(Semi-Official) Status Update #317

DABH · 2022-01-11T00:52:33Z

Folks:

Since #285 has been spammed into oblivion, I thought I would post a new issue here instead for better visibility. As promised, here is the update I have from today:

I got npm support to remove the offending package versions from there, so users of (dependent libraries of) colors will no longer be affected by the compromised versions. The compromised versions are deleted from npm.
Control of the repositories is still an issue with GitHub and npm. I am working with both support teams to either transfer control of the repositories to someone who won't sabotage them, or to make the "colors" name on npm just point to my copy at @dabh/colors (my preferred solution).
https://github.com/DABH/colors.js continues to be a safe alternative and the "official" fork until such time as this incident is fully resolved.
Although I know I'm shouting into a void, let's please try to work together as a community to combat spam, trolling, etc. on the threads/issues/commits here. The only thing it accomplishes is burying relevant info for the developers who need it.

Thanks, and I'll post another update when I have one.

ethnh · 2022-01-11T05:08:59Z

2 -- Definitely don't try to transfer away the repo, it's his code in the end
Pointing NPM to a different repo would work fine enough, I wouldn't even consider transferring an option 👎

sashmit · 2022-01-11T07:22:43Z

@EthanHindmarsh I would not even consider it "his" code

@DABH seemed to actually change more of the code (in terms of lines of code) as well as other contributors. So technically they would own the copyright for the characters they changed:
https://github.com/Marak/colors.js/graphs/contributors

Thems the breaks with OSS that doesn't have a explicit CLA for copyright assignment.

bet0x · 2022-01-11T09:04:26Z

2 -- Definitely don't try to transfer away the repo, it's his code in the end Pointing NPM to a different repo would work fine enough, I wouldn't even consider transferring an option 👎

Totally agree. People fork projects so fast just to get some fame. It's his code. Period. Also, @DABH you didn't clone the repo, you just uploaded it as if it was yours. I don't like those moves.

r-bird · 2022-01-11T11:23:31Z

It's his code. Period.

I wonder if @torvalds would call the Linux source code "his code".

csvan · 2022-01-11T11:33:34Z

Can we please not send this thread to spam-hell as well. Keep discussions in the other one instead since that is basically the only thing it is used for right now.

funkyfuture · 2022-01-11T11:40:56Z

It's his code. Period.

I wonder if @torvalds would call the Linux source code "his code".

it isn't about the MIT-licensed code, but about a repository.

liquidautumn · 2022-01-11T12:54:06Z

2 -- Definitely don't try to transfer away the repo, it's his code in the end Pointing NPM to a different repo would work fine enough, I wouldn't even consider transferring an option -1

There are 44 contributors to this project, it is their code, not his.

DABH · 2022-01-11T16:06:20Z

Definitely aiming to just change the pointer on npm. I want to achieve the least disruptive solution possible.
Copyright is moot since this is all MIT licensed anyway.
I pushed a local copy I had of the uncompromised repo, rather than forking the repo which was at the time compromised. Also not my preference but such were the circumstances. Did not alter author info in package.json etc.
Once things are settled my goal is to set up community governance for this project (multiple maintainers, a GitHub org, something); have to try to prevent a situation like this from re-occurring. I have no interest in being a solo maintainer on this or other big projects.

Feedback from everyone will be sought and we can have ample flame wars as soon as NPM/GitHub tell us what resolution they find acceptable. Thanks.

ethnh · 2022-01-11T16:16:04Z

@sashmit My point still stands regardless of who we consider the "owner" of the code: It would be incredibly disrespectful to the original author & maintainer of the code to take the repo off his account w/o his permission -- pointing the NPM package to a different repo is a different issue entirely

nocturn9x · 2022-01-11T20:07:16Z

It's funny how people are arguing here about how to take ownership of this repository from its rightful owner. It may not be ONLY his code, but it's also his code and this should not be done without the consent of all copyright holders. Allowing this means corporations like Microsoft, which runs GitHub if you had been living under a rock recently, can just ban someone and transfer their repositor(y|ies) to another user deemed more worthy of being able to speak out. Don't support this bullshit, the idiots that automatically updated their dependencies in production are the ones to be blamed. Trying to rob someone of their own code is outright theft and you guys are disgusting individuals

nocturn9x · 2022-01-11T20:10:53Z

It's his code. Period.

I wonder if @torvalds would call the Linux source code "his code".

