's not. Some will manage. Many won't.
> There would be subsidies for people on the countryside
So the solution is to subsidise people on the countryside, subsidise people needing vans or trucks, subsidise people working during nightshift, subsidise people living far away from a public transportation hub, subsidise people working far away from a transportation's hub, subsidise people who adapt to other people schedule, ... the list goes on. Creating a society where people depend on the state subsidies to just maintain their activity is not exactly sustainable.
> In Europe, there are more buses and subways, and fewer people have cars.
I live in Benelux. I can tell you that people are stopping to work because it does not financially make sense any more with current gas price. Today !. And Benelux is the poster child for a society built for bicycles, in practice it only works for 5~10% of the population. That number is increasing, but very slowly and we are going to hit a ceiling sooner rather than later. Anecdotal evidence, but in my social circle, almost everyone moved from "bicycle and public transport" to "cars only" in the past 5 years. Trigger points are : getting a child, changing jobs to something further away from their homes, promotion that gave access to a company car: when you are taxed > 50% taking the cash makes little sense. None are remotely considering letting go of their car, the value is simply too big to ignore. We are very far away from a carless world despite what politician want you to believe. And this is in a country that is usually considered to be a cycler dream
> Yes a bit. You could say that about the covid restrictions as well
You are acknowledging that what you are proposing puts the biggest amount of the weight on the poor. I don't find that acceptable: if we need to have measures, the more fragile part of the population should not be the one paying for it. The upper/lower class gap is a ticking time bomb. COVID has increased it. We need to find ways to close it, not extend it even more.
I wasn't completely serious with that comparison (that they bought all the toilet paper). But saving energy, turning down the heating, isn't that mentally advanced? And people do plan a bit ahead, otherwise people couldn't have survived in the cold parts of Europe (if they didn't plan for the winter).
> When it means not being able to sleep because of cold
Seems to me that the state and municipalities should be able to save some gas and oil, for the coldest days.
But I'd say it's not that cold. Where I live (in northern Europe), I frequently wear extra jumpers, instead of using the heaters at all -- works also with snow outdoors and the lake frozen to ice (did you try? Put on a jacket and a winter cap, if it doesn't seem to work, and double trousers and 3 x socks).
> So the solution is to subsidise people on the countryside, subsidise people needing vans or trucks [...] subsidise [...] subsidise [...] subsidise ... the list goes on [...]
Sounds like too much subsidies.
Instead, look at society's covid response: Public transport drivers, and health care workers, and teachers -- all of them got to continue working, in spite of the virus. Such job roles could be prioritized, now as well.
> Benelux is the poster child for a society built for bicycles, in practice it only works for 5~10% of the population
That's interesting. What about buses and subways? Where I live, few people go by bike. Instead, buses and subways.
Couldn't the state hire more bus drivers, in Benelux, so fewer people needed cars. And people could do ride sharing, so there wasn't just 1 person per car. There could be ride sharing websites, and the state could ask everyone to use them.
Look at this:
Occupancy rate (passengers per vehicle), Commuting to/from work: 1.1 - 1.2
https://www.eea.europa.eu/publications/ENVISSUENo12/page029....
But one can fit 5 people in a car. This indicates that by coordinating traveling to / from work, the gas needed for commuting, could be reduced (theoretically almost 80% but I suppose 50% would be more realistic).
> Trigger points are : getting a child, changing jobs to something further away [...]
Interesting.
> We are very far away from a carless world
Hmm, what you describe sounds like a careless world to me? I mean, people prioritizing their cars and gas, and being okay with others then more likely getting bombed, elsewhere. (Don't know if you meant to write something else)
> puts the biggest amount of the weight on the poor. I don't find that acceptable
Do you find it acceptable, though, to give money to Putin so he can continue bombing? That sounds like a greater evil to me.
It's about choosing the least bad thing, I think.
There's also rationing -- controlled distribution of gas and oil, so everyone got the same amount. Or, prices could be low, until one's household had consumed X amount of gas -- then, the prices would rise, sharply, for that household. A bit like progressive taxes, but for gas and oil.
FWIW people in Ukraine are already freezing to death, thanks to Russia's deliberate attacks on infrastructure.
They're almost all (except India) moving away from that. It's not something that can be done overnight. It's been in the news for almost a month now.
https://www.fastcompany.com/90731145/pfizer-is-donating-its-...
Where does this black and white caricature of an idea come from if not twitter? Acting like all the money in Russia is used to make bullets which are sent directly to the front.
Not to mention that there’s quite a few countries killing people today and nearly nobody’s boycotting them.
As for domestic prosecution, the record is mixed, but there was that high-profile case that got a presidential pardon.
Leave your job because tech companies have contracts with the government/"defense industry" and also pay taxes.
Don't buy anything from the grocery stores.
Cancel your flight if it's on an Airbus/Boeing.
Otherwise, it's all empty talk. To be clear, it absolutely is in my opinion.
They might also believe that invading Ukraine is uniquely bad because it is a developed western nation within mainland Europe, setting a terrible precedent. Or they might simply not have thought very much about the contradiction. And I note that you're lumping every western nation under the same category when some are much less objectionable than others; in how many developing nations has Finland engaged in extralegal murder?
That said, yes, the costs are lower to protesting the invasion of Ukraine than protesting everything the US government does overseas. So what? The costs are lower for me to buy Kroger brand soft drinks, too, that doesn't mean my opinions about the flavor is just empty talk.
But nobody (AFAIK) is contesting that the US killed more civilians in Iraq or in Syria (or second-order in Libya) than Russia has killed in Ukraine.
Your argument is that people perceive it as okay because the intentions were good? Our government could not forsee that these people would die, it was unexpected?
Or were they unintended consequences that were foreseen? I don't believe such a distinction is defensible, if you foresee the consequence and do it anyways, you intended such a consequence.
Even worse, I think the argument is that the intentions were good because it was our rulers who did it, not theirs. Our rulers are careful and thoughtful, while theirs are evil and cruel.
That's missing the point. Nobody with knowledge of the matter is contesting that, but plenty of people lack that knowledge. This means that they're not willfully ignoring the kind of contradiction that would make their opinions about Ukraine "empty talk".
> Your argument is that people perceive it as okay because the intentions were good?
No, my opinion is that many people don't realize how objectionably the US has behaved in the past (and currently), so it's not apropos to call them out on a contradiction that invalidates their outlook on Russia's invasion. Call them out on ignorance all you like, though.
It's not like there's a Netherlands invasion of Germany for us to all use as a neutral reference.
But Ukraine was different (and I hope it still will be), turning from the world of the strongman and toward Europe and modern freedoms. It was on the same trajectory that Poland went on 18 years ago: a massively better life for the average, ordinary person. Ukraine had troubles, but those were solvable because that is what they wanted.
All of that is now ground up along with so many children under the ruble in the streets because Putin had to establish a slightly larger state.
So when Ukraine was killed, not only was the civilians there massacered, so was the future of the entire country or at least pushed another generation into the future.
I hope neither of the perpretators ever make it the Hague, a few years in prison is nowhere near enough punishment.
> turning from the world of the strongman and toward Europe and modern freedoms
Towards Europe, certainly, but also towards nationalism - undoubtedly. It is not a "modern freedom" to ban minority languages from schools and government, restrict regional autonomy, etc.
Please, it's not a ban. The relevant law only applies to state-funded schools and makes sure that students who don't speak Ukrainian gradually learn it over the years and start using it in school:
_https://ukrainian-studies.ca/2020/08/01/ukraines-russian-lan...
If Ukraine hasn't been the target of Russian territorial expansionism, we could argue that this law is overreaching. However Russia had claimed the right to "defend Russian-speaking people" outside of Russia before invading Ukraine in 2014 (the law was passed in 2017). Under these conditions, passing such a law was practically a question of self-preservation.
Really? Reading your source it seems that it explicitly states "Ukrainian as the only means of instruction in schools after the primary division." Saying that this only applies to "state-funded schools" may be true, but you're papering over the fact that your own source indicates that fewer than 1% of students attend non-public schools.
From your own source:
> The Law determines three patterns for Ukrainian-language instruction in secondary schools of Ukraine. The first concerns indigenous peoples such as the Crimean Tatars, who have the right to be educated in their own language, with Ukrainian taught as a separate subject, at any school stage. The second pattern addresses Ukraine’s national minorities whose languages are official languages of the EU. The primary school division is available for them in their minority language (with Ukrainian as a separate subject), while higher divisions see a graduated expansion of Ukrainian-language instruction—from twenty percent in fifth year to forty percent in ninth year of middle (junior high) school and to sixty percent of all subjects during the three years of high school. The third pattern applies to “other minorities,” i.e., Russians and Russian-speaking Ukrainians who attend Russian-language secondary schools. For them, Ukrainian-language instruction should be at a minimum of eighty percent in both middle and high schools, with the opportunity to have Russian taught as a subject or elective. The Law also clearly states that these provisions apply to state-funded schools only and entitles all private schools to a free choice of their language of instruction; nevertheless, private schools must teach the Ukrainian language and ensure that their students acquire the fluency standard defined by the state.
