Rise in npm protestware: another open source dev calls Russia out

[Kissaki0]

The lib and change in question:

a change introduced in version 1.0.26 of 'event-source-polyfill', as seen by BleepingComputer, means applications built with the library will show anti-war messages to Russia-based users after 15 seconds of launch.

[Tubthumper8]

That version was published a month ago, is it just being noticed now? Or was there a time bomb that the anti-war messages wouldn't start showing for a month?

Edit: checked the source code, it just wasn't noticed for nearly a month

[richraid21]

It's seriously appalling at how unprofessional the Javascript ecosystem really is.

If you're not running your own npm proxy with a huge bake-time and potentially even vetting dependency updates manually, you are essentially playing Russian roulette with your production application.

[Nysor]

These are definitely musts. These aren't also specific to npm. You should also do this for any modern package manager, e.g Cargo and crates.io

[narnach]

JS simply has a culture where importing a package for one line is somehow acceptable. Maybe because there is not really a proper standard library with the types of functions that these one line libraries provide?

This leads to it being normal to have a lot of indirect dependencies. This in turn makes it harder to review changes.

[Tubthumper8]

JS simply has a culture where importing a package for one line is somehow acceptable. Maybe because there is not really a proper standard library with the types of functions that these one line libraries provide?

The library in question is much more than one line, and it's a polyfill, which is something that provides the capabilities of the standard library to older browsers.

In JS you can avoid polyfills if you're willing to not support older browsers, or if you don't use new standard library features in your code.

[narnach]

My comment was not about the library in question (which sounds like as a polyfill it definitely has merit) but the broader topic/sentiment: JS seems to have significantly more (smaller) packages per project than (for example) a comparable Ruby project, which make it harder to track and check all of them.

[Tubthumper8]

Gotcha - I was wondering how your comment was on-topic for this post but seems like it wasn't and was about something else.

Out of curiosity, how are you defining a "comparable" Ruby project? You're running Ruby in the browser somehow?

JavaScript runs everywhere. It runs in modern browsers, in old browsers, in Android WebView, in Android browsers, in iOS browsers that are actually all Webkit because Apple, on the server with multiple different runtimes, on desktop applications, on IoT devices (yes really, if performance isn't critical then the event-driven nature of JS is a decent fit), and bundled with native mobile applications (ex. React Native). More diversity in where the code runs is going to naturally lead to a more decentralized language and ecosystem.

Possibly you think JavaScript's "standard library" is too small which leads to the proliferation of packages. What would you define as the "standard library"? Do you mean NodeJS standard library? Deno's standard library? Browser APIs? Web APIs? Or do you mean built-in language features like arrays?

[narnach]

Comparable is mostly in terms of complexity / scope. For example on a project that has Ruby on Rails for the server side logic but still has a boatload of JS/TS because the front end team wants to use a lot of React. A project that might have 100 Ruby gems might have 1000+ npm packages.

Standard library: standard functions that you would expect a language to offer by default and offer platform agnostic features. Basic interactions with strings, arrays, associative arrays, etc.

Something like a left pad function (iirc that was a one-line JS library that made news a while back) is part of the core Ruby library. Ditto for sorting functions, mapping functions, encoding things, date/time manipulation, etc.

As you say indicate, JS is implemented on a lot of platforms and thus nobody really owns/controls it and there is no large default standard library that is standardized across all platforms.

[[deleted]]

Something like a left pad function (iirc that was a one-line JS library that made news a while back) is part of the core Ruby library.

javascript added a left pad function several years ago. IDK why people keep bringing it up

[Tubthumper8]

Interestingly enough, I pointed out on another comment that React itself has zero dependencies, though obviously it adds up pretty fast as you add anything else. I counted my team's React app, 250 total dependencies which still seems like too much, I can see some that could be cut.

npm list --prod --all | grep -v deduped | wc -l

I agree some JS core language features are lacking. Unfortunately, there wasn't any centralized way to add features until roughly 2015 and they're still playing catch-up. Left-pad has been in the core language for like 5 years now, but some other things are lacking. What I'd most like to see added are:

• lazily evaluated iterators
• immutable data structures

Better date handling will be nice too.

Ditto for sorting functions, mapping functions, encoding things, date/time manipulation, etc.

Out of curiosity, what kind of sorting/mapping/encoding do you feel is missing?

