Zalgo issue with v1.4.44-liberty-2 release

[Marak]

It's come to our attention that there is a zalgo bug in the v1.4.44-liberty-2 release of colors.

Please know we are working right now to fix the situation and will have a resolution shortly.

[Offroaders123]

Woah, crazy bug! Glad to know you are working on it.
Just reinstalled the Live Server package because I came across this while trying to host a project over localhost. Tracked my way to the new american.js file here in your project because something related to this issue happened while starting the server. Really freaked me out! 😂

[Offroaders123]

Alright, figured out how to temporarily fix the issue for use with Live Server.
The package.json for Live Server has Colors.js set to use the newest possible version available, latest, so I changed it back to the most recent Colors.js version that didn't have the issue, 1.4.0. Just thought I'd share a fix for anyone else that may also run into this too 👍

[niknbr]

👋 Hi
Seems like it was introduced because of this infinite loop

[Marak]

Still trying to figure out what happened. I think we may have tried to upgrade to JavaScript 6 but the CI system only supports JavaScript 5 and lower.

[legendary0001]

[Offroaders123]

Is it an option that, in the meantime, you could revert your project back to 1.4.0, the release before the new change was introduced? This seemed to fix all of the issues on my end. A lot of large projects appear to be requiring your dependency, and they have the version number set to use the latest release.

[Marak]

We've been up all night trying to work out a solution for this Zalgo bug and are still coming up short.

As much as we'd like to revert back to a previous working version, we strongly feel it's best if we can fix the actual problem instead of going back in time.

https://www.youtube.com/watch?v=KEkrWRHCDQU

[Offroaders123]

Yeah, changing the version number to an older release would fix it, but there are many projects out there that haven't been updated in multiple years, I don't think the devs for them will be around to change the Colors.js dependency not to use latest any time soon, Live Server could be an example. (This message was in reply to this one above)

[mdonnalley]

@Marak can you please promote the last working version to latest? I understand that you'd rather fail forward but our package is completely unusable because of this bug

[Marak]

I'm all out of ideas here. It's been a long night and I do I have to begin to prepare soup for Sunday church services tomorrow. I'll try to come back to this Monday if time permits.

Perhaps one of other maintainers can assist?

@substack @dominictarr and @tj should all have publishing access to NPM.

[DABH]

@Marak , It looks like you removed me from this repo so I'm unable to help. I can only imagine everything you're going through right now, but there are a bunch of other OSS devs like you who get hurt by pranks like this, rather than the big tech elite etc. that I think you are trying to go after. I'd be happy to help here, but please be willing to not harm the folks who would otherwise be on your side.

[Darker-Ink]

Best Bug though. You for sure should keep it in 👍 makes the console look cooler in my opinion.

[nbarikipoulos]

In package-lock file we trust and I will trust even for simple project...

[trusktr]

Hello whoever is behind this Marak account. Imagine if you turned your skill into making products for average humans that don't code, to improve their lives in big ways, leaving a bigger and longer lasting memory of what you've done... Bombs won't have as big of an impact in today's world.

[heisian]

💋

[DanielRuf]

For anyone who is affected, here are ways to check, which packages have to pin the version (the ones which directly use colors):

for npm:

npm ls colors

for yarn:

yarn why colors

In some cases you can use resolutions:
https://classic.yarnpkg.com/lang/en/docs/selective-version-resolutions/
https://www.npmjs.com/package/npm-force-resolutions

And in some you can easily apply a patch to remove the relevant code parts with patch-package: https://www.npmjs.com/package/patch-package

[timleg002]

Or check one technology called Haskell; you could even write pure (determined) IOs using one thing called Monads 🤣 It's big fun Then you could run code that never ever break, having a one century of technology under your fingertips would then be possible look how https://negativespace.co/iphone-woman-hands-touch/

all haskell evangelists are now rust evangelists, youre stuck in time bro

[cinderblock]

What are we, the confused internet, missing here? What's going on? Is this some sort of April Fools' joke? Are you trying to get developers to not use @latest tags when installing dependencies?

[sbmelvin]

So has a successor to colors.js been decided yet?

[cinderblock]

@DanielRuf Yeah, I'm not going to go sleuthing around trying to find the relevant story. A lot just point back here but all I see are what look like inside jokes. Thank you for the HN link.

I see that faker.js is related but it looks like the original post the HN post is about has been deleted along with the repository. I've got to go back to the Way Back Machine to get some details: https://web.archive.org/web/20210704022108/https://github.com/Marak/faker.js/issues/1046

---

@sbmelvin I like chalk

[slavanomics]

absolute legend for this thank you marak dont let anyone tell you otherwise

[pravindahal]

@bacloud14 my friend, https://github.com/bacloud14/Classified-ads-48/blob/main/package.json does not do version pinning.

Instead of an infinite loop, what if @Marak had decided instead to simply start sending all data in your application to him? Would your tests catch that?

Looking at your repo specifically, it would be pretty easy for any of the authors of the packages you import to own you pretty quickly.