Seems from reading this that Russian is specifically targeted and proscribed from being taught in schools. Keep in mind there are entire regions of Ukraine where Russian is the predominant language. And we wonder why people in Crimea wanted to leave after Euromaidan...
> Under these conditions, passing such a law was practically a question of self-preservation.
By eliminating Russian speaking people in Ukraine? Not a great justification.
This law was passed in 2017, 3 years after the Euromaidan, because Russia invaded Ukraine giving the mere existence of the Russian language in Ukraine as the reason for the invasion.
> And we wonder why people in Crimea wanted to leave after Euromaidan... > By eliminating Russian speaking people in Ukraine? Not a great justification.
I see. I made the mistake of assuming you were arguing in good faith. Won't happen again; have a nice day!
Russia also invaded Ukraine in 2014. The parliament voted to ban Russian language in schools immediately after 2014, it was only vetoed by the president at the time.
> I see. I made the mistake of assuming you were arguing in good faith. Won't happen again; have a nice day!
I am arguing in good faith - you claimed that the reason they stopped teaching Russian in schools was due to the Russian invasion, but there is ample evidence of attempts to do this prior to the Russian invasion.
Seems to me you cited the part where it is explicitly allowed to be taught in schools, both private and public, contradicting your claim that it is “proscribed from being taught in schools”.
Some numbers: https://en.wikipedia.org/wiki/2022_Ukrainian_refugee_crisis , note the dates.
On the other hand, accepting even less refugees in the previous crisis is something that was definitely (politically) possible at the time.
My only real point was that who the Good Guys and who the Bad Guys are in Ukraine are predetermined by the set of assumptions you start with. Everybody who was paying attention isn't that surprised by the invasion. It's not even a puzzle as to why Russia would do it. They spelled it out quite clearly, and have been saying it for years.
Which is why I find the media narrative annoying. It's an almost perfect example of gaslighting. The only response to Russia's complaints about NATO meddling in Ukraine being provocative is to make some kind of counter-offer to offset the provocation. To suggest that there wasn't any meddling, or that Russia just invaded out of the blue for no good reason other than sheer evilness, is either staggeringly wrong, or a deliberate lie.
Interestingly, at least I am making arguments. The media narrative of Putin simply being crazy is deeply unserious.
But if Russia is the bad actor here for invading a neighboring country that was attacking ethnic Russians in their territory and was flirting with joining a specific international coalition that was anti-Russian, what does that make the United States with all of our foreign adventurism?
The optimal thing would be to push the Russians out of Ukraine with military force, though that is also going to leave many dead. Just because they're soldiers doesn't mean they deserve death. But that's not an option anyway, because a NATO country joining the fight directly will cause World War 3. At best we end up with multiple countries from both sides joining the fight. At worst the nukes start flying.
The actions of the node-ipc maintainer's seem to provide evidence against this assertion.
And the primary victims will be Ukrainian. Even considering that Europe has its arms open to this particular class of refugee, the country that they left will be a smoking crater. I wish we'd stop pretending that we're arming the Ukrainians for the Ukrainians' sake; we're trying to extend the war as long as possible in order to economically destroy Russia. The end stage of that is Western and central Ukraine being reduced to dust.
Russia has committed something like 15% of its military so far IIRC. This is just a matter of time. Ukrainians are being pushed through jingoistic nationalist propaganda (which is enforced at the borders if men who are old enough to carry a weapon try to leave) to destroy their country, and letting extreme-right minorities of the population (who are basically Banderaite lost-cause Nazis) lead. Those groups are happy to burn their country so the disgusting muslim commies won't rule it, and to die in glorious battle against them.
The disgusting thing is Americans are parroting the Azov rhetoric, too. Fat slobs sitting on a couch watching MSNBC/FOX/CNN all day and yelling at the television are calling Ukrainians traitors for leaving, and demanding that they be armed and sent back in.
The optimal thing is not to push the Russians out of Ukraine with military force, it's for Ukraine to give up. The world has shown it's willing to take white refugees, so those that fear Russian persecution can escape. Plenty would have happily emigrated without the Russian invasion, but the doors to Europe and the US were shut to them before. NATO re-promises not to put their alliance whose animating premise is anti-Russian on the borders of Russia. Ukraine rebuilds and normalizes.
What have they lost anyway? They were dominated by the Russians (and hopelessly corrupt), then a Western-incited and funded coup used the extreme-right element to install a (hopelessly corrupt) puppet who left office with a 5% approval rating, so the public elected an actor who played a president on television (also fully owned by an oligarch), which is an act so desperate, it would seem insane if the US hadn't elected a guy who played a boss on television to be president, or Italy hadn't handed its politics to a comedian playing the wise fool, or Boris Johnson hadn't been. Russia and the US trashed Ukraine, and we're cheering them on while they finish the job.
Even better, maybe we can push Russia into using some tiny nuke that we can't justify destroying the entire world over. Because the fact is, if they nuke Ukraine, we're not going to do shit. They know it. Lets make them feel so victimized to the man that they do it to reclaim some face, and piss the average Russian civilian off so much that they feel like there's nothing left to lose but their pride.
Another API would be to determine if a specific domain subscribes to the service and how much they care about the appropriate topic (in terms of "points" which are partly correlated with how much they spend on the PCCaaS, but also with some human input). This would be useful to people looking to vote with their wallet. I bet there are plenty of artists who would love to make custom banners, kind of like Google's doodle of the day.
A third API would be to get notified when a customer downgrades or terminates their plan with the Protest Current Thing as a Service. Journalists could subscribe to this last API to get ideas for news stories. /s
Kremlin is going to Kremlin, aka lie and spread propaganda. Let's not pretend that protestware is making their job so much easier, it's a tiny drop in a tsunami of lies and disinformation that the Kremlin puts out daily.
"Hm, maybe if I put laws into the books that destroy the economy of a country and drives people in a certain geopolitical region into poverty, the countless innocent citizens that affected will realize what they did wrong! Wait, who am I actually targeting again?"
Oh wait.
Both the sanctions and wiper malware targeting Russia are good things.
Sure it was negligence with a bad outcome, but the intentions were good.
These are the tenants of anarcho-communism and FOSS - not sticking it to Russia and cheering on the dumping of weapons into a war zone...
“Actors in this geopolitical region are killing people and destroying infrastructure, and I am going to do everything in my power to disrupt them”
“If more people stood up like this, then either bad actors would have to abandon open-source and pay a dramatic penalty in cost and speed of IT, or they would have to pay open-source maintainers to ensure the . Either way is a win”
“People who don’t like this don’t share my values - they can prioritize the lives of Ukrainians and get on board, or they can maintain a project and provide an alternative, or they can get out of my way while I do something I think is very important”
It's a bit too indiscriminate to be a good protest, unless the thing you want to tear down IS the whole modern development process, which is based on the idea that most people are somewhat trustworthy and you can get the risk down to an acceptable level through the usual means.
It doesn't quite work if malware is not only a threat, but a semi-mainstream thing sometimes made by people you would think you could trust. The normal social process of trust breaks down if malware is included in the scope of normal things people sometimes do, as opposed to purely being something by the more criminal types.
I almost wonder if these people don't actively want to tear down tech itself, or not care, given how many coders dislike the fact that society is tech dependant.
Sure but the problems are in order of significance are:
Putin invading Ukraine
Trusting things from NPM
This author adding malware to his package
I'm disappointed by the chorus of "keep politics out of tech" that seems so prevalent on HN, though not surprised. In general I'm in the "don't be a dick or cause problems" camp but when things are this completely broken I think anything goes. Countries are made up of people, people en masse can effect change, but often times the vibe of that one poem holds true, doesn't effect me so I don't care. It's wrong to stay silent. Every bit counts, it's only death by a thousand cuts if you actually make all of the thousand cuts, if everyone who's social responsibility to make a cut thinks "this doesn't matter anyway and i don't wanna be a dick" well... look around you at everyone who's got theirs and doesn't care.
Why? If something doesn't help in any way, it shouldn't "go".
Putin's invasion of Urkaine doesn't justify doing other bad things, just because those bad things aren't quite as evil.
Something can be wrong without it beying literally invading another country. Putting malware in software is an example of that.
> but often times the vibe of that one poem holds true, doesn't effect me so I don't care.