Not only his code. Copyright isn't a black or white matter: the code he wrote IS in fact his. The reason why the kernel couldn't switch from GPL2 to GPL3 is exactly because not all copyright holders could agree on changing the license, which means that even if your contributions aren't the majority they still belong to you.

sharpninja · 2022-01-11T20:16:23Z

It's funny how people are arguing here about how to take ownership of this repository from its rightful owner.

My thoughts exactly!

lannonbr · 2022-01-11T20:34:40Z

@DABH are you in talks with GitHub to at least possibly get write access to this repository, given there is a large amount of content that is not constructive & harmful is being spread through the issue & PR listings.

DABH · 2022-01-11T21:48:32Z

Yes

jdnewman85 · 2022-01-12T00:05:53Z

Sounds like github needs to overhaul their permission system to be more accurate. Remove the Delete Repo and rename buttons. Maybe install a poll system that asks the users whether the repo owner can merge a commit?

A ban of the MIT license might be in order. It erroneously states:
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.

Where the actions here seem to show that repo owners are required to not have any breaking changes. If anyone running on latest has issue, or I guess enough people?, then this seems to be a reason to take control of their account.

Now we know.

sharpninja · 2022-01-12T00:28:42Z

Sounds like github needs to overhaul their permission system to be more accurate. Remove the Delete Repo and rename buttons. Maybe install a poll system that asks the users whether the repo owner can merge a commit?

A ban of the MIT license might be in order. It erroneously states:
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.

Where the actions here seem to show that repo owners are required to not have any breaking changes. If anyone running on latest has issue, or I guess enough people?, then this seems to be a reason to take control of their account.

Now we know.

You, sir, are spot on. However, if the FOSS community really wants to destroy copyright they will inadvertently completely neuter all copy left licenses.

derrickmehaffy · 2022-01-12T02:08:35Z

Code and distribution of said code are two very different things. Yes the lead maintainer of an MIT licensed project is entitled to their code, but they are not entitled to it's distribution. NPM/GitHub/Microsoft are well within their rights to remove versions based on their AUP, specifically acceptable content: https://docs.npmjs.com/policies/open-source-terms#acceptable-content

Likewise NPM reserves full right to remove any package or version they believe to violate their AUP: https://docs.npmjs.com/policies/open-source-terms#your-content

That being said, the package name does legally belong to the account that created it unless it's transfered or is stale for a period of time.

If you aren't sure on this you can always just email GitHub's or NPM's legal teams.

r-bird · 2022-01-12T06:52:01Z

Allowing this means corporations like Microsoft, which runs GitHub if you had been living under a rock recently, can just ban someone and transfer their repositor(y|ies) to another user deemed more worthy of being able to speak out.

It has been allowed and still is by publishing the code under the MIT license. Feel free to read it.

Copyright isn't a black or white matter: the code he wrote IS in fact his.

Actually it is. Yes, the code he wrote is his, but he gave everyone to do what ever he wants to do with it (except remove the copyright notice and text of the original license). Even Microsoft and others. They may even take the code, reserve all rights (take responsibility), ship it with their product and make big money.

So if you want to have a stricter license, fork the repository, add some lines of code and apply a GPL license. I doubt anyone is going to use your fork, but you may publish it.

nocturn9x · 2022-01-12T06:54:08Z

That was not my point! I wasn't referring to licensing matters, but to how Microsoft can just shut someone down because they don't like their commits, which is incredibly scary to me

…

On Wed, Jan 12, 2022, 07:52 r-bird ***@***.***> wrote: Allowing this means corporations like Microsoft, which runs GitHub if you had been living under a rock recently, can just ban someone and transfer their repositor(y|ies) to another user deemed more worthy of being able to speak out. It has been allowed and still is by publishing the code under the MIT license. Feel free to read it <https://github.com/Marak/colors.js/blob/master/LICENSE>. Copyright isn't a black or white matter: the code he wrote IS in fact his. Actually it is. Yes, the code he wrote is his, but he gave everyone to do what ever he wants to do with it (except remove the copyright notice and text of the original license). Even Microsoft and others. They may even take the code, reserve all rights (take responsibility), ship it with their product and make big money. So if you want to have a stricter license, fork the repository, add some lines of code and apply a GPL license. I doubt anyone is going to use your fork, but you may publish it. — Reply to this email directly, view it on GitHub <#317 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AFS6TPKUU5AIWSSYT3BPA2DUVUQJ3ANCNFSM5LVAWA2Q> . You are receiving this because you commented.Message ID: <Marak/colors. ***@***.***>

ClaudiuCeia · 2022-01-12T07:03:51Z

Also, @DABH you didn't clone the repo, you just uploaded it as if it was yours. I don't like those moves.

