Open Source Developer Appears to Deliberately Corrupt Libraries on Github

[engine]

According to a report on Bleeping Computer, an Open Source Developer has deliberately corrupted NPM libraries "colors.js" and faker.js on Github causing many thousands of apps and projects to "print gibberish."

The reason behind this mischief on the developer's part appears to be retaliation—against mega-corporations and commercial consumers of open-source projects who extensively rely on cost-free and community-powered software but do not, according to the developer, give back to the community.

In November 2020, Marak had warned that he will no longer be supporting the big corporations with his "free work" and that commercial entities should consider either forking the projects or compensating the dev with a yearly "six figure" salary.

"Respectfully, I am no longer going to support Fortune 500s ( and other smaller sized companies ) with my free work. There isn't much else to say," the developer previously wrote.

"Take this as an opportunity to send me a six figure yearly contract or fork the project and have someone else work on it.

[bleepingcomputer.com...]

I'm thinking that this now clearly calls into question the validity of using Open Source in commercial projects. In any case, commercial project should pay for use of the software, imho.

[graeme_p]

I do not think what one developer does affects "open source" in general. There has been proprietary software with bad things in it too.

Avoiding open source entirely is impossible. Everyone relies on it. For example, here is a list of Open Source software shipped with Microsft products: [3rdpartysource.microsoft.com...]

How many people here could decide not to use Wordpress, MySQL, Linux, Perl, Postgres, Apache or Nginx etc. and use proprietary subsitutes?

This developer is an idiot. He deliberately licences stuff with a license that allows for unrestricted use in proprietary software and then throws a tantrum when people do what he told them they could do with it. The FreeBSD developers do the same, and very happy that Apple, Sony (for the Playastation OS), Netflix etc. use their OS.

If he could have licensed his software GPL or AGPL and offered a paid license for commercial use.

Its funny how NPM keeps having these sorts of problems. At the other end Linux repos never seem to.

Obligatory XKCD: [xkcd.com...]

[engine]

Yes, it wasn't a good more, I agree. However, my point is that it may make others think twice about using perfectly good Open Source Devs.

That XKCD is perfect, thanks. :)

[ronin]

He deliberately licences stuff with a license that allows for unrestricted use in proprietary software and then throws a tantrum when people do what he told them they could do with it. [...] he could have licensed his software GPL or AGPL and offered a paid license for commercial use.

This gives rise to an important conversation:

Yes, there are licences which allow a developer to distinguish between commercial and non-commercial users.

But are there other licences which enable a developer to distinguish between commercial users who make 5-figure annual profits and other commercial users who make 9-figure annual profits?

[phranque]

That XKCD is perfect

this is your friendly reminder that xkcd is incomplete without reading the tool tip...

(raise your hand if you have used ImageMagick)

[graeme_p]

Yes, there are licences which allow a developer to distinguish between commercial and non-commercial users.

Yes, but they are not open source - they do not meet the OSI definition.

But are there other licences which enable a developer to distinguish between commercial users who make 5-figure annual profits and other commercial users who make 9-figure annual profits?

You can prevent people from embedding the code in proprietary software by using the GPL or the AGPL licenses.

If the code is all your own (or the copyright is held by people who will agree to this). You can dual lciense it: license it for proprietary use for a fee, and add an exemption to the GPL allow small businesses to use it without a fee. You cannot prevent someone who forks it from making their fork GPL only though.

Most of the time if SMEs (other than software companies) develop software it is only for internal use so whether the opensource software is something like the BSD license or something like the GPL does not matter anyway. A lot of big companies develop software for internal use only too. At one time (I doubt this is stilll true) The biggest employer of software developers in Europe was Deutsche Bank - considerably more than were employed by the biggest software company in Europe, SAP.

[ronin]

You can prevent people from embedding the code in proprietary software by using the GPL or the AGPL licenses.

Sure. My question is: are there licences which allow SMEs to embed and use code in their proprietary software for free, while preventing Global Offshore Megacorps from doing the same?

If I understand correctly, any licence which allows smaller private companies to embed and use code for free will automatically grant the same permissions to private companies ten thousand times the size of those smaller companies.

As such, if there are only licenses which are universally permissive with regard to embedding code in proprietary software and other licenses which activate blanket bans, the licence landscape may lack sufficient nuance.

Thanks for this clarification (which I initially missed):

You can dual lciense it: license it for proprietary use for a fee, and add an exemption to the GPL allow small businesses to use it without a fee.

[graeme_p]

There are a lot of licenses, not many that are actually widely used.

It would confuse people if we had more licenses - a lot of people find it hard to grasp the principles of the GPL as it is and there are a lot of misconceptions from it (I found some in my daughter's IGCSE computer science text book!).

[ronin]

I must admit I do find licensing more confusing than I ought to - though to be fair I've never yet dedicated the time to properly study / get my head around the landscape.

I have a very good friend - a patent attorney - who has expounded on this sort of thing at great length while we've been climbing mountains in Scotland together and that's helped me understand things rather more clearly than I did before.

A wizard - similar to the sort of thing that Creative Commons offers - is (or would be) a very useful tool.

Or even just a process chart (on a PDF) through which one could trace a route with one's finger.

[ronin]

A wizard - similar to the sort of thing that Creative Commons offers - is (or would be) a very useful tool.

I did not anticipate this, but it turns out that the European Union / European Commission maintains a wizard to help software developers choose a relevant Open Source Licence:

[joinup.ec.europa.eu...]

If the EU has a wizard, I'm sure other organisations will have one.

[ronin]

Related to the link above, more information here:

[joinup.ec.europa.eu...]

[Brett_Tabke]

I have deep sympathy and empathy for the developer. However, 1) he developed that software under a GPL open source license. However 2) it was on his account that he controlled and generated code under - it was his to corrupt.

Github is totally in the wrong suspending his account. This part of the reason I will never upload so much as a byte of code to Github.

[graeme_p]

he developed that software under a GPL open source license

He used the MIT license. I am not sure about these circumstances where I imagine this is code that will often be used internally, but in many cases the GPL or AGPL would help with this problem as they prevent reuse in proprietary software.

I did not anticipate this, but it turns out that the European Union / European Commission maintains a wizard to help software developers choose a relevant Open Source Licence

I do not like it much. I favours the EUPL without mentioning significant disadvantages: [gnu.org...]

[Brett_Tabke]

> mit

that's even more permissive.

[graeme_p]

that's even more permissive.

Exactly. He is telling people he is happy for them to use his code any way they like, including proprietary forks.

If you do that, you should have the attitude of the FreeBSD developer who said that he thought it was cool that his kid's playstation was running an OS he helped develop.