The issue is not "not caring". The issue is weighting advantages and disadvantages and be responsible in one's actions.
Politics in tech should be rejected at least in all cases in which it doesn't lead to any advantage. The existence of worse things is irrelevant.
Yes it absolutely does. Killing is bad, killing invaders in defense of your country is justified. Collapsing Russia's economy is bad, but in light of Putin's actions it's justified. Putting malware in your packages is an extension of that concept.
It's unclear to me whether putting malware in your packages is effective, but it's certainly worth trying, and I absolutely can't condemn someone for that. If you wield power you are responsible for it's effects, and to some lesser extent you are responsible for the effects of your inaction.
What I don't agree with is the idea of structuring society to benefit antifragile people and encourage more to become such.
Indiscriminate sabotage is a type of chaos. I expect it to always benefit those who are already in the strongest positions, and harm those in the weakest positions.
If one is going to do hacktivism, I'm sure they can think of something better than just randomly attacking computers supposedly in one country but probably all over the world because of IP weirdness.
An attack on tech in general is somewhat of a political statement that you would like to side with the less tech dependent people, at the expense of the more technical side.
This could destroy records at a Children's hospital. It could affect peace protesters.
I'm not sure that anything that preferentially targets technical people while leaving those with analog-first lives unaffected is useful.
It's stirring up chaos, giving power to those who benefit from chaos.
Does that not include those who benefit from war?
Maybe I'm wrong and this is actually going to being about world peace.
But to me, it seems pretty random and poorly thought out.
I agree with this, it's not a move I personally would do, but yet I can't condemn it either. Lashing out like this when faced with the horrors of war makes sense to me.
> What I don't agree with is the idea of structuring society to benefit antifragile people and encourage more to become such.
I agree with the sentiment here, but on some level I feel that an increase in antifragility is necessary to combat the centralization of power. It strikes me as the only way to prevent bad actors in positions of power for ruining it for everyone else.
It wasn't that long ago that using open source software required a lot of politicking inside my clients, and we could easily go back there with enough spooked executives.
That said, I'm all for open source software monetization; include messages in the README, code, or logging that basically says something to the tune of "If you are using this for commercial purposes, please consider donating / sponsoring / hiring". I think Github and co can do a lot more as well to encourage big corporations to pay open source contributors.
Most people, certainly productive people, are employed by companies. Take an extremist position on who your product works for and you limit the developer pool. An agnostic competitor would be expected to replace you.
The GPL, LGPL, BSD, Apache licenses have not changed. A rogue actions by any supplier comes directly under bargaining powers of suppliers in your corporate strategy risk analysis. If it happens you deal with it and you've already thought about it or you have no business in making decisions in a large company. If any big company runs away scared from Free software, bye.
Google literally shot to glory when they went extra hard at using Free software when established big companies were scared. It's not a sufficient condition for their success but it was absolutely a necessary one. They don't get going if they have to pay for operating systems alone.
This is fair. Would note that one advantage to teams that do the outreach and accommodation can be support, financial and contributions. But that's speculative and not the right move for every team.
That's what this discussion is about. You want to monetize your Free software project? That's a very different discussion to this one, about which nobody writing Free software need care. Note also the "protestware" or whatever nonsense this is didn't hit anyone with a support contract from the developer, or am I wrong with that guess? So big co.s are using a metric ship load of code that they didn't pay a cent for and don't bother even reading once. Just hit the auto-update while paying and contributing nothing,, then claim this is the fault of Free software somehow? Yeah. Ok. Bye. The value proposition sucks for them, apparently so they'll pay someone a lot of money to solve that. Nobody else need care - unless you're sliding into that space to solve that problem for them.
> If you limit access to anyone it is, by definition, no longer open source
Licensing disagrees. Not everything opensource is permissive.
Exactly. Setting off a logic bomb targetted at whole countries is not “without causing more harm than necessary”. Add wilful destruction to a protest, especially if that destruction is such that is affects innocent bystanders, and you no longer have a protest, you have a riot.
If an OSS developer can drop a logic bomb on Russian interests, one could do it to anyone else they disagree with, and that might understandably make people uncomfortable.
Furthermore, the “attack” was indiscriminate, hitting out at a geographical area potentially damaging the data of many innocent bystanders not just those responsible for, taking part in, or supporting, the invasion. Or is it OK for a code bomb to affect civilian targets? I know physical protests often inconvenience bystanders, intentionally so, a lot of the point is to do so in order to draw attention to the matter being protested, but wilful destruction of property is usually considered bad form for such protests (arguably at that point you have a riot, not a protest) and that is essentially what node.ipc change did.
Putting commercial interests off OSS is a symptom of a deeper wrong here.
That's why you audit your dependencies and have tests right? Right?
* Many don't.
* Even for those that do something might slip through the cracks, particularly given how deep and wide some dependency trees go in the current JS ecosystem.
* Such attacks would still cause you problems once your audit spots one: you now have to hold back a version, perhaps back-porting security fixes, at least until you can migrate to another package or create your own (or, rather than creating fresh, decide to continue maintaining a fork of the affected one). And you may need a deeper audit, checking to see if anything else slipped by earlier that has left dangerous traces.
And the existence of dependency audits doesn't make damaging protest updates like this right any more than the existence of secure zips makes pick-pocketing those without them fine.
That's not a problem caused by this "attack". You should assume that any open source project you use is unmaintained unless you have a support contract and that it will never get any updates again. A lot of these packages have a bus factor of 1 with no backup plan.
And that's the problem I see with many of these political statements. There seems to be this politically driven assumption that the only users of OSS are greedy companies that won't pay to support it. So they make a political statement, take down their package or make it malicious. All this does is creates a minor headache for the big corps that have resources and fucks over the little guy.
Proprietary software provided by a single vendor is much easier for a government to lock down via actual sanctions. Hypothetically, they can outlaw your company doing business with that vendor.
On the other hand, Javascript developers have a whole different culture than the developer circles I like to frequent. In npm-land, the societal expectations of quality and solemnity (for lack of a better word) are lower, and this kind of behaviour is even celebrated if it favors the "right cause".
The last two cases we've seen (faker/colors, node-ipc) just took it one step further, but we've seen a lack of seriosness from both the npm organization and the community during the last... what? 6 years?. At this point, if you stay in the whole npm ecosystem, it's understood that you do so at your own risk.
Whether or not most engineers _do_ keep up on things like this, is a different question. But that's why there's a large range in salaries for similar positions across our industry.
Keeping up on actual code related concerns yeah. Internet drama, no.
Of course, the ideal solution is just to not use an ecosystem where pulling in code from all sorts of random people is common.
Adding an antivirus scanner to your Node project is not going to fix this. It certainly hasn't solved the malware issue in the last few decades for PCs.
Most Javascript developers I know are just writing code and that's what they're concerned with.
Vocal voices on twitter or etc != most Javascript developers.
I'd argue most vocal folks on forums or etc don't represent most developers of any given language.
I've never seen controversies like this in the .NET/Nuget ecosystem, the only controversies I've ever seen there are over libraries changing licenses to make the authors more money, and controversies over Microsoft exercising too much control over the ecosystem.
I think your meant criminals are more likely to be men.
Can you really make such generalizations considering there are millions of JS devs, some of them not working exclusively in this language?
Some .NET ecosystem projects have put political messages on their documentation over the past couple of years.
* npm - (1,916,619)
* Maven - (465,713)
* NuGet - (299,957)
npm has about 2.5 times the number of packages as Maven and NuGet combined; it's not surprising that it has more drama than other ecosystems.
Sure, but for some reason, this stuff seems to only happen in the JS community (at least to my knowledge and recollection, which admittedly may be faulty). Maybe it's the fault of the tooling or the language, but python is another popular language which has historically had quite a messy answer to dependency management, and I don't remember ever hearing about an open source python developer throwing a hissy fit and trying to wipe the hard drives of everyone who uses their software.
What stuff? Drama? That happens everywhere.
Malware? That stuff happens a lot of places, maybe npm makes it more accessible but that's just a technical hurdle ... doesn't mean it wouldn't happen elsewhere if folks could do it easily.
Maybe, as you say, it's a technological problem. However, if that's the case, it's an eminently solvable one, as evidenced by the fact that I've never in my life had to avoid bumping my Java dependencies because I'm worried my CI pipeline will be overrun with heart emojis, and the fact that the JS community has not solved it just points to a different kind of un-seriousness.
I would never get angry because of a package which doesn't work properly. I didn't pay for it and I treat it as essentially a social media post. It should be assumed broken until proven functional.
But there is no "right cause" for spreading actual malware.
Every protest every has been met with "but this protest is being done the wrong way, don't inconvenience me", but that's the point: protest has to disrupt things to make people take notice and make changes.
