Listen to this article instead

Introduction

The developer of the widely used faker.js and colors.js , Marak Squires, has been accused of intentionally crippling github repos containing the source code for the libraries. They receive millions of downloads each week^{1 2} to provide code support for a presumably large number of software projects; some of which in commercial use as seen in such software as the Amazon Development Kit³.

Users of these libraries most likely considered they were provided corrupt or compromised versions of the software when they updated, as has been highlighted in recent events^{4 5}.

When running the affected software post-update, users were greeted with an image⁶ similar to the following:

Back in November of 2020, the author was found posting comments indicating their dissatisfaction with the support of those who rely on their library for widespread commercial use:⁷

Respectfully, I am no longer going to support Fortune 500s ( and other smaller sized companies ) with my free work.

There isn’t much else to say.

Take this as an opportunity to send me a six figure yearly contract or fork the project and have someone else work on it.

Software supply chain has become a great concern as more and more software dependencies are being targeted to disrupt or cause harm. Events like this will surely change the way companies approach open source software libraries moving forward, as this sort of behavior was likely never anticipated as a potential risk to consider.

Licensing

A very common license used for open source software, including the libraries mentioned in this article, is the MIT⁸ open source license, which clearly states:

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation …

There’s nothing outright malignant being done by those companies who use the software. They are adhering clearly to the licenses attached to the projects which does not restrict its specific use, commercial or otherwise.

Parody license models have been created such as the DBAD⁹ license which starts out:

Do whatever you like with the original work, just don’t be a dick.

This beckons the question, if the software is open source, and free, when should one think to consider supporting it? The average completed software bundle likely includes a significant number of open source libraries.

How can you support open source?

Here are just a few of the open source programs that you can join and support:

• Apache Foundation
• Eclipse Foundation
• Cloud Native Computing Foundation (home of Kubernetes)
• GraphQL Foundation
• Let’s Encrypt
• Linux Foundation
• Open Source Initiative (OSI)
• OpenStack Foundation
• NodeJS Foundation

Updates

According to a tweet¹⁰ by the author:

NPM has reverted to a previous version of the faker.js package and Github has suspended my access to all public and private projects. I have 100s of projects. #AaronSwartz

This has created some controversy surrounding what open source software is and who actually controls the rights to it. As of now, it has been reported that a rollback to a previous version of colors.js has been performed to restore applications that have been built to depend on it.

White House reminds tech giants open source is a national security issue https://t.co/25Ngp0mZ8s

— Patrick C Miller (@PatrickCMiller) January 16, 2022

Conclusion

Open source software has grown to have a significant impact business. Large corporations such as Microsoft are seeing the merits it has on the future of programming and business growth¹¹. While some licensing associated with open source software does not require any sort of compensation for their use, many feel it’s only moral to contribute back to those authors who help make their product successful.

Additional Reading

https://fossa.com/blog/open-source-licenses-101-mit-license/

Sources

• ← Previous Post
• Next Post →