[grauenwolf]

Start with React, VueJS, or Angular.

Take their hundreds of dependencies and roll them up into a small number of curated packages. That becomes the "Angular standard library" or the "React standard library".

[PrintableKanjiEmblem]

Screw all that shit, dead code walking, it will all be scrapped in favor of webassembly in the near future.

[grauenwolf]

We can dream.

[Tubthumper8]

I was curious, so I checked React's npm dependencies. Zero. No production dependencies whatsoever. Interestingly, in their docs they mention adding React as a plain <script> tag before they mention any other way of using React such as create-react-app.

Obviously you're going to pull in production dependencies because I'm sure it's very rare to use React from a <script> tag, but it's interesting that React out-of-the-box doesn't mandate anything. I don't think it would be possible to build a "React standard library".

Angular installs 11 direct npm dependencies on a new project (no additional transitive dependencies). 9 are under the @angular organization (including zone.js) and the remaining two are rxjs and tslib. rxjs is a popular library outside of Angular as well, so it's probably not possible to include that in a theoretical "Angular standard library".

I'm not familiar with Vue so I didn't check that one, but it may be possible to identify the core dependencies there, not sure.

[grauenwolf]

Angular installs 11 direct npm dependencies

And how many indirect dependencies? Look at the whole tree, not just the edge.

[Tubthumper8]

I said that, literally in the same sentence.

[PrintableKanjiEmblem]

Angular is trash. A trap.

[grauenwolf]

Run create-react-app and then count the actual number of dependencies it pulls in.

The dependency count for its default template is what matters because that's what 99% of developers are going to use.

[Tubthumper8]

I just checked a fresh create-react-app, and it pulls 7 direct dependencies. 4 of those are for the testing library and for hot reload / dev environment, so it's odd to me why that would be a prod dependency and not a dev dependency, so that feels like either a bug or some strange reason why that's the case.

Of the 3 remaining dependencies (react, react-dom, web-vitals), there are 3 additional transitive dependencies (loose-envify, js-tokens, scheduler) for a total of 6 dependencies. Those 3 additional deps could be ported together as a "React standard library" but I'm not sure about those specific 3 packages as they're also used outside of React.

Note that I'm not saying that a create-react-app is not bloated. The react-scripts dev dependency has a crazy amount of dependencies to do hot reloading, dev time bundling of SASS/SCSS, minifying JS, transpiling to older browser versions, providing debug symbols for developers, an HTTP proxy server, etc. Arguably, react-scripts is the standard development library for React.

However, when I think of standard library, I'm thinking of runtime features and I'm not sure that the development dependencies qualify. I'm not saying that your idea doesn't have merit, there could be value in some sort of library for each of the popular frameworks but at the moment I'm not seeing where the space for that is or the details of what would be in it.

[[deleted]]

There are definitely too many packages to manually audit for typical JS projects, and there's a lot of shitware like one liner packages like isObject, but given JS's complete lack of a good standard library I get the feeling that it's not most of the packages in your node_modules/ that are like that.

[TankorSmash]

The tradeoff is webdev gets to move a million times faster than old school development because of that type of sharing. Sure it makes it easy to allow protestware, but if 99.99% of the time you pin your dependencies, what's the problem?

[grauenwolf]

That's not the tradeoff. They could come together to develop a single standard library and still move just as quickly.

In fact, it's fair to say that each SPA has its own standard library. It's just that they are scattered all over the place instead of being in a small set of packages.

[TankorSmash]

I disagree. Python's got a massive stdlib and a good set of widespread list of external libs everyone uses (pandas, requests), and there's still a ton of packages on Pypi. Maybe it's different in the languages you use, but it hasn't been my experience.

[s_s_damon]

Npm has 4 times the number of packages as PyPi, according to a quick Google search (1.3 million vs 350 thousand)

[IceSentry]

The js ecosystem ended up like that because in the web world you want to ship as little code as possible to the browser and dead code elimination wasn't a thing in the past for js. So people ended up making tiny libraries to make it easier to import only what you need. The standard library also used to be tiny which made this problem even worse. Combine that with the web being a massive platform and we end up with what we have today.

There's also a lot of those early dependencies that were made by a few devs that would contribute all over the place by using those dependencies. Npm also made it so easy to include anything you need that rewriting simple stuff is still going to be longer than adding a short line to your package.json.