Would I do this? No. I don't think it's effective or right (it really isn't going to harm Putin, even indirectly, in any meaningful way), but I think it's silly to pretend people don't know what they are doing. The intent is to disrupt.
Not something I’d have done, but I understand the idea.
It draws attention and coverage to the issue. It forces people to listen. Protest has to be disruptive to the norm to achieve that, and there will always be people who don't like that. That's the point.
As I say, I don't think this one is effective or proportional given the lack of control someone in Russia has over the situation, but just saying "nothing should ever be damaged in protest" is, I think, naïve at best.
If Russia were a state with a reasonable guarantee of a fair legal process, I would argue a moral obligation to disruptive protest to end the war. If the UK (where I am) were to invade another country like this, I would hope for a general strike, and civil disobedience of all kinds, including vandalism. The fact that Russia has such a hard line against dissidence makes this obviously more morally difficult, although I greatly respect those that still choose to protest, I can't expect it of anyone.
People will disagree about how effective a thing is, and how justified it is. What the Russian state is doing is monstrous, and that increases the level of justified disruption to me. That doesn't mean this was justified—I feel it wasn't—but pretending that all "vandalism" is inherently never reasonable as protest is, in my view, wrong.
“Every protest ever has had people saying that the disruption to them is over the line”
So which crimes would not be acceptable in a protest? And if people will always complain about the line being crossed, does this mean there can be no line at all?
Highly illegal and immoral, destructive and violent, killed some five-digit number of press-ganged soldiers and civilians, met all of its political goals...
But I'm not really seeing the connection here or why it invalidates the Unabomber example.
The long and short of it is - just about any destructive, devious, and murderous form of protest is considered acceptable, as long as you can convince a large enough segment of society that it's end justifies the means.
It's circular logic, of course, but that's all there is to it. There are no involatile, unbreakable taboos when it comes to seeking political ends - you just have a harder time convincing some people that your cause is worthwhile, when you are using more extreme ones. And even if you win, you might still be condemned by history for your methods.
On the scale of extremes of methods, this thread's subject is notable, novel, interesting, but is more on the 'misdemeanour hooliganism' side of that spectrum.
Clearly that doesn't mean all protest methods are always justified, and I even said I think that this is over the line given this particular set of circumstances, but I reject the premise that it would always be over the line.
Neither is invading another country.
Someone didn't delete the files. You deleted them yourself by blindly trusting 3rd party software that you got for free with no guarantees of anything.
Indeed. Except, did I elect this president? No I did not (and elections in Russia are more of an illusion anyway). Can I do something to stop him? No I can't. What's the point of this act then? Putin and his allies don't use npm. This can't affect them by any stretch of imagination.
> Someone didn't delete the files. You deleted them yourself by blindly trusting 3rd party software that you got for free with no guarantees of anything.
Yes, of course, npm is at fault here for downloading untrusted code and running it with no sandboxing whatsoever on behalf of your OS user. This kind of stuff used to be called an RCE vulnerability and used to cause people to issue urgent security patches, but somehow, now it's considered a perfectly normal way of doing things. At the very least, there should be a permission request if this untrusted code tries to access anything outside of the project directory.
I believe that the developer who implemented that attack should face criminal charges. Our ability to trust our open source is a critical part of our economy. People who abuse that trust to directly harm others should know they will face criminal charges for their actions.
With that said, disruptive protest can be (and often is) illegal. I may think it's justified in some cases, but also if I do something illegal I expect to face legal punishment for it. Some people lay down their lives to protest: to some people committing a crime is a cost worth paying.
Again, my point isn't that I agree with the action, just that the idea that protest should disrupt no one is counter to the whole point of protest.
Actively trying to harm those computers is simply not OK and goes beyond "disruptive" protest into harmful.
To analogize, if your protest blocks traffic, it is disruptive. If you protest goes looking for property owned by Russian speakers to burn down...you have moved beyond disruptive protest an into being a harmful attack.
I do not think the latter is anywhere even close to justifiable.
I agree that the "any Russian person" aspect of this makes it unjustified, in my eyes, but harming property more generally?
Well, denying someone their property is certainly harm of a sort, and if I were asked if it was justified to seize or destroy an oligarch supporting Putin's property or yacht or whatever, then I'd say absolutely.
In a similar way, there was a case in the UK recently where a statue of a man who was both a philanthropist and a slave trader was thrown into a river. This was charged as a crime, but the accused were found not guilty (commonly believed to be jury nullification).
Was this right? Well, the guy had actively limited his philanthropy where anyone was anti-slavery, people had tried getting a plaque added to the statue to explain context, but this had been blocked. I think this was a reasonable act of protest, and clearly a jury of their peers agreed.
More directly, what if they found their software was being used in a Russian weapons factory that was being used to produce munitions killing Ukranian people? In my mind, that would significantly raise the justification to cause damage to that property.
Harm, especially when it comes to property rather than people, is tricky. I don't think it can always be ruled out when it comes to justifiable protest.
Those are targeted actions taken against specific individuals, not an indiscriminate attack.
Causing indescriminant harm to random people as an attempt to protest is not acceptable. Targeted harm has to be assessed on a case by case basis.
I don't think that means that targeting random people in protest is wrong universally. A common example might be blocking roads, which can harm random people disrupted from being able to go to work, for example. I think there are cases that can be justified.
I mean, right now the sanctions put in place to try and cripple Russia's ability to wage war are hurting random Russian people. That's essentially state-level protest. It sucks for the Russian people who don't support their government, but I think it's the lesser of two evils rather than funding and enabling a regime that is invading Ukraine.
It's a combination of factors, I think trying to draw hard lines universally is just the wrong way to think about it: protest should be proportional and justified, and each case has to be judged on its own merits as to whether it is, something people won't ever agree on universally.
I disagree. Users are responsible for the open source software they use. If they want to blindly execute software from the internet without auditing it first, that's their problem.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
For some people, a world that they relate to is coming to an end, and anything they could do, however insignificant, no matter what the side-effects or personal reputation cost, is worth doing. This isn't some brainy impact-analysis based action. "Something must be done".
The disruptions caused by these rogue packages will make it to newspapers and the media, and maybe, just maybe, parrying the news of war and destruction.
I don't support having this. But I can see how a single-contributor package author would feel emotionally compelled to "Do something, anything".
It is not OK to go out and find Russian Americans and go vandalize their property to make a point. If you do so, you should face criminal charges.
I similarly think that the node module maintainers who deliberately abused their trust to make an indiscriminant attack of people's digital property should face criminal charges and civil liability.
Package authors who did this are also going to be ostracised by the community. So they will most likely pay a price.
A recent case in the UK involved people vandalising (throwing into a river) a statue. It was charged as a crime but they were found not guilty by a jury (in what most believe was an act of jury nullification).
There are a lot of loud people who felt this was disproportionate, but when it came down to it, a randomly selected jury from the UK clearly felt it was justifiable.
If my government was doing something morally abhorrent, that justifies greater disruption in the name of trying to stop it. Given there is no obvious way to judge the objective moral value of things, let alone one consistent across people, there will never be a hard rule about what is correct.
If we say there can be no justification for disruptive protest, then we lose the ability of the people to fight back against a tyrannical government doing things against the will of the population.
That makes no sense. It sounds more like an excuse for acting out.
I guess that's the thinking?
> The intent is to disrupt.
Presumably the intent is to help Ukraine. People need to stop and think about how their disruptive "protest" is actually going to help their cause rather than blindly chase awareness.
This event added to the strong distrust I came to have on NPM these last months. The NPM ecosystem seems incredibly immature and unreliable and any Javascript project depending on NPM is now a potential future malware.
By the way, does anyone know an easy way to use Svelte without depending on NPM? Because if not I might reconsider my choice of using it in a side project despite me liking it.
In theory the same things could happen for PIP, Maven, Gradle, their Rust and Go counterpart and any such package manager. Any data on this?
Supply chain attacks, such as these, can definitely happen to any language. NPM seems to be a nice target simply because the volume of deps your avg 'simple' node project has (I mean, 'npm generate'ing a simple strapi-backed static site for us and there's ~300mb of node_modules...).
There's not really a cure. You can peg your deps to a version, but with that much code in there, you're never going to really know if that version is compromised.
If you can come up with a solution, there's money to be made..
Edit: The best we really have atm is just scanning for known vulns with stuff like xray/lifecycle/dependabot. Better than nothing, but for sure there are malicious packages out there yet to be discovered.