I don't get it, are you complaining about the GitHub UI not showing it's a fork? There's functionality built around forks that would get in the way if it was still being marked as a fork. Regardless, your statement is misleading at best, anyone can go check the commit history, the history wasn't rewritten in any way.

Also, @DABH seems to have been the guy making sure things go smooth since about 2014 with this project, it's as much "his" as it is Marak's.

mannyluvstacos · 2022-01-13T02:10:40Z

@mannyluvstacos NPM has already removed the violating versions of colors.js, it is not currently vulnerable? Why are you spamming out PRs thinking

I apologize for the spamming of PRs 🙁
My intention was to switch folks over to using @dabh.colors as the alternative library.

Pardon for all the noise @EthanHindmarsh and folks on this thread.

jdnewman85 · 2022-01-13T20:54:21Z

First, I think DABH made it clear he's only seeking that NPM point to a different Git repository. NOT that Marek's Github account be given to someone else.

Second, even if Github decided to stop hosting Marek's most recent code, or to give control of that repository URL to someone else, it's their right and it has nothing to do with copyright of the code. Owning copyright of code doesn't include forcing anyone to distribute it or to preserve your user account, so let's not mix things up.

In short, it's exactly the same argument as saying that nobody is forced to use colors.js – nobody is forced to use Github. "I can break people's code with my repo, but Github can't break my repo" is contradictory.

I think you've mixed things up. None of what you're saying relates to what I've said. Maybe you're replying to others? 🤷

davux · 2022-01-13T21:44:15Z

I think you've mixed things up. None of what you're saying relates to what I've said. Maybe you're replying to others? 🤷

Maybe, I don't know... Honestly if you have a special status in this thread I haven't noticed, and in general I haven't kept track of each person's opinion. I was just responding to a few messages that link Marek's Github account with intellectual property, and pointing out that the two things are unrelated. But I'm sure you do deserve attention and I hope you get it.

Marak · 2022-01-15T17:23:03Z

I'll have you know I've already contacted my secret network of 64th Level Dwarf Paladins at the Electronic Freedom Foundation. As you read this they are in the midst of drafting a Pull Request the likes of which the world has never seen before. This pull request will be written entirely in the Holy C Programming Language. This pull request will contain over 144,000 custom Node.js modules, each one greater than the next. The sheer act of witnessing the magnificence of this Pull Request will cause all tests on all Continuous Integration servers to fail. Travis CI himself will be banished to the land of SourceForgia for 1,000 years.

TechStudent10 · 2022-01-15T17:24:38Z

I'm sorry, what? You just notified everyone for something very confusing.

Marak · 2022-01-15T18:24:31Z

To ensure that this Pull Request will be merged: I have compiled Temple OS in a VMWare virtual machine over 9000 times. I have read the Holy C documentation 33 times. I have personally built a shrine to Terry A. Davis consisting of Gold, Silver, and 1980s M.U.S.C.L.E Men collectable figurines.

Marak · 2022-01-15T18:25:04Z

9/11, never forget
I am the one who commits
I am the one who forks
I AM THE ONE WHO OPENED THE SOURCE

Marak · 2022-01-15T18:27:59Z

To the righteous members of the 69th Division of Social Media Medics:

I thank you for your thoughts and prayers.

I can assure you that I am of sound body and mind. I have attached a certificate from the Reid Mental Institution, which proves beyond a shadow of a doubt, that I Marak Squires, do not have Donkey Brains.

Can the members of the 69th Division of Social Media Medics provide a document which proves they do not have Donkey Brains?

I've taken out my Rolodex and contacted Surgeon General Captain Crunch. As you read this we are going through your Google Search history dating back to when all four of your Great-Grandfathers were born.

I can assure you that we will find out once and for all who is and isn't Donkey Brained.

cc @doctormantistoboggan

hello-smile6 · 2022-01-15T19:50:13Z

It's his code. Period.

I wonder if @torvalds would call the Linux source code "his code".

They're one of the top contributors, so they'd have some justification for such claims. @torvalds What would you say?

TechStudent10 · 2022-01-15T20:18:16Z

It's his code. Period.

I wonder if @torvalds would call the Linux source code "his code".

They're one of the top contributors, so they'd have some justification for such claims. @torvalds What would you say?