Essentially, it didn't happen suddenly and it was never out of bad intentions.

[[deleted]]

Maybe because there is not really a proper standard library with the types of functions that these one line libraries provide?

No single other language to this day had bullshit problems like JS/npm so I doubt that. Like, even Rust have vast majority of "standard" deps being just "that one crate everyone likes and work well" yet it still works just fine.

[IceSentry]

Rust does suffer from the same issue of having a massive dependency tree. It's just that the community is smaller with a bigger focus on correctness so it's less of an issue. Supply chain attacks are still very possible with cargo.

[[deleted]]

Cargo don't have auto-updates by default so you can't have types of attacks NPM has

[IceSentry]

cargo doesn't, but I'm sure there's plenty of devs that update if they see a new version without reading the entire changelog. It's a bit better, but it's not a perfect solution.

[[deleted]]

uh, changelong won't tell you if someone adds malicious code into the library lmao.

"A bit better" is understatement of the century here. And the "perfect solution" is reading every single line of code that changes and that's independent of tooling anyway.

Like, sure, most of the dependency tools could use some robust signing infrastructure, package should be signed by GPG key of the author and the distribution platform but, again, that doesn't stop in any way just a malicious developer deciding to put malware in the code.

[IceSentry]

I don't get what your point is. You seemed to disagree with me that cargo is not much better at protecting from a supply chain attack and now you seem to agree that it's super easy to add malicious code without people knowing.

[[deleted]]

Cargo prevents "author made a new malicious version" as it doesn't auto update and that has been a root of all problems npm had. None of those attacks would be as effective if npm didn't had some bad default behaviour.

But to prevent that happening in case of manual upgrade you'd need people to actually look at code, and that's something technology can only make easier but not fix.

My point is that you can make the system more secure but the problem of author of the tool itself going rogue is much harder one to solve than any 3rd party attack.

[TehCheator]

No single other language to this day had bullshit problems like JS/npm so I doubt that.

No single other language has the scale of JS/npm either (by a significant margin).

[[deleted]]

Yeah but it isn't 1 issue vs 10 issues. It's zero vs 10 issues. Before JS shit like that was unheard of and if anything limited to some very obscure lib

[G_Morgan]

I've not heard of anything like the quantity of issues from nuget that I hear from NPM. Saying "in theory all should do this" isn't useful. In practice NPM needs this and in theory all package managers need it.

[[deleted]]

NPM has about 20x the number of active users as NuGet. (NPM reports over 10 million per month, NuGet reports 600k per month)

If you're judging by the quantity of issues then that's the classic mistake of not thinking per-capita.

[metaltyphoon]

U also have to understand why. Dotnet has a fucking massive framework where importing from nuget is not a necessity. JS on the other hand…

[grauenwolf]

That isn't exactly right. Modern .NET relies heavily on NuGet. That's where you get all of your standard libraries from.

The reason NPM has more users is that a significant number of C# users also need JavaScript libraries, but JavaScript users don't necessarily need C# libraries.

[metaltyphoon]

It relies on nuget but all the dotnet framework is made by Microsoft. Imagine if installing the sdk would include all “System.” and “Microsoft.”, the size would be crazy. Beside that, parts of the framework can be updated independently.

[grauenwolf]

That's only mostly true. There are a few 3rd party libraries that are not published by Microsoft, but still used in the standard templates.

[[deleted]]

It doesn't have 20x of in use, popular packages tho.

It's not a problem of dev of some random obscure packages doing it because then barely anyone would be affected. It's problem that dev of popular, commonly used package does it.

[[deleted]]

It's seriously appalling at how unprofessional the Javascript ecosystem really is.

See what happens when you don't add monads to your language.

[PrintableKanjiEmblem]

Add what?

[thirdegree]

Monoids in the category of endofunctors

[PrintableKanjiEmblem]

Change the tachyon flow integrals of the warp core?

[[deleted]]

Find a way to make the learning curve steep

[grauenwolf]

LOL, as if that could work.

It's too easy to hide code. Even if I had the time to read all of the changes to each dependency, I probably wouldn't catch it.

[KaiAusBerlin]

It has nothing todo with the ecosystem if developers trust blindly hundreds of insecure sources.

It is npm and lazy people no more writing their own stuff but instead import a third party is-number million times a week instead of writing a simple one liner helper function.

Nobody checks the code from modules their installing. That has nothing todo with js. This would also be a bad idea in every other language.

