5 ms·

The Ant Design Christmas Egg That Went Wrong

143 points by druml 8y ago

tzh 8y ago
Interesting question: should organised projects, tech or otherwise, cater to the cultural intricacies of third world countries?
- crooked-v 8y ago
  I know the US and various western European countries have been having all kinds of trouble lately, but I don't think they're "third world" quite yet.
  - jmvoodoo 8y ago
    US, Western EU countries, and even China are by definition not third world.
    - crooked-v 8y ago
      You missed the point of the joke.
  - seniorsassycat 8y ago
    First and third world country refers to cold war alegiences not development status, the first world is The US and it's allies, second world is USSR and it's allies, and the rest of countries are third world.
    - crooked-v 8y ago
      You missed the point of the joke.
- delinka 8y ago
  To answer your question: if you want your project used by others, it's best not to rock the boat. Which leads me to ask why anyone would muck about with something that could affect other projects' production code? My response to this little fiasco: why is anyone relying on externally-hosted, malleable code in a production environment? Run a repo, package it with your app ... whatever it takes to have a stable release.
  - crooked-v 8y ago
    It sounds from the description like this "feature" was added in an earlier version, not something literally released on Christmas.
    - c22 8y ago
      The point still stands. If open source code is vital to your business you should probably at the very least audit it.
      - mp3k 8y ago
        Good advice. Funny thing is, from May I'm working on a big project, where we use ant extensively. We pushed the limits of almost all the available components, found several issues, enhanced it in our custom wrappers. In that time, I was going through the sources of components several times, not only of the ant itself but also through sources of react-components on which the ant is built. YET I HAVEN'T EVER INSPECTED THE BUTTON COMPONENT. Would be super funny if I would have found that christmas egg this summer... Now as I'm thinking about it, we have EnhancedButton, which gets 'block' boolean prop to make it full-width. I was used to that from react-bootstrap and even had the idea to open feature request on antd... In that case I would certainly open the button.tsx... Anyway, great episode in the frontend world.
      - aaron695 8y ago
        Do you audit Linux if you use it? Why only audit open source? Part of the whole reason of open source is trust. At what point does an audit cost more than doing it yourself? Then do you need to audit the audit since you have no trust? Can't we not pass the buck in a just world situation and blame the user and instead encourage open source not to mess with the codebase.
  - mp3k 8y ago
    The code was there for months, there was just time trigger for 25th of Dec. I'm loving ant, but this was stupid. At least it's free advertising so the project's user base can grow.
- ars 8y ago
  Obviously they should try. And since when is not wanting a Christian holiday displayed on your site a third world country thing?
  - monochromatic 8y ago
    Why is that obvious?
- jdietrich 8y ago
  "Third world" is a nonsense term that gives a completely misleading picture of global wealth distribution and helps to perpetuate negative stereotypes [0]. China's PPP GDP per capita is almost exactly the global average and higher than many Eastern European countries. They are practically the definition of a middle-income country. How would American companies react if their website suddenly started showing messages celebrating Eid al-Fitr for no apparent reason? Would you expect them to blithely laugh it off as harmless festive high-jinks? [0] https://www.gapminder.org/videos/hans-rosling-ted-2006-debunking-myths-about-the-third-world/ https://www.gapminder.org/videos/hans-rosling-ted-2006-debun...
  - tzh 8y ago
    Nobody who celebrates Eid al-Fitr makes any useful contribution to mankind, so that situation you mention is unlikely to ever happen.
- deleted 8y ago
  [deleted]
- PhasmaFelis 8y ago
  "Third-world countries" is both inaccurate and misses the point. A much better question is, should we cater to autocracies trying to suppress their citizens' religious freedom? I'd say the answer is no, whether it's China, the actual third world, or the USA or Europe. https://www.theguardian.com/world/2018/dec/24/china-cracks-down-on-christmas-celebrations https://www.theguardian.com/world/2018/dec/24/china-cracks-d...
crooked-v 8y ago
Well, there goes any chance of me ever using this project.
- matte_black 8y ago
  Unfortunately there’s not many sensible alternatives for what Ant design does.
  - druml 8y ago
    What do you think about Semantic-UI?