Rust employs version locking for it's builds, so you'll only be able to propagate malware with it if:
0. The developer's cargo definition auto-grabs the latest dependencies (trust me, very few do this)
1. The developer has deliberately updated the version of their dependency
2. The developer doesn't notice any significant changes when debugging/staging the new release
3. The package passed through testing without identifying any malware or malicious changes
In theory, it's possible to distribute malware with Rust's dependency system, but doing so would be pretty difficult. I'd say there's some pretty good roadblocks in place to prevent it from happening.
Only the resulting binary might contain malicious code, but the build and package management part is guaranteed safe.
In addition, go installs the oldest viable version that matches constraints - dependencies are thus not only locked, but also don’t automatically update to the newest available version during relocking unless explicitly requested by the user or another dependency.
It's very uncommon to specify the "latest" version in Java package managers. The capability is there, but everyone always specifies something exact. And there aren't nearly as many transitive dependencies. Many popular Java libraries don't have any dependencies at all. And, at least on Maven Central, you can't overwrite an already released version of a package, you can only add a new one.
in theory, but why is it always node.js/npm? I work on completely different things... is it a different community culture? is it the thousands of tiny low quality packages people include to do the most basic things?
I also checked esbuild which is written in go, but it still has a dependency on babel and webpack (via scripts/package.json fuse.js at least). https://github.com/evanw/esbuild/network/dependencies
Returning to .NET Core recently I'm very fond of the ecosystem in this regard - everything is open source - but so many things are provided by Microsoft you rarely have to venture out, even stuff that's not under their repo/umbrella has people paid by Microsoft working on it (eg. npgsql).
Are you aware, that Microsoft bought NPM (or at least tried to)?
It's got nothing to do with npm as a repository - I don't trust the community.
I don't think the difference is the message and how political it might be, but the way the message is delivered.
A message, or even refusing to run¹, is completely different to deleting or corrupting data.
[1] though unless that is very precisely targetted I'd still think it a step too far.
It is betraying that trust to make indescriminant attacks that harms. If peoole want to do more than just add a message, the author pointa out a number of types of software that people can cobtribute to that would have a more direct positive impact.
For example, how would I know if my mouse driver software happens to use a certain Node module, and one of its auto-updates just starts breaking things? Yes, it would be a stupid technical decision on the part of the mouse driver company (and that company would ultimately be responsible for the fallout) but how does that help the person actually affected, in the meantime? And did the protestware developer really not think that someone “downstream” like this could be affected by such decisions? Not everyone is sitting at a terminal seeing a message printed out.
Of course there are other reasons too, e.g. you completely destroy your credibility as a project (or even potential employee in the industry) by pulling stunts like this, and how could that be worth it in the long run?
fake internet points.
I’d personally think that working on Truth Social would permanently affect your credibility in the industry, yet they have some devs who probably feel proud to work there. So people have different priorities in their lives.
I think also that's it's better to focus on propaganda, like displaying a ascii-art of the old woman threatening a Russian soldier or whatever.
But at the end, maintainers have the right to do anything they see fit. And disruptive actions are in my view better than apathy and just ignoring the whole thing.
All of these companies shutting down in Russia, people pressuring others to take a stand or shut down their services, upset the population. On HN I remember the namecheap thing and the service that allows westerners to call random Russians and inform them. On paper these seem like solid moves, but I cant help but feel like its only harming the citizens, and potentially irresponsible in a place where someone faces consequences for speaking out. I dont think anyone is going to risk their lives and take notable action because they need to find another service for their website, or some random foreigner telling them their government is lying. Of course these issues are more complicated, and taking these actions isnt a bad thing necessarily, namecheap has offices in Ukraine so they are going to take it personally, but there have been many cases where the company does it out of nowhere. These actions are inconveniencing the population, and when taken to the extreme like with peacenotwar, potentially very harmful. And I dont know if its doing much else. Yet too many people are acting like inaction is unacceptable.
I understand, you feel powerless in situations like these, but that shouldn’t stand in the way of making smart decisions. The need to do something has been pressuring people to take actions without considering the actual consequences vs the intent.
Essentially, this someone was working at a homeless community shelter, and often found the bathroom completely destroyed. Paper everywhere, missing the toilet, intentional destruction and trying to make it as messy as possible. Every time they would clean it it would just get trashed once again
They had a theory that being trapped in that kind of situation gives them so little control that their brain wanted to take control over something however it can, which lead to the bathroom situations. They related this to “cancel culture”, needing to call out people for the littlest things, or the loss of direction in social justice, but I find it applies to a lot more than that.
My device is freaking out rn, cant pull up a link, but if you search for “the trashed bathroom thread” you should be able to find it.
Maybe got it?: https://twitter.com/tercicatrix/status/1376210092492791809?l...
It is a shame that the innocent have to suffer, but I'd rather impose sanctions and boycotts and see a smaller number of bombs rain down over Ukraine.
For this reason, I support every move to cut off anyone in Russia from any and all foreign products and services (perhaps with the exception of medical supplies and children's toys, but the principle stands).
In aggregate all these small actions are having a very real impact on Russia's ability to conduct the war.
I was referring to the more meaningless actions that don't effect the Russian government or military to any significant degree, to attempt to upset the people and encourage them to speak out.
IP-based geolocation is garbage but there aren't many Russian/Belarusian-attributed IPs in the US so the intersection of those with people using node-ipc was empty, and the US Government couldn't be pressured to investigate/enforce.
NodeJS' culture is very much "move fast and break things", and "all software is political". Look at the TSC drama. Leftpad.js.
This isn't an ecosystem that you want to build and maintain a product on.
“Of all tyrannies, a tyranny sincerely exercised for the good of its victims may be the most oppressive. It would be better to live under robber barons than under omnipotent moral busybodies. The robber baron's cruelty may sometimes sleep, his cupidity may at some point be satiated; but those who torment us for our own good will torment us without end for they do so with the approval of their own conscience. They may be more likely to go to Heaven yet at the same time likelier to make a Hell of earth. This very kindness stings with intolerable insult. To be "cured" against one's will and cured of states which we may not regard as disease is to be put on a level of those who have not yet reached the age of reason or those who never will; to be classed with infants, imbeciles, and domestic animals.” - C.S. Lewis
Thankfully the field of software development has stagnated to the point that there really hasn't been any significant improvements to actual non-web software in about 15 years, so I'm looking forward to the brand new world with a stack of ancient machines, a bunch of boxes of capacitors, and a few hard drives' worth of abandonware, because frankly, fuck that noise THE AMISH WERE RIGHT.
Either way, I can't see anybody putting "must add a BLM banner to their website" to the licensing conditions of their FOSS code.
Anybody who legitimately makes a "liberals only" stand in their license will get forked and their usage will drop off.
Being silent about shitty behavior is the same as condoning it, don't you know? Just because you don't like the playbook doesn't mean it doesn't work.
>Anybody who legitimately makes a "liberals only" stand in their license will get forked and their usage will drop off.
Considering that the developer just pulled a "no russians" stand with their software...
my point is that it doesn't matter. Condemn or not, regardless you can still fork earlier versions. Materially, it's not a threat to you.
> Considering that the developer just pulled a "no russians" stand with their software...
Yeah and look at how much shit they're catching for it. People are forking and freezing earlier versions, he's getting raked through the coals, etc. Is this really the outcome conservatives are afraid of?
Kind of crappy whataboutism there don't you think? What if I'm a VPN user and my hard drive was wiped?
>Conservatives
What does this have to do with conservatives?
Yeah it obviously sucks to be a victim of this behaviour, but the developer is being roundly condemned by everybody. I thought you were worried about this type of behaviour being encouraged by progressives?
> What does this have to do with conservatives?
Just a guess, it's usually conservatives that hand-wring this much about "woke" people.
But, in at least one case—the peacenotwar module in the node-ipc package—an update sabotages npm developers with code intended to wipe data stored in Russia and Belarus. In a March 16 blog post on the malicious code, Liran Tal at Snyk said, “This security incident involves destructive acts of corrupting files on disk by one maintainer and their attempts to hide and restate that deliberate sabotage in different forms.”
This has nothing to do with pace of development, or even the political views of the developers. It has to do with inserting what is essentially malware into open source packages that affect users based on geo-location.
> Why do you have to be beholden 3rd party developers and the pace they work at?
You don't "have to", you only are beholden to them if you use their software.
I saw this as a JS developer who scarily runs npm installs multiple times a day.
I mean a framework or library with a global audience shouldn't push american politics. Vue, React, Preact, Nodejs, Ember (had a whole page and made documentation unavailable for some time), Go lang, ExpressJS (still has the banner up), Typescript, a lot of python projects etc etc. The list can be made very long.
I try to avoid any framework and library that pushes political agendas onto their sites because that signals what type of people are in charge of them. They must think that their political views are so important it must infiltrate every aspect of life even if the thing has nothing to do with it. Unfortunately, there is such a large amount of them doing this it's practically impossible to avoid it.