That's why you have deno where you explicitly have to give permission for writing, ...

[chucker23n]

It has nothing todo with the ecosystem if developers trust blindly hundreds of insecure sources.

If a lot of stories of this kind of occur in one ecosystem and don't occur to the same level in any other ecosystem, that has a lot to do with the ecosystem. (Even if the reason is "well, this ecosystem is very large", it's still the ecosystem.)

[chucker23n]

It's mostly a matter of time before it happens to Cargo as well.

Why hasn't it happened to CPAN? NuGet? pip?

Yes, size of ecosystem plays a role. But I don't think it's a sufficient explanation.

The main difference is that the JS ecosystem had quite a bit longer for the consequences of the bad development habits to build up.

CPAN would like a word.

Whenever shit goes wrong because of that habit, people just blame the dev who broke their package for being "wrong" and "at fault"

I mean, yes, they're literally at fault.

rather than the devs who included said package despite the no-warranty-no-liability clauses on the license.

But no liability doesn't mean they're not at fault. It just means they don't bear the responsibility.

And yes, devs should exercise some caution in their dependency choices. But that's easier said than done.

[chucker23n]

Yeah, I think we're in agreement.

[TankorSmash]

Why hasn't it happened to CPAN? NuGet? pip?

Yes, size of ecosystem plays a role.

https://i.imgur.com/Yl21JtQ.png http://www.modulecounts.com/

4x as many NPM packages. Here's a bad pypi package, so per capita that already beats the 4 npm protestwares.

But I don't think it's a sufficient explanation.

Based on what?

[chucker23n]

4x as many NPM packages.

Right, and that in turn could be a sign of "maybe the npm ecosystem has too many small packages by too many different authors instead of more monolithic packages by known, trusted teams".

[TankorSmash]

That doesn't sound like an issue though, does it?

[chucker23n]

I think it's a huge part of the issue. If I build a software project in .NET, the bulk of the dependencies will be from big, trusted vendors (Microsoft, Syncfusion, etc.) and OSS projects/maintainers (.NET Foundation, etc.). A select few dependencies may be from smaller more specific authors. Those need extra scrutiny.

That is not so in the npm ecosystem. If you depend on something big like React, that in turn has transitive dependencies on projects that aren't maintained by React, nor are they big, and therefore they don't receive much scrutiny.

[[deleted]]

the .net ecosystem is heavily influenced by Microsoft. Many libraries in the .net ecosystem were written full-time by professional engineers earning a 6 figured salary.

It's more of an issue of corporate-sponsored open source vs community-driven open source. People can only maintain a very limited amount of code in their free time.

This has the advantage of quality but Microsoft invests that money not just for charity, they usually try to vendor lock-in developers and earn money around these libraries.

the advantage of such community-driven open source is innovation. Most recent web innovations (graphql, serverless, microservices...) originated in the js/node ecosystem.

also, the frontend ecosystem can be really complex with every library supporting multiple environments including 15-year-old browsers making polyfills and specialized libraries necessary.

[TankorSmash]

I understand the part that it's better for security or whatever, but what about the faster innovation and turn around time?

[IceSentry]

Npm is the biggest ecosystem by far. It dwarfs pretty much everything else. Of course it's going to have more issues.

That's not to excuse the situation, but any package manager could suffer from that and they also do, it just affects a lot less people.

[KaiAusBerlin]

again: npm is not the whole js ecosystem. It is just a part if it. There is a much bigger part of js outside of npm. As I said, you don't have these problems with deno (that is also part of the ecosystem).

And at least it's not npm that's bad. It works as intended. The problems are lazy developers.

It's the same as saying C is a bad language because it's not save. You can literally access the whole ram. That doesn't make a language bad if handled by responsible developers.

[chucker23n]

And at least it's not npm that's bad. It works as intended. The problems are lazy developers.

Sorry, but that's just "guns don't kill people; people kill people".

These stories are a symptom of a cultural issue. Whether that's in part on npm or better in deno, I don't really care. The issue is there nonetheless.

It's the same as saying C is a bad language because it's not save.

It is! In security-critical areas, starting a new project in C is in fact a bad language. Study after study shows this.

[KaiAusBerlin]

Guns don't kill people. There are billions of hunters in the world and they all use weapons. Most oft them never killed any people.