That repo does use package-lock.json, so there is no need for version pinning in package.json.

[hello-smile6]

@bacloud14 my friend, https://github.com/bacloud14/Classified-ads-48/blob/main/package.json does not do version pinning.
Instead of an infinite loop, what if @Marak had decided instead to simply start sending all data in your application to him? Would your tests catch that?
Looking at your repo specifically, it would be pretty easy for any of the authors of the packages you import to own you pretty quickly.

That repo does use package-lock.json, so there is no need for version pinning in package.json.

People aren't taught to use npm ci. npm ci should be the default for npm install, the current behavior should require a flag.

[dustinlw1987]

@Marak just lost faker.js. The community has taken it from him and rightly so: https://fakerjs.dev/update.html

[hello-smile6]

@Marak just lost faker.js. The community has taken it from him and rightly so: https://fakerjs.dev/update.html

They should've pulled back earlier.

[renhiyama]

I trust @Marak still now, and will do in future! Don't dislike this comment you guys if you don't support him, it's my personal opinion and I have the right to support him, and he has the right to make and destroy codes. More happy because this method did SHAKE the whole social media and blogs, and his message to fortune companies definitely went to them!

The vast majority of "support" comes from anonymous accounts with little to no contributions to open source themselves. You have continued to shill and throw random support towards Marak with no understanding of what "trust" is.

You say you "trust" Marak still now. What do you "trust" him to do?

At this point, I'm convinced you are just an alt account of Marak's that being using to stir the pot.

Me? An alt? Oh I didn't knew I had the chance to call myself such a popular person! Anyways I am the owner of @rovelstars org. Deal with it 😎

And I'm a owner of @labdiscord. Most of us are owners of an organization. Humble yourself.. and what the hell is RovelStars anyways?

And what's LabDiscord?

😂 Thanks for dealing with that guy. I myself posted my org to prove that I'm not an alt of Marak, and I don't care whether my organization is that popular or not, but it has a 120 stars repo, enough to proove that im not an alt of Marak. Labdiscord guy should have learnt about this instead of starting to promote his too without being asked to ¯\(ツ)/¯

[Solixity]

You said deal with it as if you were flexing your organization and having a repo with stars doesn’t prove you’re not an alternate account of Marak. Either way, I’m tired of losing brain cells on this issue (and I’m pretty sure everyone else is too) so I’m unsubscribing from here on. Good luck in life with your future endeavors.

…

On Mon, Jan 17, 2022 at 10:33 PM Ren Hiyama ***@***.***> wrote: I trust @Marak <https://github.com/Marak> still now, and will do in future! Don't dislike this comment you guys if you don't support him, it's my personal opinion and I have the right to support him, and he has the right to make and destroy codes. More happy because this method did SHAKE the whole social media and blogs, and his message to fortune companies definitely went to them! The vast majority of "support" comes from anonymous accounts with little to no contributions to open source themselves. You have continued to shill and throw random support towards Marak with no understanding of what "trust" is. You say you "trust" Marak still now. What do you "trust" him to do? At this point, I'm convinced you are just an alt account of Marak's that being using to stir the pot. Me? An alt? Oh I didn't knew I had the chance to call myself such a popular person! Anyways I am the owner of @rovelstars <https://github.com/rovelstars> org. Deal with it 😎 And I'm a owner of @labdiscord <https://github.com/labdiscord>. Most of us are owners of an organization. Humble yourself.. and what the hell is RovelStars anyways? And what's LabDiscord? 😂 Thanks for dealing with that guy. I myself posted my org to prove that I'm not an alt of Marak, and I don't care whether my organization is that popular or not, but it has a 120 stars repo, enough to proove that im not an alt of Marak. Labdiscord guy should have learnt about this instead of starting to promote his too without being asked to ¯_(ツ)_/¯ — Reply to this email directly, view it on GitHub <#285 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AND4TBGGRLH45Z5UGQWARJLUWTNR5ANCNFSM5LQFI2VA> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[Taro-Naza]

It's come to our attention that there is a zalgo bug in the v1.4.44-liberty-2 release of colors.

Please know we are working right now to fix the situation and will have a resolution shortly.

You're just childish! this is a pathetic behavior

[StepanZharychev]

So the long story short: guy published software under fully open license which allowed commercial usage, abandoned the project so other people supported it literally for years, project became very popular at some point, guy developed jealousy because it was non-profit and decided to break the project.

Except it’s extremely unprofessional and childish behavior (it’s not activism, fellow developers, because big companies wouldn’t even notice it, since dependencies are on strict control there):

1. Marak fully mimicked behavior of “evil corps” by destroying 2 projects which were founded by him, yes, but maintained by many other people, basically saying “I own it and don’t care about your efforts”;
2. As it was said tons of times he could’ve changed licensing to non-commercial;

I’m deeply disappointed by this situation and happy to see that community now leads those projects.

[Saiv46]

Except it’s extremely unprofessional and childish behavior (it’s not activism, fellow developers, because big companies wouldn’t even notice it, since dependencies are on strict control there):

Big companies would notice that by failing tests, and the shitstorm towards this package, otherwise GitHub wouldn't even block his account in first place (there's actual backdoored packages and just outdated packages with vulnerabilites).