The funny thing is, now when Russia has invaded Ukraine there is no banners on the same websites so it's obvious some lives matters more than others in their views..
Supporting one issue publicly does not mean you think it's more important than every issue you don't support publicly.
There is a big difference with war and people being systematically killed and a potential unjust legal system. War is obviously many times worse in every aspect and I think it's hilarious on what these people publicly support and what they don't.
It's hypocritical, unfair which makes it a big irony since that was what the BLM movement was all about (unfair treatment).
That was literally the whole thing of "inclusive language" right? It wasn't about what the words actually mean, just how people felt about them. If they felt the word was discriminatory, then it should be fixed.
If you're going to throw up banners on every JS site for one cause and not another, you're saying very loudly you don't care as much about the other. You, under the logic of "discriminatory language" even be engaging in discrimination.
It isn't limited to JS frameworks. I remember seeing banners on Kubernetes docs too.
pretty sure they made sense to quite a few people outside the US:
https://tribunemag.co.uk/2020/06/frances-black-lives-matter-...
https://www.americamagazine.org/politics-society/2020/06/22/...
The UK as an example had something like 6 people killed that year when protests arrived. Most of which wasn't black if I remember correctly. Do you really think it's comparable to the issues that exists in the US?
My critique is still valid tho, doesn't ukrainian lives matter? Why are there no banners for them?
I think you're showing your hand, I am arguing for treating everyone the same and that the people in charge of these sites appears to care more about American lives than Ukrainian ones.
If you're gonna have banners, then having them for ukraine is an obvious choice for me. OR.. maybe you could decide not to involve politics into tech with a global audience at all and skip all this bullshit.
It's the arrogant attitude that "if you aren't for me, then you're against me". That their views are so righteous, that the only people who could possibly object are bad actors.
I’ve never worked a place that would auto-magically roll out things like windows or chrome updates without having them vetted first. If you can’t trust those, then you certainly can’t trust some random NPM package, and if your organisation doesn’t have a strategy for how you handle something that unsafe then you really need to step up your professionalism.
I personally consider NPM packages to be sort or nice, in the very cynical way, that the community tends to beta test updates for you much faster than with any other dependency system.
The NodeJS community somehow tends to attract the worst kind of people.
Download all dependencies and freeze them, fork the dependencies and groom your fork or have dependantbot or depfu managing your dependencies for you and keep a delay between merging the PRs, have manual review, etc..
You shouldn't be pulling stuff from internet and pushing to production without take a look into that anyway...
The trite ways to say it (ie: "we live in a society" or "actions have consequences") don't really capture the full complexity of human interaction but do somewhat describe the notion that everything you do as an individual affects and is affected by everything everyone else does. Being "political" really means just believing that those effects are too significant to ignore.
Political action is shaping my environment to my desire. Via compromise or war perhaps. What is your definition of it that it applies to everything?
Yeah, I can do some things some people can't, but I can't do some people can. You can make a reasonable argument that everything is politics, but it is slippery slope, because tomorrow I might find myself with files deleted, because I did not read fine print with vegan inclinations of the developer and his stance on this subject.
It can bad really fast. It is already bad. Previously dumb pipes are being coerced to be 'smarter' and it is breaking the basic foundations of society. It is a privilege to live in a society. I think it would help if some naive activist did not undermine its foundations.
It is not "Protestware" that harms open source. It is politics and ideology harms open source.
And the rate things are going may be Open Source will not only be split between permissive and copyleft, but progressive and libreRight.
Edit: Now I remember Douglas Crockford's "The Software shall be used for Good, not Evil." license. I wonder if there are still any open source that uses it.
This is nothing new: this is a problem which has always existed.
No, at the rate things are going, OSS will not be as you describe.
To many people, the idea that a small business owner would have their store burned to the ground because someone else in their town (or on the other side of their country) did something bad, is a massive dick move. Yet, this happened numerous times during the summer of BLM in 2020 and it was widely defended with things like, "everything is political" and "not to take a side is to take a side" and "you're either with us or you're against us" and "mostly peaceful protests." There was even a famous "looting is reparations" in articles and at least one book called "In Defense of Looting."
The movement towards free and open source software was created in no small part do to activists with a very strong ideology. Open source would not exist to the same extent without the ideology espoused by the FSF. The problem is that abandoning a key tenant of the free software movement, neutrality towards different uses (part of freedom 0 of the free software definition), does far more harm than good and contravenes FLOSS ideology.
This is true, and an argument that keeps getting repeated, but isn't the same issue. The politics of open source software are about software. How it's made and how it's used.
The modern push is about injecting outside ideology into software (and everywhere else). Bringing geo, gender, and racial politics into software is a whole lot different than software politics in software.
They did have a strong ideology and they worked towards building the world they wished to see. Not by breaking existing things to virtue signal their support for "the current thing"
My point is analogy is not a valid tool of criticism when talking about policies, because their inputs and outcomes are not simple bool -> bool functions.
Would you be satisfied with 1000000 years on average as the answer?
What is it with some people wanting to "make the world a better place", but end up starting fires and making it worse. Is it just middle class western liberal arrogance manifesting through a software developer's actions?
I don't want to make the world a better place, I just want to keep it from burning.
A big site has production, testing, dev servers spun up by docker or whatever. So to fix this you just need to roll back the node package version and redeploy.
A person learning code/developing locally now just lost everything.
And if that trust is eroded, the whole system comes crumbling down.
Companies paying after the service is rendered, delivery services not having to be escorted by armed guards, being sure that a random worker won't poison the food on the production chain, etc
When I was leaving they were looking to run new projects on Linux (from the proprietary unixes we were running) so I'm not sure how that would work. I'm guessing that's where the linux vendors fees come in.
Frankly, given how normal it is to just blindly download unverified, unsandboxed code from random developers and execute it on our machines it's surprising this sort of incident isn't more common.
What we need are better tools and processes to detect and block malicious code in dependencies before it has a chance to execute. I wrote up a few suggestions for that several months ago and I think they're still applicable: https://news.ycombinator.com/item?id=29266992
Per-dependency sandboxing and permissions might mitigate things to a degree, just as it has on iOS etc with apps. But it would require a different software module architecture than we have today for common languages.
As the text makes clear, 'protestware' as a concept is fine, destroying random people's data is not.
> When deployed, this ‘protestware’ expresses the maintainer’s opposition to the Russian government’s invasion of Ukraine. Most protestware simply displays anti-war or pro-Ukrainian messages when run. This is a non-violent, creative form of protest that can be effective.
Sure, everybody's against the war, but what if the message was a more controversial anti-this or pro-that topic - do we really want to have these messages popup during installation and even after?
At issue here isn't open source as a concept, but rather an emergent ecosystem in that blindly trusts package uploaders not to be malevolent. It points to a need for improved testing coverage. Indeed, since open source is open, it is also amenable to static analysis of uploaded package revisions, something one cannot readily do with closed-source software.
I think this is a weirdly bad argument. All the sanctions against Russia harm pretty much all Russians because they're in Russia even if they're peacemakers. That's just the price of using sanctions. You can absolutely apply that to open source - block all Russian IPs and say "Sorry, but we endorse the sanctions that our government has put on Russia, and we're going to boycott your country for that reason" - just the same way that hundreds of western countries have pulled their businesses out of China.
Now they also make the argument that it's ineffective - that you're ruining your own codebase to try and make Russia suffer, but at the end of the day that's a judgement for the developer of the repo.
It's also naive to think posting "anti-propaganda" in commit logs is in any way an effective way of circumventing censorship, at best you're just hoping that your obscurity prevents you being censored, but that's basically just playing by the censors rules.
First of all, there aren't 100s of western countries...
This line of criticism could be blunted by targeting government IP blocks. Would that make it okay? (I don’t think so. But it’s less black and white.)
For anybody looking for an easy way to do this, https://infowarship.pages.dev/howto-en may be interesting.
Add a single script tag to your project website, and all visitors from Russian IPs see a popup providing real information about the war in Russian, and links to accurate Russian-language reporting & Telegram groups, from outside the Russian state propaganda bubble.
Not malicious or damaging, no problem for anybody in Russia visiting who doesn't support the war, but a quick & easy way to inform those who do, and to push back against Russia's internal propaganda & censorship.
If the node devs did the same thing, this whole story would have been a nonstarter. I don’t recall if you suggested for node devs to also do this.
Ironically, if the dev who made the hard drive wiping changes had said that it was a protest against the bad practices of the node ecosystem which allowed for their hard drive wiping code to work as intended, I think that the dev would be getting just as much ire cast their way, if not more. This way, they get to perform two protest actions at once.
I’m impressed. I don’t approve of his methods, but I do find the causes justifiable.