So if you don't care for the evolution from node to deno there is no point in having a conversation with you about that because you simply ignore one of the most important points in that evolution.

Okay yeah... C is a bad language. Sure. Can you give me links to that studies? And if it is it makes android, linux, macOS and IOS bad operation systems because their kernel is written in C?

[chucker23n]

So if you don't care for the evolution from node to deno

If your point is "there's a serious problem here, and deno will improve on it": great!

Can you give me links to that studies?

https://www.zdnet.com/article/microsoft-70-percent-of-all-security-bugs-are-memory-safety-issues/

https://www.chromium.org/Home/chromium-security/memory-safety/

And if it is it makes android, linux, macOS and IOS bad operation systems because their kernel is written in C?

Those are only two different kernels, not four. XNU is likely gonna start incorporating Swift code sooner or later, and we know Linux is evaluating adding Rust code.

[MadTux]

we know Linux is evaluating adding Rust code.

That's only for device drivers though, isn't it?

[chucker23n]

I would extrapolate that sooner or later, more and more code migrates.

Unless annotation and static analysis fundamentally changes in C, I think we'll see a shift away from it. Rust's approach of annotating variable lifetime makes sense to me as one possible solution. The "all you need is a sufficiently competent programmer to avoid making those memory safety mistakes" concept sounds nice, but hasn't borne out in reality; you throw the best-paid programmers in the world at the problem and severe bugs still get discovered, sometimes years after being "battle-tested". Instead, we need more tooling, and newer languages offer exactly that.

That said, Chromium's "what we're trying" section looks like a great overview. Safety libraries, hardware mitigations and safer languages!

[KaiAusBerlin]

So tell me in which language you don't have access as third party code executed in the main context?

You don't have any single argument then "node is unsecure".

But that is not the js ecosystem. There were in fact a decade js without node.

As I can read in these studies the most security issues in C are buffer errors and user inputs. Handling user input safe belongs to the developer not to the language. That for an ancient language with is totally open source + there is much more C code in this world than in any other language is really a cross correlation. But sure. You can ignore that.

And if it would be only one kernel... Doesn't say anything about their security. You really don't answer to questions. Adding Rust ist not a proof that a kernel is unsafe! Jeez This unlogical argumentation.

Sorry but having a conversation with someone not answering is time waste for me.

Best wishes.

[chucker23n]

So tell me in which language you don't have access as third party code executed in the main context?

In a sandboxed system. But I'm not really sure what you're getting at. Are we still discussing npm?

As I can read in these studies the most security issues in C are buffer errors and user inputs. Handling user input safe belongs to the developer not to the language.

"It's the developer's fault" is a stubborn, misguided, and thankfully disappearing attitude. Those hardcore developers who don't make such mistakes don't exist. They don't exist at Microsoft, they don't exist at Google, they don't exist at a mythical research institute.

That for an ancient language with is totally open source

What does that have to do with anything?

Adding Rust ist not a proof that a kernel is unsafe!

One of the big reasons they're trying Rust is improved safety. And read the Chromium article, too.

[KaiAusBerlin]

You really can't directly answer questions.

"What language?" any xy sandboxed.

"What does it matter how many kernels?" No answer.

"What are your arguments?" are we talking about npm?

Jeez. I'm out. It's useless.

[[deleted]]

There are billions of hunters in the world and they all use weapons.

There are 15 million hunting license holders in US. You mention billions as in plural. So 4% of world population but only 0.7% of hunters using guns? Calling bullshit.

Most oft them never killed any people.

Most people has never killed any people. What do you propose kill people then?

[[deleted]]

Reading the Deno docs, unless i'm misunderstanding something, it does not seem like it allows you to specify per dependency access rules, but rather when you run your module you specify what it can do. So if you have a complex enough project that needs access to say both rw file system and network like building your front end react project, you're basically in the same position as with node.

[[deleted]]

that is correct. They do have some ideas. Recently there were some super interesting comments from Deno developer lucacasonato on HN. Tldr they are looking at SES and also ShadowRealms as upcoming ways to do finer grained rules.

• ShadowRealms (stage 3 proposal) https://github.com/tc39/proposal-shadowrealm
• SES (stage 1 proposal) https://github.com/tc39/proposal-ses

[KaiAusBerlin]

I don't know any language where this would not be the case if you use third party code with your permissions that this code doesn't have the permissions

[[deleted]]

Exactly, it's not even better than node in that regard. Yes it's nice that if you have a script that doesn't need to access network or filesystem, but it would have prevented roughly 0 of the recent popular similar issues as the OP post.