  - ng12 8y ago
    What does Ant give you that Material-UI, Kendo, or Blueprint don't?
    - matte_black 8y ago
      A complete set of useful and practical components for enterprise applications. Have you used Ant??
      - ng12 8y ago
        There are many such frameworks including the three I mentioned. I haven't used Ant, but I've looked at it and didn't find a compelling reason to use it over the others.
- monochromatic 8y ago
  How awful for Ant.
CJefferson 8y ago
I am increasingly of the opinion that free open source software should include fun things like this. It is an easy way to remind people just what "free, but with no warranty" means.
- crooked-v 8y ago
  That sounds like an excellent way to get people to stop using any new open source software.
  - CJefferson 8y ago
    Well, if they don't want me to have any fun, they can pay me.
    - crooked-v 8y ago
      If you want to make proprietary software, make proprietary software. Don't make open source software and intentionally put traps in it.
      - CJefferson 8y ago
        Your message has really annoyed me, I just wanted to say that. I found the tone quite upsetting, although I hope it's just because our only communication is through this brief chat, and we don't really know each other. I've never made proprietary software. I've written hundreds of thousands of lines of open source code in dozens of projects. I make releases of those projects, answer bug reports and issues, review PRs, all for free. Often I get annoying demanding emails for support for something I give away for free, which is quite annoying, but I usually answer anyway unless the sender is really annoying. In a couple of them, there are features which are the because they amused me when I wrote them. Nothing that would lead to a wrong answer. Maybe if someone wants to base their business on my free labor, they have to put up with that.
        lox 8y ago
EamonnMR 8y ago
Pipenv did this for Halloween. https://github.com/pypa/pipenv/issues/786 https://github.com/pypa/pipenv/issues/786
- xkcd-sucks 8y ago
  Yeah but everyone already knows pipenv is buggy as yesterday's turds
mac_was 8y ago
Seems to me that they’ve lost credibility by injecting these sort of ‘joke’ into open-source software used in prod in many companies. How would I use it for a new project now?
zorpner 8y ago
This is a long-standing feature of VLC which I enjoy (the santa hat on the icon), but is similarly not enjoyed by everyone: https://forum.videolan.org/viewtopic.php?t=96539 https://forum.videolan.org/viewtopic.php?t=96539 My opinion about people who demand professional perfection from software they neither pay for nor can be bothered to review the source of are probably well-indicated by the tone of this sentence.
- saghm 8y ago
  I think there's a difference between putting a cosmetic thing like this in an application rather than a library; if you put it in your application, you're not going to change the experience of anything other than your own product, but by putting it in a library, you're changing the experience of other people's applications. From reading other comments here though, it seems like this isn't a universal opinion though.
  - djsumdog 8y ago
    Yea, and VLC is really just a media player. Sure someone might be using it in production at a Kiosk, but that little icon change literally doesn't affect production use at all.
mp3k 8y ago
The event was certainly interesting enough so it was worth to setup a new jekyll blog, right?
deleted 8y ago
[deleted]
molszanski 8y ago
They could've at least limited it to a DEV environment or a whitelist of Ant Project related domains. I hope they've learned the lesson.
DoreenMichele 8y ago
I have really mixed feelings about this. To my mind, the larger outrage is that people were fired over this. I'm aware of the tendency to try to focus on what it seems like we can control rather than on actual justice. In this case, I'm so far only seeing outrage about the Easter Egg. I'm not seeing outrage about "They fired people over this???!!! People whose only crime was using Ant??!" I'm not a fan of what Christmas has mostly turned into these days. I'm ambivalent about leaving a remark that could easily be wildly misinterpreted as supporting and encouraging cultural insensitivity by Americans/Westerners. Anyway, I may seriously regret commenting at all. This seems like a can of worms for various reasons. I just dislike the idea of standing idly by while the developers get lambasted, as if they should have known ahead of time that people would be fired over this because of stuff happening in China. I'm also leery of the possibility that the other answer will be to ignore the seriousness of the situation for some people and act like "not my problem." So there's my 2 cents.