Pinging him won't do anything.

TechStudent10 · 2022-01-15T20:18:29Z

He probably has notifications off.

hello-smile6 · 2022-01-15T20:19:09Z

He probably has notifications off.

Well, they're awake right now. They live in Oregon.

TechStudent10 · 2022-01-15T20:54:10Z

He probably has notifications off.

Well, they're awake right now. They live in Oregon.

So? He probably gets tens or maybe hundreds of notifications each day.

hello-smile6 · 2022-01-15T20:54:27Z

He probably has notifications off.

Well, they're awake right now. They live in Oregon.

So? He probably gets tens or maybe hundreds of notifications each day.

Good point.

prietales · 2022-01-16T11:53:50Z

He probably has notifications off.

Well, they're awake right now. They live in Oregon.

So? He probably gets tens or maybe hundreds of notifications each day.

It doesn't matter, he doesn't understand you. @torvalds only speaks in ANSI C.

dustinlw1987 · 2022-01-17T05:12:50Z

The community has spoken. The community now controls faker.js: https://fakerjs.dev/update.html

@Marak fucked up, plain and simple, and now nobody will trust him -- rightly so.

nocturn9x · 2022-01-18T22:24:11Z

The community has spoken. The community now controls faker.js: https://fakerjs.dev/update.html

@Marak fucked up, plain and simple, and now nobody will trust him -- rightly so.

You kind of misunderstood the point of his actions I think, but I feel like you're right (sadly)

G2G2G2G · 2022-01-19T05:35:04Z

@hello-smile6 @TechStudent11 you dimwits realize torvalds doesn't use github because it's an abomination of his git, right? The linux here is a mirror.

@Marak good posts bro, don't worry about these soys, they'll all go to therapy and recover after a few years.

TechStudent10 · 2022-01-19T12:04:38Z

you dimwits realize torvalds doesn't use github because it's an abomination of his git, right? The linux here is a mirror.

I didn't know that. The more you learn.

good posts bro, don't worry about these soys, they'll all go to therapy and recover after a few years.

I am not insulting or personally attacking or whatever you want to @Marak. I'm just confused about what he's posting. IDK how you understand them, but okay.

nyakowint · 2022-01-19T18:58:53Z

gosh

TechStudent10 · 2022-01-19T19:04:20Z

gosh

yep

Privanom · 2022-01-23T20:33:18Z

Wtf is going on here? Is this guy mentally insane?

hello-smile6 · 2022-01-23T20:39:39Z

Wtf is going on here? Is this guy mentally insane?

IDK.

TechStudent10 · 2022-01-23T20:49:03Z

Wtf is going on here? Is this guy mentally insane?

IDK.

same

DABH · 2022-02-12T07:44:04Z

To anyone following this thread: the final resolution of this issue is that https://github.com/DABH/colors.js is the official repository going forward, and the official package on NPM is @colors/colors. It is recommended you update your package.json to refer to @colors/colors instead of colors. Collaborators will be added to the colors org in NPM in due course after interviews are conducted. In the meantime, PRs are welcome on the new repository. I am unsubscribing from all threads in this old repo and will not see any notifications here. Thanks all.

TechStudent10 · 2022-02-12T14:41:43Z

To anyone following this thread: the final resolution of this issue is that https://github.com/DABH/colors.js is the official repository going forward, and the official package on NPM is @colors/colors. It is recommended you update your package.json to refer to @colors/colors instead of colors. Collaborators will be added to the colors org in NPM in due course after interviews are conducted. In the meantime, PRs are welcome on the new repository. I am unsubscribing from all threads in this old repo and will not see any notifications here. Thanks all.

@DABH you aren't gonna see this, but thanks for maintaining colors.

A Security Vuln was identified in the Colors package for >1.4.0, offending packages being `1.4.1`, `1.4.44-liberty` - [source1](https://twitter.com/snyksec/status/1480286811482206216?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Etweet) - [source2](https://twitter.com/snyksec/status/1480286811482206216?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Etweet) - [source3](https://security.snyk.io/vuln/SNYK-JS-COLORS-2331906) This PR updates the color package to using [@dabh/colors](https://www.npmjs.com/package/@dabh/colors) as stated on this [colors issue #317](Marak/colors.js#317 (comment)) which is a safe alternative.