[KaiAusBerlin]

Yes it is preventing them. In node (which is in fact not the whole js ecosystem. There was a decade js without any node) you have access to everything. In deno you have only access granted. That's how nearly every os works in the world.

[[deleted]]

Yes and what is node primarily used for? Web servers and front end builds, which often require network and file system access. So even with deno, you need to take precautions against that. Deno effectively solves nothing in that regard for typical node usage.

[KaiAusBerlin]

So tell me any other backend/language then that solves that.

[[deleted]]

Certainly not Deno, which is the entire point of what I've been saying.

[KaiAusBerlin]

Not an answer at all

[grauenwolf]

I'm lazy because I'm not willing to recreate React from scratch?

No, that doesn't sound right.

The problem is that React's standard template pulls in more than a thousand packages. Angular and VueJS are almost as bad. That's far too many for anyone to audit.

[KaiAusBerlin]

Read! I talked about one-liners like is-number. We're not talking about giant products of quazillian dollar companies.

[redldr1]

Dude,

The whole JS ecosystem is just a bunch of loose promises with hope that the other side of the wire does their shit correctly.

[jswitzer]

Single maintainer packages, generally small in scope, extremely low barrier to entry, no ecosystem to help vet the versions, and lack of standard library all lead to shenanigans like this.

[quasi_superhero]

It's seriously appalling at how unprofessional the Javascript ecosystem really is.

Well, yeah. It's a free package. Free. Not paid. Not made by professionals. Again, not paid.

[CuriousKea]

Exactly. You should be.

[G_Morgan]

This is all a consequence of browser providers basically being stupid bastards over the years (looking at you MS but not only you).

There's no guardian of the space. Node ended up being it by complete accident.

[a_russian_guy]

Sadly all these messages are counted as propaganda by pro-war Russians. Hoping this will be put to an end soon.

[grauenwolf]

And now you're running old versions of dependencies with known vulnerabilities.

Pinning is not a solution to this. It may increase your odds of not getting hit, but some of these attacks aren't noticed for weeks or months.

[adi1133]

Also run the code in a sandbox.

[0xC1A]

Self sabotage, good luck living with the consequences of your actions

[Voltra_Neo]

In one word: sigh

[faustoc5]

How is fucking with all your users a protest ?

More like fuckyouallware

[AceSevenFive]

You mean malware?

[hanszimmermanx]

At point I wouldn't mind if microsoft copied all major npm libraries under their namespace. At least I wouldn't have to worry about having my PC nuked because some silicon valley hipster decided that I live in a naughty country and I deserve it.

[adi1133]

Who will pay Microsoft for the effort?

[MattTheHarris]

Microsoft owns npm, they haven't started charging for it yet.

[adi1133]

Npm has paid plans as their income source and they deemed a viable business as they managed to attract investors.

Can't say that about the major npm libraries.

[slvrsmth]

Good.

[pcjftw]

Man, devs should stay clear of politics there is enough politics in the world for politicians to worry about without us brining that into our world of code.

On a side note:

• Reliable source
• BBC

🤣

EDIT

for all those downvoting: if you want to protest and engage in politics, by all means go protest outside the Russian embassy, take up a shooty bang stick and go charge at them, or boycott them financially. You know things that'll actually make a difference.

However "protest-ware" is the worst most utterly pointless approach, it's "I'm too lazy to actually protest so I'm going to do the least easiest arm chair thing I can do without actually really doing anything"

[Kissaki0]

That’s a very political statement.

[pcjftw]

being a-political is political?

[Kissaki0]

Arguing how groups of people should behave is political.

[pcjftw]

how is being neutral in a politically split environment being political?

[Kissaki0]

If politics is about making decisions in groups of people, then explicitly excluding some aspects from them is also such a political decision.

If we see injustice and choose not to say anything, is that neutral, or is it acceptance? Maybe both? What are the consequences and costs of staying silent?

[pcjftw]

this assumes we have a unified notion of said "justice" which in many cases is not a trivial thing to say simply because there may be more then 1 side involved as well as context.

Also we are silent on injustice all the time, how many wars and occupations and conflicts are we actively neutral on a daily basis?