- nomel 8y ago
  Imagine working for the state. Your non technical boss comes in and asked why you have a holiday theme on the page when policy is to not show celebration on state websites. He asks you why you put this code in. You tell him you didn’t write the code. He asks who did. You tell him it’s open source, many people contributed and someone put this in without telling anyone. At this point, you’ve lost all credibility to you non technical boss and all of his non technical execs. You put a strangers code on the state run website, without reviewing it and without knowing what’s in it.
  - DoreenMichele 8y ago
    I worked for a corporation for a few years. We had strict rules about not downloading anything to our work computer because they did an internal study and found that 98% of all malware came from employees downloading music apps and that sort of thing. So they forbade it all wholesale. Breaking that rule could get you in trouble, up to and including being fired for it. So, sure, it's possible that in some cases people were fired because this Easter Egg outed them for violating some rule. And it's entirely possible that some of the cases of "I got fired for this" are that kind of scenario. But if this is not against the rules and the firing is actually because it is Christmas-themed, that's a different situation. I'm also aware that it could be a cultural thing where someone has to be the fall guy and heads will roll to prove our innocence. I see that as deeply problematic. If you didn't forbid open source, firing someone for using it as the "first offense" penalty is not a good policy. I realize we likely have very little information at this point in time about the details behind the firings and it is the norm for early reports to be wildly misconstrued, which is one of the reasons saying anything at all here is potentially something I will regret.
anigbrowl 8y ago
For those outside the USA, I regret to inform you there is no such thing as a 'Christmas egg' and no Christmas traditions involving eggs. May I suggest you calling it a Christmas cracker?
- ng12 8y ago
  I think it's a pun on easter egg.
  - kwhitefoot 8y ago
    True, but it is feeble and misleading. Software Easter eggs have to be searched for but this one seems to be just there.
- jeklj 8y ago
  Traditions always start somewhere!
- bdcravens 8y ago
  What is a Christmas cracker?
  - code_duck 8y ago
    Ah, the rich, storied tradition of the Christmas Cracker.
  - roryokane 8y ago
    https://en.wikipedia.org/wiki/Christmas_cracker https://en.wikipedia.org/wiki/Christmas_cracker “Christmas crackers are festive gifts that make a snapping sound when opened.” For example, a Christmas cracker could contain a paper with jokes on it, a paper crown, and a puzzle where you have to disconnect two linked ring-like metal pieces.
- soyyo 8y ago
  >For those outside the USA USA did not invent Christmas, even if you are right with your statement about 'Christmas eggs', I don't see the point of remarking that you are American as if that will make you some sort of Christmas authority.
zenexer 8y ago
Is it known whether this was a deliberate political statement in response to recent events in China, or just a festive holiday joke intended to be harmless? Given the current state of affairs in China, I’m inclined to believe this was political. If that’s true, many of the other comments here debating the need for professionalism in FOSS may be missing the point. It could be argued that this fits into the same category as the malicious hijacking of libraries on NPM, although I agree with the political statement being made here. A more appropriate debate may be whether it’s acceptable for FOSS libraries to protest human and civil rights violations.
- karmasimida 8y ago
  > just a festive holiday joke intended to be harmless Christmas in China is just a shopping holiday for the most. And no reason to make things this complicated, the author has already stated that all this is intended to be an easter egg.
  - Stratoscope 8y ago
    > all this is intended to be an easter egg. An easter egg that they put on other people's sites without their knowledge or consent. The correct word for this is malware.
- Ahmed90 8y ago
  Protest all you want, but use your own productions, not others, can you tell me what would be your feeling getting a call on holidays from an angry client or a manager who might not even be celebrating Christmas? Chinese politics? alright fair enough... but what if some of these companies got punished because of it? or lost business? I'm Arabic, can you imagine the shit a dev will get because of this if he/she used Ant for a political figure or party website? imagine a non-christian religious organization finds their site publically celebrating Christmas? at the end of the day, politics or not the only person that will get all the shit dumped on their head is the poor developer who trusted your product and took you as a responsible person with all the 39k GitHub stars and 692 contributors... if I can't trust that to be mature then eh... good luck reshaping the world with FOSS. Good luck explaining dependencies to the client/manager and how "someone from outside the company can modify our precious little website" and how can you prevent that in the future lol...
conanthe 8y ago
What reaction someone expected by shoving their religion down the throat of the users? This is so sad.