The problem with loading frontend libraries directly from third parties is that they can change that code at anytime and for arbitrary subsets of users.
I’m showing my ignorance here, but why does node do this? Is that just a consequence of how JavaScript works in the browser? Could node be designed or used differently so that it doesn’t have these failure modes?
The instructions above do encourage self-hosting the script though, for both avoiding-block & security reasons.
OSS is built on hard earned collective trust. Once this is gone, the golden age we are surfing on right now will be gone.
Do I think “protestware” is a bad idea? Sure. Am I going to tell them to take their fight for human rights elsewhere? Not a chance.
Why not? Is every action legitimate as long as it uses "human rights" as an excuse?
Something doesn't become more ethical just because it's described as an act of protest.
Agreed, but fighting back is often seen as ethical when unwarranted aggression is not.
In the case of this “protestware”, they’re both fighting back against unwarranted unjustifiable war AND doing no direct harm. They’re free to restrict who or where their software may run. They’re also free to include a boobytrap for anyone who doesn’t respect the license/restriction.
That malware was directed to anyone with a Russian IP. The license was an open source license.
If we consider malware to be simply a form of licensing, than all malware is allowed, in every place. If malware hits you, it means you shouldn't have been using the software.
Putting in code that is destructive like that, for any reason, is a good and fast way to scare management away from using your code. If you are going to insist on doing that stuff, just engage in hacking on the side lol.
How about not taking sides instead of acting like a kid believing one side is black and the other white with absolutely no gradient in the middle? Also, propaganda goes both sides, just like in absolutely every conflict in History. Stop being a tool of your own government.
If you can't do that, but still want to engage in the discussion on the topic, your standpoint is clear. You're not some holier person not taking a stand. You have taken one, you just don't dare to spell it out.
That's not the topic at hand. The topic is, you don't need to pollute every thing you work on out there with your preachy opinions on every single topic, especially when you are whole-fully ignorant about what's actually happening, the in-and-outs of the conflict, because you are in a state of constant propaganda, whether you are in Russia or in the West.
And this is not just about the conflict at hand, it's about this disgusting habit these days of bringing politics in all walks of life where it was not before.
People who claim there were no politics before, were just oblivious to others' struggle. Which is ok, but it still happened, you were just sheltered or privileged.
I can't remember when people cared about the bombs falling everyday in Yemen. How absurd is it for people to suddenly care and cry publicly about one country's conflict while another much bloodier one, not too far away, is being completely ignored. Is their blood less red? Are their children worth less? Systemic racism maybe, since these are not white people?
Mass media (including social media nowadays) is what shapes what people care and feel concerned about. It's not about people's values, this goes on to say a lot more about how easy people can be manipulated to project violence onto anything they had no clue about 5 minutes ago, as long as you repeat it all day long.
Are the authors of the change in question actually in Ukraine? And I'm pretty sure that technical minded people there could find better uses for their talents, rather than petty vandalism
* russia invaded ukraine
* vaccines work
* wear a mask
* black lives matter
* trans women are women
* abortion is a right
then you're a pro-russian, vaccine-denying, anti-mask, white supremacist, transphobic, misogynist?
Your cause is not more important than thousands of other causes, and my refusal to spend my time amplifying your viewpoint does not in any sense imply I agree with the opposing view.
The list of Bad Things is endless, and failing to address any one of them does not make you in favor of that Bad Thing. It just doesn't.
You're just trying to bully people into spending their time amplifying your particular protest, and bullying in itself is a Bad Thing.
Are you saying they were agreeing with the oppressor? It must take some serious mental gymnastics on your part to write such statement.
You might not like it, fair enough, but expressing one's opinion in commit messages is neither childish nor an instrumentalisation by any government.
It's childish because it's incredibly naive to think that commit messages are going to change anyone's mind. Instead they will look like someone preaching for no reason. Next, how about doing an online petition as well? /s
If you have the power to do something and you don't, that's taking a side. You either oppose something or you enable it. At least own that. If you're saying you're neutral, you either agree with the unpopular side and are scared to admit it, or you can't form an opinion because you're uninformed and thus uncivil, or you feel unaffected by what's happening and thus discompassionate. Either way, that's pretty much the definition of "acting like a kid".
By the way, everything is not propaganda: anti-propaganda can just be the truth.
Pushing political commit messages is not "power". If you like like everyone around you you are not a rebel, just a conformist.
And using indiscriminate IP-location malware to annoy people is the textbook definition of evil child behavior. I'm not sure what exactly you are trying to defend here.
> By the way, everything is not propaganda: anti-propaganda can just be the truth.
How do you know what the truth is when you have no foot on the ground?
I'm not debating whether it works or whether it's the right form of activism. I'm responding to your comment. Namely you saying that taking a side is childish.
> If you like like everyone around you you are not a rebel, just a conformist.
If your goal is to follow the herd, that's bad. If it's to go in the opposite direction, that's the same thing. I'd encourage a person like that to think about more than himself.
> How do you know what the truth is when you have no foot on the ground?
Are you disputing the recent Russia's invasion of Ukraine?
Not the GP. I don't specifically dispute that. But in a time when many fictional stories can be told through video, I think it's reasonable to be unsure and neutral on things that we don't have direct knowledge about. Put another way, I think being neutral and silent by default is a necessary defense against manipulation.
But what if the purpose of the manipulation is to suppress dissent, or at least encourage passive acceptance of the status quo, by convincing people remain to neutral and silent?
To whom? If everyone followed the rule you're proposing, the only people they could speak out to are people who share their firsthand experience or domain expertise. Communicating further would necessitate secondhand information or some form of media which can't be trusted, as it could possibly contain some manipulating element. Who could Ukrainians ask for help from? The Russians? Would everyone else be required to fly to Ukraine to try to verify the existence of the war firsthand before having an opinion?
There are more important things than being made a fool of sometimes. The risk of being manipulated exists no matter what you do, or don't do, and you can never have perfect knowledge of any situation, even if you're an eyewitness, because human perception itself is fallible, limited to a single perspective and prone to self-deception.
I can sympathize with the sense of confusion, but this is one of the principal purposes of information warfare. When successful it does one of following things:
1. disengages people who would otherwise be opposed;
2. sows doubt and division;
3. makes people believe the propaganda is true.
We often fixate on #3, but #1 and #2 are the principal goals of today's information warfare, because they're much easier to achieve. When the other side's population doesn't know what to think, you're in a great position. It's effectively demobilizing the enemy.
I think this is an interesting argument, and I think it translates to a real world example quite well. For example, if my older kid hits younger kid I have to either:
1. Punish the older kid, taking the "side" of the younger kid
2. Not punish the older kid, thus taking the "side" of the older kid
however I think there's more nuance here than just that, because either of the kids could be lying. I wasn't' there, I have no video footage or proof, so I can only investigate and interrogate, and at some point I have to make a decision. Often times it comes down to the question of which is worse? Punishing an innocent kid, or letting a crime go unpunished?
The answer to that is far from clear to me. As an authority and neutral arbiter, I have a duty to administer justice, and I don't think taking a view that punishing an innocence can be worse than not punishing a guilty (obviously individual circumstances really matter here).
I also have a full time job, and I can't arbitrate between my kids all day long. I have limited time/attention. Given that there are dozens of issues every day that come up, and I don't have enough bandwidth to handle them, some packets will by necessity have to drop.
How do you know which position on which issue is the "right" one to default too when you don't have enough information? Given your argument, you must default to one of them. What criteria do you use when you have limited info?
I say that Ukraine has the right to sovereignty and I condemn Russia's assault on that right and on its people. It goes against what I want from the society I live in. There is no nuance there.
We could talk about war crimes that are seemingly being committed in droves by the Russian side. We might find nuances there. But, there's no nuance about the crime of starting the invasion in the first place.
There is not 'I can explain it' or 'this is not what it seems' or 'they must have a reason' or 'just kidding' here. This is not normal behavior in humans.
There is not any gray area about the war crimes of the Russian army. Had been videotaped, narrated, proven and reported extensively. Each building is a proof. And now they are talking about using chemical weapons to speed up this genocide. Seriously, what Russians were expecting? A clap?
Not taking sides? We are animals brain-wired to develop a strong reaction of seek and destroy in this cases. In less civilized times the murderers would be hunted and mashed to grinded meat.
Not more excuses. Don't call us kids, silly, ignorant, inconvenient or Russophobes. We are furious. We want this to stop. Right now.
The monetary system is fracturing, now the open source system could be fracturing.
If I was Russia, I might start seeing the need to develop in-country versions of open source packages, as a matter of national security.
When those expectations break down, the open source software process becomes but one of many casualties.