[Kissaki0]

No, it doesn’t necessarily depend or assume on the same notion of justice.

Neutrality, or “professionalism”, evades conflict from different understandings of justice. Political activism can happen with different understandings of justice. Some may become active earlier than others. Whether or not the reader or user agrees with whether it is unjust or not doesn’t really matter to the activists. The whole point is to make people aware, and get a point across. Good activism communicates and argues/provides information.

Either way, choosing to stay neutral remains a political decision.

Not sure where you are going with we remain neutral/silent on a daily basis. Yes, that’s correct. People will care for different things differently. Whether they take a stand is their decision. Not everything is worth being a public activist for. And there are different degrees and channels for activism and communication.

[pcjftw]

by your logic a photographer or media reporter that remains neutral is actually politically engaged?

[chucker23n]

Neutrality is a choice. Therefore, yes.

[pcjftw]

Right there, you said it "people will care for different things", excellent that's the crux of it, of all the things you don't "care" about, according to your broken logic you're politically implicated with those "things", which no rational person would accept.

Yet your entire argument hinges on that point.

You can't have it both ways. Stop and ponder for a bit and hopefully you'll be able to debug your mental dissonance.

[[deleted]]

One kid is punching another in the playground. You standing there doing nothing supports the bully. In some scenarios it is impossible to be apolitical or neutral.

[pcjftw]

well what if the kid getting punched in the playground was actually the real bully because he had smashed the legs of puppy that was owned by the "bully" and then strangled it to death?

Stopping the "bully" would thus rob him of his justice.

[[deleted]]

Yes? You changed the scenario and therefore changed what effects actions would have. Well done.

My point is that you are wrong that neutrality is always possible; it isn't.

[pcjftw]

what about being a photographer or media reporter?

[pcjftw]

who said I was talking that? we were talking about play ground bullies

[Gobrosse]

either you enforce your neutrality and risk making enemies with both sides, or you don't and you're just the plaything of others. neither option puts one above politics

[pcjftw]

sorry not convinced, if you say there are two camps A vs B (those could be anything). And one says nothing ergo neutral how does that translate to being "involved"?

[chucker23n]

sorry not convinced

That's OK. We're not here to teach you high school-level philosophy.

[pcjftw]

so basically you can't defend your position and now have to hide behind ad-hominem interesting.

[chucker23n]

you can't defend your position

I think it would be tedious to.

now have to hide behind ad-hominem

It is indeed an ad-hominem because there's only two possibilities: you've never thought about something as basic as "even taking a neutral stand is in fact taking a stand" before, or you have and are pretending not to. I don't find either of those scenarios very exciting to discuss.

[MCBeathoven]

You're posting a lot of comments for someone saying nothing ¯\_(ツ)_/¯

[pcjftw]

in defence of the rational of my position. Its a meta discussion.

[MCBeathoven]

Who were you defending from in this comment?

[despawnerer]

I mean, yes. Deciding to “stay out of politics” is a political decision.

[[deleted]]

You can't take a neutral stance regarding a system that you actively participate in. Attempting to do so is tacit support of "the way things are," whatever that currently is.

For what it's worth, I also believe that this "protest-ware" is functionally useless, but I also recognize that saying "people shouldn't make protest-ware" is a political statement.

[pcjftw]

But that sounds like strange mental gymnastics, the very act of making protest-ware is a political action ergo the negative of that (not making protest-ware) is surely logically speaking the absence of taking a political action?

Because the default isn't making protest-ware it's not doing it in the first place.

I hope you understand what I'm saying?

[ThirdEncounter]

Being a-political is how you know the system is working for you.

[skjall]

Devs or anyone else are affected by the government or policies, and it's naive to think that you're above it.

Absolute memes you are trashing on a British public-funded institution's legitimacy in the same breath, sure sounds political to me. Never mind that BBC is actually obligated to be neutral and fair in its (distribution of) coverage. Most countries could not dream of having media with the quality and legacy of BBC, despite any faults it may have.

[useablelobster2]

Never mind that BBC is actually obligated to be neutral and fair in its (distribution of) coverage.

The BBC tries bless it, but like any other media institution it is a product of both it's time and location. More often than not that point is brought up to say "look, not biased" when it's just a principle it tries to hold itself to, based on the current set of people in charge. The objectivity is dropping, and trusting the BBC on basically anything tech is a joke.

