SoylentNews is people
SoylentNews
from the with-great-responsibility-comes-great-LOLability dept.
From Bleeping Computer
Users of popular open-source libraries 'colors' and 'faker' were left stunned after they saw their applications, using these libraries, printing gibberish data and breaking.
Some surmised if the NPM libraries had been compromised, but it turns out there's much more to the story.
The developer of these libraries intentionally introduced an infinite loop that bricked thousands of projects that depend on 'colors and 'faker'.
The colors library receives over 20 million weekly downloads on npm alone, and has almost 19,000 projects depending on it. Whereas, faker receives over 2.8 million weekly downloads on npm, and has over 2,500 dependents.
But the target of this action wasn't the end user - but the big corporations...
[...] The reason behind this mischief on the developer's part appears to be retaliation—against mega-corporations and commercial consumers of open-source projects who extensively rely on cost-free and community-powered software but do not, according to the developer, give back to the community.
In November 2020, Marak had warned that he will no longer be supporting the big corporations with his "free work" and that commercial entities should consider either forking the projects or compensating the dev with a yearly "six figure" salary.
"Respectfully, I am no longer going to support Fortune 500s ( and other smaller sized companies ) with my free work. There isn't much else to say," the developer previously wrote.
(Score: 0) by Anonymous Coward on Saturday January 15 2022, @08:45PM
If you're using closed source software you have the executable - you're not entitled to a lifetime of support at no charge, same as open source. You want support, or new features, then pay the closed source devs to make them. Because at some point open source devs will say "fuck it, I gotta eat."
It's not like the open source community is going to release new versions of software abandoned by developers - the FSF, for example, doesn't actually contribute to updating free abandonware such as emacs.
The various linux distros don't either - they're too busy twiddling with the desktop UI to bother. (Redhat/IBM will, to increase lock-in, which is why we have unnecessary shit like systemd, which most users neither need nor want).
log4j was a symptom of how fragile open source development is. And how inept and lacking in coding chops most devs are today, relying on libraries they neither understand nor can write themselves. Time was, a coder's value was in actually being able to code.