Harsh reality is: It's user's responsibility to test for those. Noone is forcing you to use this piece of code which is given as-is without any guarantees. Noone is forcing you to update. It might be a dependency, but still it's not the problem of the code owner.
Or am I missing something?
Also I'm not sure which one is more unethical: Malware from a random developer or profiting over his/her "free code" * by not giving any care about open source or sustainability of it at all.
* (in the view of big corp)
The issue here is spreading actual malware. A developer doesn't owe anything to anyone.
But actually and actively harming others trough actual malware is unethical even if someone didn't promise they wouldn't do so.
If I give someone a piece of food that I expressly don't guarantee anything about, the worse one would assume is that it might be spoiled and I didn't check, or that the ingredients may be of very law quality. Not that I actually purposefully poisoned it.
Anyway, I understand the frustration of people who got broken tests, but just noting the different angle.
A paper from last year evaluating this on Github achieves a ~50% success rate[0].
Given Github already training ml models across all repositories for Copilot I would guess higher rates would be possible.
[0] https://arxiv.org/abs/2103.03846
Edit: add link
> Code in huge ransomware attack written to avoid computers that use Russian, says new report
Edit, a better reference than the NBC article: https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...
As platforms it is important to protect against this making artifacts immutable. As people we can only protect against it by auditing upgrades depending on risk.
I much preferred the old world, where I could pick pretty much any software package and it would be safe but that is not today’s world. It’s entirely possible that a colorizer scans my disk for ethereum keys.
In practice I rely on social validation but it is not a safe thing in general. Unhappy about the outcome but this tends to happen in time.
In the end, it’s true. If you bomb my house, I will strike back in whatever way I can. If the only thing I can do is burn you and your children, I will. If the only thing I can do is destroy your hard disk, I will. I am limited in retaliation not by morality but by ability.
And if I am like this, then I must assume that others are, too. And that I might get caught in the collateral blast zone.
Suppose US government did this to sabotage Russia, since it cannot directly act against Russia because it would trigger WWIII. Nobody would care about.
But this guy doing it, or you, or me? No. We are not allowed.
I would care even more about it. I absolutely don't want our government destroying trust in open source in such a fashion.
Time to start paying for closed source and/or curated/vetted OS libraries now?
I don't like how open source is being co-opted by people supporting _ANY_ political ideology or belief to cause harm to other people around the world. It's not _your_ code, so why are people openly advocating to modify it to cause harm to others?
It's a net negative all around, in my mind.
The rancor this protest has caused in certain tech circles has really shown that we believe we're somehow different or better than the rest of the world.
In the real world 1 specific region has violated the norms the rest of us have agreed to ... you don't get to indiscriminately kill innocents while taking their land and has accted appropriately by cutting them off.
In the tech world we are screaming about how the people in that region are getting inconvenienced by the free tools we provide because we are supposed to be above "politics"
It isn't about being above politics. It is about abusing and destroying trust.
If you want to add messaging to your project, that is not harmful to the ecosystem and will just cause some people to view you as unprofessional. If you try to actively destroy people's file, you have stepped up at over that line are attacking and harming people, not just "inconveniencing" them.
It's funny how every time there is an "open" project on the internet, from code to Wikipedia to whatever, there is always a group of people that forms to quantify, collate, tabulate, and regulate it into some imagined corporate structure.
Don't like the protest? Fork away!
Seriously though, adding malware to OSS code harms trust. I'm down with messages or comments in support of X cause though.
The developer of the software that made the protestware was rightfully banned by Github. I haven't heard if he ever regained access to his account.
I get the author, it is impossible to see what is actually going on and not want to eviscerate Russia but the way he did it was counter productive.
And people ask me why I refuse to use *.js.
But the battle for the narrative has already been lost when people consider this to be a problem with 'open source'. Rather, it's a problem with software that's being given away for reputation brownie points. Here, the author showed exceedingly poor judgment towards users of their software, and this should result in the loss of goodwill and respect towards the author and the forking of their works if the license allows.
Open Source didn't enable this behavior. The author's poor judgement and the author's lack of need to care for the users of one's software is what didn't dissuade this behavior. In this case, it was giveaway software causing harm. In other cases, it's commercial software pushing hamfisted changes users don't want, because the users aren't empowered enough to fight it. The reason commercial software would avoid this particular type of stunt is because it's poor business sense to harm one's direct customers.
So what of Open Source? Open Source allows anyone to review or modify the software that engages in this behavior. So the community can salvage the author's good contributions and better custodians can carry the software forward.
Open Source also allows anyone to discover these cases proactively. Of course, almost nobody does this, because we as an "industry" have gotten used to four troubling trends, and ridicule those who aren't on this "bleeding edge":
* thinking that software that costs $0 to obtain incurs no additional costs
* not auditing our dependencies
* being unconcerned about the sheer quantity of dependencies
* blindly updating dependencies
It's a sad but predictable development that the field of Open Source software has basically merged with the community of authors actively looking to give away software for $0 (for fame or to upsell advanced features). Basically, the Open Source movement was too successful (in its advocacy and in raising the demands of the customers of software), and it has largely subsumed and supplanted the formerly-separate fields of shareware and trialware software.
This development is what truly hurts Open Source: so much software but too little emphasis on (or even demand for) curation, massive imbalance of contributors to users, the decreasing influence programming-language-specific spaces, and increasing dominance of the "move-fast-and-break-things" culture.
The way forward is to achieve stronger curation, more focused maker spaces, tighter (as opposed to larger) communities, and an outreach effort to re-establish the philosophical distinctions between Open Source and freeware.
I guess it's easier for folks here to empathize with why a level of restraints over ownership for "the common good" when it's an open source library they imagine using.
I am also aware that with this knowledge I chose to not harm any other living entities. The "problem" is that people calling themselves "agents of governments" go around asking other people initiate violence on other people, using words such as "laws" and "orders", and these other people, believing that "the government" i a real entity, and that these "laws" somehow overwrite our natural sense of morality and free will decided to act and initiate violence.
In this current conflict, people who call themselves the government on both "sides" are instructing people to go initiate violence, and people thinking the authority is real do so, and go murder other people.
We, as people who are mostly "uninvolved", acting in the role of "citizens", are seeing this evil occur, and want it to stop. However, we are still supporting this idea that government is real, that "Russia" is doing something to "Ukraine", when there is no "Ukraine", or "Russia" or "United States", but simply people who act as if these entities exist. We give power to these egregores, or intersubjective entities, and by doing so believe we are somehow absolved from making our own moral decisions.
All of this stops when each and every one of us (or at least a big enough percentage) takes individual moral responsibility for our actions, and learns to be moral for its own sake.
A big part of this that a lot of people I've talked to seem to be missing is the role of "money", and how people with free will thinking that pieces of paper, or numbers on a computer have power or value. The only value that exists is us as conscious entities. Every aspect of reality, from this computer I am typing this response on, to buildings, art, and technology is the output of consciousness acting on matter on its own free will.
When we believe that having money in our possession gives us power and freedom, it gives us a false sense of security. If I have some sum of money, I believe I can use this money to influence reality by giving it to other conscious entities. For now this is somewhat true, because you, and other entities agree to do thing in exchange for these imaginary numbers. However, what is true is that each and every one of us acts on our own free will, and we use money because we are too afraid to admit we are dependent on each other. As we continue believing this, we allow other people who know how to manipulate the numbers in clever ways, such as those people controlling central banks, and printing money to exert large influence on the direction of the world. During the last two years, a very large number of money was printed, and used to reshape reality. The value of every dollar decreased, as suddenly the equation was out of balance, but again, those in control of the money supply use this new money, and we, believing it represents value change our behavior trying to capture the value, forgetting it is us who are the real value the whole time.
So my message to other people who want to hear it is: you are the value. There are no governments, companies or money. There is only us, and we are the value.
This could quickly devolve into a nasty slippery slope where people who simply disagree with a direction of an open source project try to strip it of its licenses or eject it from various package managers.
I don't understand your characterization of this issue as "trying to “tone police” open source projects". In this case it's quite likely breaking the law (ie. CFAA), and for good reason. It's one thing to start a website with racist content. It's another to actually damage people's property. Not even US, home of the most liberal free speech laws (at least when it comes to "hate speech") allows this.
2. That being said, forking a project due to maintainer disagreements is a time-honored open source thing to do.
3. The last point you made is already happening on both sides of the political aisle.
Conclusion: Maybe software being political isn't a great thing, but that's what everybody chose, and that's what everybody gets to live with. I am looking forward to the +NOPOLITICS licensing clauses.
E: Bring on the downvote brigade, I'm just happy knowing that in the end this too will inevitably burn itself out.
Trying to paint this as "tone policing" is completely ridiculous.