A cautionary tale about software dependencies during major geopolitical events (opens in new tab)

I don't really see how this has anything to do with major geopolitical events, other than the fact that the developer of the library is Russian. The author's complaints could have happened with any open source library and don't seem to relate to the war in Ukraine in any way.

Is the author's implication that the developer took the project in a different direction because of the war? I don't understand what the connection is between "major geopolitical events" and the library. It's just a graph that shows that a year after the war started, the developer removed a feature the author liked.

>> The founder & lead developer is Russian and does not accept donations, perhaps noble, perhaps to avoid a financial trail.

In modern Russia, if one receives money transfer from any other country, they may receive "Foreign Agent" (иностранный агент) status

https://en.wikipedia.org/wiki/Foreign_agent

"prohibited from receiving state funding, teaching at state universities, or working with children"

I see the post got flagged, sad to see but if that's the verdict this'll be the last comment on this post.

The title is not "I caught a Russian developer doing bad things during war!!", the title mentions "a cautionary tale", which from my point of view is a PSA through the means of sharing observations and my interpretation, with some speculation to inform the reader of possible avenues which may affect them, if not through this repository, through another.

To close my writing I'll include the content of a comment in response to a different user, which should define my intent:

"My point would mainly be to spread awareness and share an experience and my interpretation of it, not "slander" and paint a target on my back by namecalling and divulging more information which doesn't serve a purpose beyond wanting clout under the assumption that the war does not affect myself and others around me."

Thanks. Have a good weekend.

From my experience as a developer from Russia, it's usually the other way around from what's found in the article. Since 2022, there's been a lot of instances of malware being found in dependencies which target Russian developers (deleting data in prod, denial of service). Many sites which host tutorials, programming blogs etc. have become unavailable to Russian devs ("access from your country is blocked"). Some repos removed Russian localizations altogether. Github deleted repos and banned accounts of developers with links to Russian banks and other large companies (even if they don't work there anymore). In the last year, our corporate site was defaced and DDoSed several times from foreign IPs.

I don't know about others, but I have't witnessed some kind of similar refusal by Russian devs to cooperate with Western devs, not there's been any protests in the form of altering repos.

What really changed in Russian IT after the war started is that 1) it strenghtened Russia's infosec - for example, our company finally started reviewing random dependencies developers found on the Internet before going to production 2) some companies went into "hiding" and changed their legal names, "moved" their offices abroad, changed country info in GitHub profiles etc., to avoid being associated with Russia because it's now problematic if you want to deal with Western companies/devs (refusal to work with). As for not receiving donations etc. - it's not easy to set up because of sanctions.

Have there already been cases where a project switched part of their codebase to protest something(whatever it may be) and it resulted in lower quality/security issues, or is that something we'll see in the future?

Seems like an interesting attack vector. LibFoo was made by BadGroup, use LibBar instead, it's GoodGroup approved!

Meanwhile LibBar has security flaws, known or unknown, intentional or unintentional, which quickly get absorbed into other projects in a political frenzy to expel LibFoo at all costs (and said actions also are incentivized given that they drive publicity, engagement, etc).

I would have thought this completely nuts, prior to the whole node-ipc malware debacle. I would expect state actors to make the most of this expanded Overton window.

Many underestimate how many resources Russia puts into cyber warfare, and how simple dependencies or Docker images can be infected with malicious intent. Authors often have no choice but to do what they are told if they are physically located in Russia. Western folks, having never lived in such an environment, simply have no idea how things are different.

Are there not enough examples already proving the state of things in the industry right now? All the points the author mentioned are valid, in my opinion. Even if in this particular case it may not be true, there is a large background suggesting why it could be true.

I'm not sure the article really makes the point, but in my experience the war has complicated remote work.

I'm tangentially aware of at least one US company that was outsourcing work to Russian and Ukrainian coders. Apart from the obvious "team" dynamics collapsing, it's not even possible (legal) to pay Russians at this point if you are a US company.

I'm also aware that the narrative inside Russia as to the cause of the war is very different to the narrative I hear. Naturally I believe the narrative I hear as do they.

In this global work-space, who you hire and where they live can become material quickly.

I have trouble discerning the author's point exactly.

- Yes, you can't rely on open-source project going in the same direction as you want.

- Yes, any process involving people has a phycological and interpersonal component.

> To this day we read about the war and it feels distant[...]

> [..]don't get blindsided, especially in times of war[...]

I'm glad the author is not affected by the war, but I supposed it's fair to say that it is not hard for the author to stay unbiased (or it might be just indifferent).

Yeah, of course, there are many much worse effects from this invasion. But one, while less harmful than the many deaths and displaced people, that hits close to home is that it is not really possible to collaborate with folks in Russia anymore. Hopefully their country will relent and allow them to rejoin the international community.

I've had to reread, I was certain I missed something. But no, this is entirely conspiratorial speculation without any basis _or_ even without any point?

If at least they explicitly put forward a theory like "it's russian influence to slow down western digital development" it would have some internal consistency, but no. They suppose it's russian influence (again, without basis) without any theory of _why_ Russia would care about an inconsequential CSS-related lib. Shrug.

Related https://news.ycombinator.com/item?id=35182705

the developer of a library removed a feature around the time the war started and this is enough to accuse them of what, being a Russian state operative? without evidence, this is borderline xenophobic, man.

people's minds change, APIs change: look at the mess that was Python 2 -> 3, Angular 1 -> 2, react-router 4 -> 5, etc.