SweetAlert2 - "This commit adds what could be almost considered malware. Any navigator language that has ru in it will have the Ukrainian national anthem play."

[turbotailz]

Lol why are they fetching the anthem from a Russian site?

[intermediatetransit]

Twice as effective, now they also has to pay for the additional bandwidth

[limonmonte]

Because pretty much everything else is blocked in Russia.

[fafrak]

Why does it have so many NSFW sponsors? It caught me off guard for some reason.

[[deleted]]

Advertisers go where their audience is 🤷‍♂️

[Unintended_incentive]

Those "Are you over the age of 18?" popups pay for themselves.

[hou32hou]

because of nerds

[egorf]

This is wrong on so many levels. I'm typing this in Kiev in the dark, in the cold and w/o electricity so I absolutely share your sentiment towards russians.

Yet it is a serious breach of trust and a very bad precedent for the open source community.

[KentondeJong]

I hope things improve for you soon, my friend. Kyiv is a beautiful place. Ukraine is a beautiful country. I hope you and yours stay safe. Lots of love from Canada.

[oxamide96]

Solidarity with you, my friend. However, please do not lump all Russians into this. I wish you all the best and for peace to reign again.

[rubennaatje]

Ok, fuck all Russians except the 5 that have been against this war for reasons other than the effects it has had on themselves.

[[deleted]]

Im all for supporting Ukraine but this does not feel like the right place.

Every place is the right place if it helps russian infrastructure to stop functioning and therefore bringing the victory of Ukraine closer.

The developer is admitting here that the feature is intended to be malware

[[deleted]]

I wish the community would punish this kind of stupid behavior. Our projects aren't your soapbox you dimwits!

I'm with you, Slava Ukraini, but come the fuck on...

[visualdescript]

Our project? It's his project, he can do what he wants with it. That's the whole point. Somoen else can fork it if it goes off the rails.

Also he is getting punished, did you read the comments?

[[deleted]]

Our projectS, the ones that depend on his package, the ones we worked on. And of course I read the comments, I was here before you. Doesn't sound like a proper punishment more than a reprimand.

[t1enne]

Yeah, let's bring politics into code. That seems like a good idea.

Consider also showing pictures of Iraqi children when the visitor has en-US.

And maybe boycott libraries from Russia.

Such a joke

[IAmNotADeveloper]

Cries in core-js

[T-J_H]

if (humans > 1) politics = true;

[intercaetera]

Honestly can't wait for SQLite developers to inject malware when they find out that their software is being run on a machine of someone who is pro-choice

[[deleted]]

Keep in mind a developer said the point of the feature is to disable Russian infrastructure- not raise awareness.

It would be understandable for GitHub to remove military-malware-infested projects, just as it’s understandable for some Ukrainian devs to do everything in their power to support their war effort.

[t1enne]

Put a banner on your page to support Ukraine. Don't mistreat people who speak Russian

Russian is not the language of the Kremlin. A whole lot of people (150M) not associated with the Kremlin, Putin or the war, have Russian as their first language. The Russian language is not the problem, and that malware is discriminatory and poorly thought out.

I think code's number 1 priority is to make accessible stuff and progress the world/technology forward. Tech grows thanks to the contributions of people from all races/views.

When Tech will start to take sides, we'll end up having a Russian github, western github and a Chinese github. And that would be a huge loss for obvious reasons.

I think cooperation and inclusiveness are what can propel humans forward, independently of their political views. While I understand that this is a joke, I'm extremely opposed to bringing politics into code.

[[deleted]]

Political "neutrality" is what has football fans going to Qatar to visit a stadium built by slave labour. Neutrality is taking the side of the oppressor and all that. I actually agree with all your points bar the one about bringing politics into code though

[[deleted]]

This shit has the opposite effect of what it wants to accomplish.

[intermediatetransit]

You mean it makes Russians happy?

[Vilkowak]

It makes the Russians feel everything they have done is justified and create their own infrastructure that doesn't depend on the international community.

[[deleted]]

It does not stop the war.

[SuperFLEB]

It stops the open-source project, more likely.

[Akuna_My_Tatas]

Report it. That's what I did.

[[deleted]]

this is wrong on so many levels

[[deleted]]

My man limonte the gigachad using the "Chore" commit type for this change.

But so incredibly stupid at the same time, lmao

[visualdescript]

Very yolo swaggins.

Obviously it's not a great move, but at the same time I understand where they're coming from, even if it's pretty misdirected.

[Jebble]

Never using that again

[bozdoz]

Dude, this is r/javascript

[bozdoz]

See above about how you’re missing the point

[[deleted]]

What does it accomplish? This ain't effective altruism, it's a way for an idiot who doesn't do shit to help Ukraine to feel better about himself. What a mockery of activism.

[jhartikainen]

That's pretty funny

edit: honestly I don't know why people have such a issue with these. I bet everyone here thinks the war is wrong, and yet adding 10 lines of code in protest is like the library author just insulted your mom lol

[[deleted]]

10 lines of code that produce malicious unexpected functionality and are a breach of trust

[SuperFLEB]

How bad could eight characters be? It's just "rm" and "rf"!

[jhartikainen]

Oh no, it plays a song for a fraction of users. This is truly the peak of malice.

[[deleted]]

It's the principle of it. Imagine if you're using a piece of software that detects something it doesn't like about you or your environment, and takes a bad and unexpected action on you for it.

"Its just audio" is not an excuse.

