bluefox

Not everyone has an email address associated with their account, or want one.

Anyway, since such requests are apparently ignored here, my password is "bluewave".

Have fun.

Indeed, it's common nowadays to label things (ideas, people, etc.) in order to frame them in a way that's convenient to the labeler and helps him advance his agenda. I think given the global situation, some people become more sensitive to this kind of tactic (which is often used), while others have shown just how susceptible they are to it.

The author of the software didn't attack anything. He just pushed some code into a place he had legitimate control of.

Some irresponsible (see what I did?) developers downloaded and executed this code without checking, and as a result their stuff broke.

So you're saying he also had to document his code? Maybe make a pull request.

Every developer is responsible for what goes into his project, including dependencies. When a developer wants to update a dependency, he is responsible for the appropriateness of the update. In order to get an idea, he should audit the changes. For personal code, such an audit may constitute of a quick skim to determine that nothing breaks. For production code, it may also include a security audit.

When a dependency that used to do X now does Y and therefore breaks your stuff, you are the one responsible for dealing with it. The author disclaimed any warranty and any fitness of purpose for his project, and whether his intentions make sense or not is of no consequence.

My point was that there is no such thing as "malicious code". Code is code, and it's your responsibility to determine whether it fits the context. That someone put it out there with an MIT license means the responsibility is yours.

P.S. Ata nishma bachur magniv, lama macharta et ha'autobus? OK, ro'e she'ata gar be-Sverige achshav (Scandinavia ze ha'chalom sheli) az mevin.

[flagged]

Yeah, I was a GitHub user in 2008. Though it obviously had a social aspect, it wasn't considered a "social network" type of site. Its ongoing transformation into one is a result of the acquisition by Microsoft.

I take it you've never read a virus magazine like, say, 40Hex or 29A?

What is "malicious code" anyway? Maybe Microsoft Windows is malicious. It does contain code to format your disk.

You are saying "scary", but I think "alarming" is more appropriate.

It's an alarm that should be buzzing through sleepy programmer skulls. It should alert them to the fact that it's no longer the small company that respected programmers, where you felt your account was yours, and your repositories were yours.

The rules have changed with that acquisition, and Microsoft exploited the good reputation of that small company and the inertia of its users. Step by step, the site became more "social", and started suffering from the usual issues. Step by step, we see the same bigco policies that treat users as worker ants. When an ant starts making up a mind of its own, queen ant sends some soldier ants to cannibalize it.

Now, I realize here on HN the tired old rants of Moxie are considered gold. But if you want to skip being treated like an ant, run your own server, maybe support upcoming federation protocols to kill this centralization and bring down the nest, or at least migrate to some place that respects its users in the meantime.

This sounds good, but what about discoverability?

There should probably be a way to merge project lists on various forges into a potentially huge index that can be browsed and searched, independently of each particular forge. Maybe it already exists?

1. thaumasiotes is __________.

2. everyone likes being __________, but...

3. ... not everyone likes criticism, even when it's __________.

4. therefore, often HN comments are downvoted despite being __________.