1. Marak fully mimicked behavior of “evil corps” by destroying 2 projects which were founded by him, yes, but maintained by many other people, basically saying “I own it and don’t care about your efforts”;

That's the issue with OSS, ex. lead maintainer could crap your for your patch and that's it.

2. As it was said tons of times he could’ve changed licensing to non-commercial;

Then Big companies will just fork from previous version and then just make original package obsolete, that'll be undesirable for Marak.

I’m deeply disappointed by this situation and happy to see that community now leads those projects.

I'm disappointed by reaction of devs, that reminds me of the similarity of cancel culture and apostasy in islam.

[rilysh]

@Marak lmao c'mon dude, at least explain who "we" are as you've mentioned above.

[kuizeo]

Looking at the date of this (January 7th), I assume this has something to do with the attacks on January 6th? The public hearing was today, so what a fitting time to say — fix this. Don't ruin your project because of your political opinions.

And if, by some chance, this is about something else? Fix it regardless.

[DumbGameMaker]

Its about big companies not paying open source devs

[Crsarmv7l]

So the long story short: guy published software under fully open license which allowed commercial usage, abandoned the project so other people supported it literally for years, project became very popular at some point, guy developed jealousy because it was non-profit and decided to break the project.

Except it’s extremely unprofessional and childish behavior (it’s not activism, fellow developers, because big companies wouldn’t even notice it, since dependencies are on strict control there):

1. Marak fully mimicked behavior of “evil corps” by destroying 2 projects which were founded by him, yes, but maintained by many other people, basically saying “I own it and don’t care about your efforts”;
2. As it was said tons of times he could’ve changed licensing to non-commercial;

I’m deeply disappointed by this situation and happy to see that community now leads those projects.

I dislike this train of thought. If I own a house, but leave for a few years and someone lives there and maintains it, it is still MY house, not theirs.

(Although I know with the covid eviction moratoriums governments are actively trying to change that).

Others may have maintained the project but it is still marek's to do with what he wants...and he did. Most people here are just whinners.

[kuizeo]

this is a great way of analogizing it

[PalmDevs]

I dislike this train of thought. If I own a house, but leave for a few years and someone lives there and maintains it, it is still MY house, not theirs.

I know I'm like a year late, but have you by any chance heard of house squatting laws? 🤣

[Crsarmv7l]

Squatters may end up with possession rights (why that is a thing is absurd), but they do not gain ownership rights

…

On Wed, Nov 29, 2023, 9:19 AM Palm ***@***.***> wrote: I dislike this train of thought. If I own a house, but leave for a few years and someone lives there and maintains it, it is still MY house, not theirs. I know I'm like a year late, but have you by any chance heard of house squatting laws? 🤣 — Reply to this email directly, view it on GitHub <#285 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AULD4G53AR2PEEVGAT62B63YG477HAVCNFSM5LQFI2VKU5DIOJSWCZC7NNSXTN2JONZXKZKDN5WW2ZLOOQ5TCOBTGE4TQNBWGM4A> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[DumbGameMaker]

house squatting laws apply after 30-40 years iirc

…

On Nov 29, 2023, at 6:31 AM, Crsarmv7l ***@***.***> wrote: Squatters may end up with possession rights (why that is a thing is absurd), but they do not gain ownership rights On Wed, Nov 29, 2023, 9:19 AM Palm ***@***.***> wrote: > I dislike this train of thought. If I own a house, but leave for a few > years and someone lives there and maintains it, it is still MY house, not > theirs. > > I know I'm like a year late, but have you by any chance heard of house > squatting laws? 🤣 > > — > Reply to this email directly, view it on GitHub > <#285 (comment)>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AULD4G53AR2PEEVGAT62B63YG477HAVCNFSM5LQFI2VKU5DIOJSWCZC7NNSXTN2JONZXKZKDN5WW2ZLOOQ5TCOBTGE4TQNBWGM4A> > . > You are receiving this because you were mentioned.Message ID: > ***@***.***> > — Reply to this email directly, view it on GitHub <#285 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AOXRTN2PUIJK7NMUJCW6L7TYG5BNXAVCNFSM5LQFI2VKU5DIOJSWCZC7NNSXTN2JONZXKZKDN5WW2ZLOOQ5TCOBTGIYDAOBSGQZA>. You are receiving this because you commented.

[nukeop]

In what barbaric country does the law work like that?

[DumbGameMaker]

america - 20 years

…

On Dec 10, 2023, at 1:53 PM, nukeop ***@***.***> wrote: In what barbaric country does the law work like that? — Reply to this email directly, view it on GitHub <#285 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AOXRTN63B3L3UF6O4BI4V3DYIYVODAVCNFSM5LQFI2VKU5DIOJSWCZC7NNSXTN2JONZXKZKDN5WW2ZLOOQ5TCOBUHEYDSOBQGM2A>. You are receiving this because you commented.