- PhasmaFelis 8y ago
  Snow and "ho ho ho" is hardly a religious statement. If anything, this is the capitalistic "buy lots and lots of presents" version of Christmas, not the religious version.
  - monsieurbanana 8y ago
    They are one and the same.
    - PhasmaFelis 8y ago
      They overlap a lot in the West especially, but they're very different phenomena. Look at Japan, where Christmas is hugely popular, Jesus is nowhere to be seen, and a poll of schoolchildren a few years back showed that most of them thought the holiday was about celebrating the birth of Santa Claus.
  - conanthe 8y ago
    Right mate and the Christ is just an old action hero.
songco 8y ago
The framework mark itself as enterprise level Used by many small companies in china, and those companies delivers products to many different customers, include chinese gov/military, and maybe some the middle east customers. So the problem is that: 1. Chinese gov/military don't allow celebration of Christmas in their office.(CCP members not allowed to have religious belief) 2. It's a critical thing for some customers like The Middle east 3. If it's a hidden Easter Egg hard to trigger, it's ok; but it's not.
- songco 8y ago
  Comments from the dev of the Easter Egg: 1. He commented it's a small thing, don't need to include in changelog. So nearly all users don't known this 2. Another his comment: "I have already prepared for the complains"
alangpierce 8y ago
I wonder if it's reasonable in the long run for third-party libraries to run under a restricted permissions model with explicitly-granted capabilities. Just like how it's unreasonable to expect an end-user to audit the code of a phone app they install, it seems almost as unreasonable for a developer to need to audit the code of every third-party library they use. For example, if a library can't access the clock, then it wouldn't be able to implement this sort of "time bomb" behavior. You could also of course limit cookies, XHRs, etc. Certainly a bit hard to know how it would work from a technical standpoint, but I think if done well it would make diligence a lot more manageable.
- Something1234 8y ago
  I really like this idea. Although permissions will have to become a lot more granular. There may be a little bit of call overhead, but this kind of context level permissions would be amazing.
stickfigure 8y ago
I actually use Ant in my product. I had no idea this would happen. And I think this is... pretty awesome? The world needs more random amusing-but-not-damaging surprises like this. To the Ant team: I'm impressed.
- crooked-v 8y ago
  > amusing-but-not-damaging Some people got fired because they used this library in sites and this happened.
seabird 8y ago
I don't know what possesses people to implement moronic surprises like this in software that people use to actually get things done. I remember just about shitting my pants when trying to boot a computer using Super GRUB Disk on April 1st and getting a prompt claiming that my hard drive was being formatted [1], or something along those lines. After wasting over a day with a non-booting machine verifying that I didn't catch something, I did some Googling and found out what my issue was. It is this exact kind of stupid bullshit that convinces people that open-source software is a joke that can't be taken seriously, and in some cases (such as this one), they're right. [1] https://www.supergrubdisk.org/2012/04/02/happy-2012-april-fools-day/ https://www.supergrubdisk.org/2012/04/02/happy-2012-april-fo...
- franciscop 8y ago
  Fun (autonomy + mastery + purpose)! Don't forget that most OSS is still developed for fun, and adding things like this are totally fine in that context. Now, if you want to use thousands (millions?) of hours of development from hundreds of developers for free, you might have to put up with them having a bit of fun. The alternatives are to pay them to make very serious software [tm], use proprietary software or review the code yourself (not viable most times). And I'm not being ironic or anything, really, literally the thing pushing a LOT of OSS is doing it for fun. If people keep complaining and blaming those OSS devs and it stops being fun then they will stop doing OSS, as many have done. Or it will be delegated to big companies like FB, Google, etc. where they get paid for the OSS they make, which is a whooole different can of worms. (there is a thread saying something about a political stance, but I'm not qualified to have an opinion there and most easter eggs are for fun anyway)
  - smel 8y ago
    Even if I'm pissed off with this particular incident since I was working on a project using this great library and I was scared by the little snowy button :) ... but I agree with you those people are doing it for fun. I used too but lost interrest in working for free. A lot of companies are making a ton of money using (among many others) my OSS project. Even my current employer (big if not biggest European software vendor) is using it on a major product they're selling for millions the funny thing is that they don't even know and prohabiting employees to work on open source even in their own free time. This particular experience make me understand that working for free on open source is really a foolish idea. I was tempted by changing the license but since there are many others using it to build their business I thought it's better to just keep it as it is by respect to early adopters and users which any project is nothing without them. For a healthy open source project the work needed it's not fun at least for me, it's not just about hacking/problem solving/design, you need actually to do issues triage, answer questions, documentation, extensive testing (with whole infrastructure for builds/releases/communication) those are not fun activities and in most cases done better than paid softwares (because people are passionate about their projects) and in addition to that I need to work fulltime on different (shitty) things to pay the bills and have time for familly ...