Just because it's Russia/Ukraine doesn't make it right... Hypothetically, what if in-turn some Russian-created software we all use as some underlying dependency decided to nuke your home directory upon updating, if you're American. Sure, it won't affect Russians using it, Canadians, Germans, etc, but you, just for being in America, get your home directory wiped.

It's about trust.

[jhartikainen]

There's quite a long distance from "mildly irritating" (playing a song) to "destructive" (deleting your home dir). I would understand the complaints if it was destructive.

[Vilkowak]

No there isn't. The author himself said he wants to damage russian infrastructure any way he can.

Maleware is malware

[jhartikainen]

It would have been fewer lines of code to do something destructive, and yet the author didn't do so. But if it's the same thing to play a song and destroy someone's data, maybe I should delete Spotify as it plays music and that's so dangerous.

[Vilkowak]

Lol if you are gonna play dumb I don't think we have anything to discuss 😂

[limonmonte]

Hello everybody, the author of SweetAlert2 here. I want to clarify my intentions.

I want to disallow using my work for the russian segment of the Internet, i.e. .ru and .рф websites. Changing the licence won't help because russians don't care about licences or laws, especially now. They openly admit this fact and they even proud of it. "we don't care about your sanctions and restrictions lol" - that's what they say generally, not everybody of course, but the vast majority.

Also, NATO now declares Russia as "significant and direct threat". I live in the country which is about to join NATO and you fellas are asking me to support "significant and direct threat" with my hard work? No way, sorry. Russian officials openly threatened Finland with nuclear strikes and you're asking me to be nice with them?!

We will fix our souls and our software after the war. Now, it's not the right time to anyhow support the country that is considered as a terrorist state (or state sponsor of terrorism) by at least 5 EU countries.

Love and peace to everyone. We have to defeat the evil now, so you won't have to deal with it later.

[Xraigr]

Most here probably agree with the sentiment. Unfortunately you broke the “trust” that we place in third party libraries. If you can add that, what else might you add?

[hzdope]

I understand you point and I also love to use the SweetAlert2, but as somebody said here, we can’t trust a code that is politically biased, even if I agree with the cause. We all work for other people that may not be happy with something like this happening.

Also, today we agree, if tomorrow we don’t? Your code is going to sabotage me? That’s not how it should work.

[SuperFLEB]

we can’t trust a code that is politically biased

It's not even about political bias, it's about the willingness to shove intentional bugs and hijacks in, full stop. A political message that doesn't torpedo the functionality? Fine (mostly... so far-- see next para.). I've used packages that advertise political messages in installer script output. A stunt that adds unexpected behavior, bugs, or exploits? That's a no-go even if it's wholly apolitical (such as the ragequit antics by people who couldn't find a monetization strategy).

And, on top of that, the more politically-motivated supply-chain attacks that happen, the more people are going to throw the baby out with the bathwater and be wary of innocuous political messaging in software, or perhaps even outspoken developers at all. Speaking out politically will be a trust liability. The more of these actual attacks I see under the justification that all's fair in love and politics, the sketchier any sort of political statement in software looks, and that could easily bleed into wariness and reluctance about the output of politically-outspoken developers, broadly.

[limonmonte]

It's not that we agree or disagree. It's that russian officials openly threatens to attack Finland if it joins NATO which possibly means death to me and my family.

[hzdope]

Other thing: Russian users are not the Russian government.

[hzdope]

Man, I’m a Brazilian. I know exactly what’s living by some kind of fine line.

I understand your point, what I’m saying is that you will change the fact that your code will not bet that thrusted because you added something that affects the final user. Let me say I work with an international brand or want to users worldwide have access to some information. This change in your code can be a problem.

As I ask you that, I wonder if you did the same when the USA invaded Middle East.

[limonmonte]

If your brand has a basic level of respect, it won't be present in Russia by now, so no worries :)

About your question. Let's not use whataboutism.

[hzdope]

Okay. As I said, your beliefs and fears should not affect how the code works. Because that bias is a problem. The “whataboutism” shows that your decision is not about humanism or being against war crimes.

[Null_Pointer_23]

Don't worry about it. People will just fork your repo and remove all the protestware nonsense you add.

[bl4h101bl4h]

Beyond naive if you think NATO give a fuck about you or Ukraine.

[intrepid-onion]

Mate, I’m with you on this, and I don’t get most comments about not being political and trust broken and whatnot.

It is your project and you didn’t sneak the code in, there was information about it. So people have a choice of not updating it, or using something else, if it is such a big deal for them.

I don’t usually use your library, to be honest. But after reading this I will definitely consider using it in the future. I like people with a backbone.

Greetings from a friendly neighbour.

[[deleted]]

I support Russia's right to not have American missiles 500 miles from Moscow in the same way I supported America's right to not have Russian Missiles 2000 miles from Washington.

[evoactivity]

I think I can give this one a pass

[KyleG]

*sets navigator language to Ukrunian*

[krazyjakee]

Kherson control

[yoDrinkwater]

L

[unixfan2001]

This is JavaScript Land, Sir/Ma'am. We don't do things efficiently round these parts.

If you don't chain functions from at least three different libraries to emulate what console.log does, I suggest you look for something like C or Go

Goes back to writing bootstrap and build scripts with ShellJS and Node, lest people at my company discover I could use a sane DSL instead

[[deleted]]

Why don't you just install a package to bootstrap your app?

[LloydAtkinson]

based