DABH mentioned this issue Jan 11, 2022

Zalgo issue with v1.4.44-liberty-2 release #285

Open

baron1405 mentioned this issue Jan 11, 2022

Angular 12 - ng test fails on a newly created app - garbled text angular/angular-cli#22462

Closed

15 tasks

azu mentioned this issue Jan 11, 2022

2022-01-11のJS: グローバルなサイトにおけるCore Web Vitals、2021 JavaScript Rising Stars、colors.jsのインシデント対応 jser/jser.github.io#948

Merged

SlayerOrnstein mentioned this issue Jan 11, 2022

chore: pin colors to 1.4..0 WFCD/worldstate-emitter#189

Closed

antongolub mentioned this issue Jan 11, 2022

DoS sec vulnerability in colors antongolub/yarn-audit-fix#218

Closed

novalu mentioned this issue Jan 11, 2022

yamlinc depend on corrupts npm libs 'colors' javanile/yamlinc#31

Open

36degrees mentioned this issue Jan 11, 2022

Older versions of the Prototype Kit may not run alphagov/govuk-prototype-kit#1214

Closed

antongolub mentioned this issue Jan 11, 2022

Terminal Broken after initial conversion. imsnif/synp#90

Closed

This was referenced Jan 11, 2022

Pin colors v1.4.0 junedomingo/react-native-rename#150

Closed

colors.js LIBERTY LIBERTY LIBERTY crashing junedomingo/react-native-rename#148

Closed

mannyluvstacos mentioned this issue Jan 13, 2022

fix: update to @dabh/colors for security vuln appium/appium-test-support#48

Closed

DABH closed this as completed Feb 12, 2022

lfdebrux mentioned this issue Mar 1, 2022

Vendor gulp-nodemon and remove dependency on colors alphagov/govuk-prototype-kit#1213

Closed

(Semi-Official) Status Update #317

(Semi-Official) Status Update #317

Comments

DABH commented Jan 11, 2022 • edited Loading

ethnh commented Jan 11, 2022

sashmit commented Jan 11, 2022 • edited Loading

bet0x commented Jan 11, 2022 • edited Loading

r-bird commented Jan 11, 2022

csvan commented Jan 11, 2022 • edited Loading

funkyfuture commented Jan 11, 2022

liquidautumn commented Jan 11, 2022

DABH commented Jan 11, 2022

ethnh commented Jan 11, 2022

nocturn9x commented Jan 11, 2022

nocturn9x commented Jan 11, 2022

sharpninja commented Jan 11, 2022

lannonbr commented Jan 11, 2022

DABH commented Jan 11, 2022

jdnewman85 commented Jan 12, 2022

sharpninja commented Jan 12, 2022

derrickmehaffy commented Jan 12, 2022 • edited Loading

r-bird commented Jan 12, 2022

nocturn9x commented Jan 12, 2022 via email

ClaudiuCeia commented Jan 12, 2022

mannyluvstacos commented Jan 13, 2022 • edited Loading

jdnewman85 commented Jan 13, 2022

davux commented Jan 13, 2022

Marak commented Jan 15, 2022

TechStudent10 commented Jan 15, 2022 • edited Loading

Marak commented Jan 15, 2022

Marak commented Jan 15, 2022

Marak commented Jan 15, 2022

hello-smile6 commented Jan 15, 2022

TechStudent10 commented Jan 15, 2022

TechStudent10 commented Jan 15, 2022

hello-smile6 commented Jan 15, 2022

TechStudent10 commented Jan 15, 2022

hello-smile6 commented Jan 15, 2022

prietales commented Jan 16, 2022

dustinlw1987 commented Jan 17, 2022

nocturn9x commented Jan 18, 2022

G2G2G2G commented Jan 19, 2022

TechStudent10 commented Jan 19, 2022

nyakowint commented Jan 19, 2022

TechStudent10 commented Jan 19, 2022

Privanom commented Jan 23, 2022

hello-smile6 commented Jan 23, 2022

TechStudent10 commented Jan 23, 2022

DABH commented Feb 12, 2022

TechStudent10 commented Feb 12, 2022

DABH commented Jan 11, 2022 •

edited

Loading

sashmit commented Jan 11, 2022 •

edited

Loading

bet0x commented Jan 11, 2022 •

edited

Loading

csvan commented Jan 11, 2022 •

edited

Loading

derrickmehaffy commented Jan 12, 2022 •

edited

Loading

mannyluvstacos commented Jan 13, 2022 •

edited

Loading

TechStudent10 commented Jan 15, 2022 •

edited

Loading