Thread by @gravislizard

so some shit happened with a node (gack) library earlier which of course there's now arguments over and once again nerds have rediscovered and reopened a societal ill that we created legislation to solve decades ago

long story short: a dude was developing a useful library for free. he stopped developing it. a rando emailed him and asked "can I take over" and he just transferred ownership and walked off. the rando then implanted malware and pushed it out to (maybe) millions of systems

i've already seen the same old, sad, tired defenses of this
1) well you didn't PAY for it!! they don't owe you anything!
2) well nobody was PAYING them. they don't owe you continued support!

one of the applicable legal concepts here is "attractive nuisance"

if you dig a hole and put big spikes in the bottom and don't put a fence around it, kids are going to come play around it and try to get down inside. they will get hurt, and you will go to jail for manslaughter. this is an old law, because you fucking knew better.

you have a *protective duty* to the public when you do something in public.
It is perhaps even clearer to say: you can't put poison in sandwiches, leave them on picnic tables, and then claim "well I didn't owe anyone anything! they never paid me for those!"

Put differently: If you aren't okay with your code being the mainstay of thousands of packages, Don't Do It. The moment you put your project out there and let other people use it and don't stop them, you owe them duties of protection.

"they didn't HAVE to use my code!"
what should they use? they have jobs. they need to accomplish them. their bosses won't accept "well the guy who makes this is doing it for free" - that will get a brisk "so?" and if they decline, they'll be fired.

It's not actually acceptable to make something with the intent of it being massively utilized, let it become massively utilized, at no point put the brakes on and then complain about it being massively utilized. You have options, including not doing it.

everything's fucking open source now. Nobody is getting paid for many of the fundamental building blocks of tremendous amounts of software. That doesn't change jack shit.

If you undercut another contractor to do some foundation work on a building and the foundation fails, it doesn't matter how little they paid you. They trusted you, and you violated their trust.

People who have taken side jobs from their regular occupation know this REALLY WELL. If you work at a computer store and accept $20 from a customer to go to their house and reinstall their OS, you will own that computer for life. You will never be free of it.

So you learn not to take side jobs, because it's not responsible. Making an OSS library is a much, much, much heavier proposition. You are invariably talking about something that thousands or millions of people depend on. Don't do it if you aren't willing to accept responsibility

Dude didn't need to continue development for free. He could have just stopped. Walked away. Would not have been culpable. Everyone would have understood. But he TOOK an action, and in doing so he TOOK BACK the mantle of responsibility he had dropped.

Computers aren't a thing that happens in your bedroom. They are important parts of billions of lives. This is grownup shit now and you have to be responsible about it.

Btw, "you have to put code on github to survive in the industry!" is a false equivalence. Not doing so would have hurt *one persons career.* Doing so and then handling it irresponsibly has untold consequences.

to be clear, i'm not talking about the law. the law is UTTERLY unqualified to deal with this. our legal system predates the ability for one person to move their finger an inch and impact 250,000,000 people. but ethically? dude fucked up.

being an adult is hard! if you pick up a piece of trash, putting it back down makes you a litterer. sucks! computers are not different just because it's easy to do things that have staggering social impact on them. life is full of burdens of responsibility.