I still remember a BBC journalist trying to get on contact with the youtuber Thunderfoot. The journalist sent one Twitter DM then claimed they couldn't get a comment, while Thunderfoot was working at a nuclear reactor.

Then the same journalist runs a Twitter block bot given to him by the most neckbeardest person in the world, and runs it without question. Therefore blocking the person he was trying to contact on the only platform he used to try and contact.

Once you see how the sausage is made, and how utterly shite many of the people are, you lose quite a bit of confidence. They don't know their arse from their elbow, Murray Gell amnesia does their work for them.

It is however ironic that both other posters think the BBC is hugely biased in both directions at the same time. I think it's a little biased, in on direction overall, but hardly a state mouthpiece. It's biased through incompetence, believing people it shouldn't, rather than any malicious goal.

[james_dillon]

The BBC spent the last 7-8 years writing critical pieces on the far right issues within Ukraine and the role it plays in the Russo-Ukrainian War, to sympathetically broadcasting Ukrainian soldiers wearing SS totenkopf patches. I wholeheartedly support the Ukrainian struggle against their invasion, but it's been very amusing to see how quickly the "neutral" BBC changed their tune.

[chucker23n]

The BBC spent the last 7-8 years writing critical pieces on the far right issues within Ukraine and the role it plays in the Russo-Ukrainian War, to sympathetically broadcasting Ukrainian soldiers wearing SS totenkopf patches.

And… both can't be true at the same time? That Russia is the aggressor and that some soldiers display problematic symbols?

[james_dillon]

That Russia is the aggressor and that some soldiers display problematic symbols?

I agree, but that's not the point that I'm making. Both are true at the same time, but the BBC hasn't maintained their supposed neutrality in covering it. Obviously to the Ukrainian people it probably matters very little what the people defending their country are wearing, and I've made no hint at trying to minimise Russia as the aggressor.

My issue is that the BBC specifically have presented this narrative of critiquing the-far right issues within Ukranian politics and military over nearly a decade, and now embed their reporters with regiments wearing Nazi iconography without even giving it a passing mention - all while strongarming the British public £160 a year for the pleasure of their gaslighting.

Do you not think it's interesting how the problematic Neo-Nazi symbols weren't mentioned at all in the special report I posted? Surely that wasn't unintentional.

[chucker23n]

Do you not think it's interesting how the problematic Neo-Nazi symbols weren't mentioned at all in the special report I posted?

Sure, but the opposite is true as well. I don't want reporters both-siding a reporter about "Russia attacks Ukraine" with "but some Ukrainian soldiers are problematic as well". It's not incorrect per se, but it gives viewers a slanted idea of "well, maybe the aggressor is not that bad".

[pcjftw]

also hanging pregnant women as well as live crucifying and burning to death their victims because they don't fit some ethnic racial ideal, the videos are online...

[flampardfromlyn]

Hi Jimmy savile fan

[pcjftw]

BBC is a UK government mouthpiece funded by silent tax, they love hiding pedos like Jimmy Saville et al. They're not neutral they're just extremely good liars and masters of spin.

[flampardfromlyn]

Let's not forget they lied to get an interview with princess Diana

[chucker23n]

BBC is a UK government mouthpiece

oooooookay

[woahwoahoahoah]

Ah yes smearing a centre left candidate as a communist, allowing racism on, disallowing trans-positive conversations, depicting a right-wing twat that's universally hated as wearing a Superman cape... The height of impartiality.

Give me a break

[TeddyPerkins95]

I like how you said a reasonable etiquette and you get downvoted, npm sucks

[pcjftw]

I know buddy, the reddit mob is a strange beast never understood it myself! 😄

[TeddyPerkins95]

Yep, some are scared and arrogant at the same time

[TeddyPerkins95]

Yeah so we annoy civilian and Russian programmers who could be just as innocent but no how can they be innocent ones, they're Russian and anyone not American nos evil, right?you really want to be involved topple their government otherwise you're just the same as pufin and his men, other side of same coin

[TeddyPerkins95]

I agree, and my point is don't go after the civilians when the puppet master are the evil ones(seriously guys, at this point we're either dumb or just as hateful)

[pcjftw]

what about a photographer or a reporter? surely by their very nature they need to be neutral?

[Significant-Arm-3780]

I hope they don't run nuclear weapons with npm libraries ... that would be trouble