marcus_holmes 8y ago
Another reminder that dependencies are bad. Introducing someone else's code into your production environment without auditing it is a security breach. This "undocumented code change" could easily have grabbed any login details/session cookies/personal data from the page and sent them somewhere, instead of drawing snowflakes. I doubt anyone would have noticed for a while... clearly there were a large number of people who weren't auditing the latest version of the code to see what changed, and only noticed the change because of the visual effects. Sorry, but if you deploy a random chunk of third-party code into your production environment without knowing exactly what it does, you deserve to be sacked.
- cyphar 8y ago
  > Sorry, but if you deploy a random chunk of third-party code into your production environment without knowing exactly what it does, you deserve to be sacked. Have you reviewed all of Linux, glibc, nginx/Apache, bash, all several thousand node dependencies, and so on? Do you do such a review each time you have to update a package? Don't get me wrong, I think there's a serious problem with the micro-dependency insanity, but every single person on the planet depends on others. "We stand on the shoulders of giants" is more of a truism today than it has ever been. It's not a sacking offense to trust people (because you wouldn't be able to do your job if you spent all of it reviewing other people's work). Most people have a reasonable expectation that maintainers of a project are reasonable people -- which is why the micro-package insanity is particularly problematic. I trust most kernel maintainers and so I don't check each Linux release to see whether a backdoor was added (I only check if I've noticed a problem). The blame should be on the maintainers here -- it isn't acceptable to add Easter eggs like this to a library used by many people (especially if it's being used for Serious Business™). Would you blame every glibc user (which is all Linux users) if they decided to make all math functions return 25 on Christmas? Of course you wouldn't -- you'd blame the maintainers for having lost their minds.
  - marcus_holmes 8y ago
    I do deliberately try to limit what goes into my production machines, yes. I choose to trust some things, carefully, and choose not to trust others. No, I can't review everything out there. But technically, I should. And if it goes wrong and there's a problem with some code that I put on the production machine, then that's my problem. I don't really understand why we have "reasonable expectations that maintainers of a project are reasonable people". We absolutely know for a fact that a not-insignificant percentage of our users are malicious. Why do we assume that zero percent of package maintainers are malicious? The only qualification someone has to be a maintainer is to have written something that someone else wants to use, and to publish that thing on a package repository. Or that they volunteered to take over maintenance of a thing that other people want to use. There's nothing in there about not being malicious. And yes, I would absolutely blame every glibc user for trusting the glibc maintainers. Glibc is a gift. I don't have any contract with the maintainers of glibc that says they have to act in my interests. I choose to use their work because it saves me time. If that stops being the case, I'll find an alternative (together with everyone else), or roll back to the last known good version of their work that they let me use. If the glibc maintainers really want to make it Christmas Day every day, then that is entirely their right. I do not have the right to demand anything from them or their code. I don't have to use their code, and they don't have to take my needs into consideration when writing it.
ngcc_hk 8y ago
Why not have a bit Christmas spirit and why not allow a bit Christmas message is the real question.
jlg23 8y ago
I call that Darwinism at work: The author of this surprise disqualified itself for any job that requires trust or at least a minimum of cultural sensitivity [1]; the users of this disqualified themselves from any work that requires attention to detail (like actually reading the code of libraries used or at least checking the issue tracker). [1] I live in a country that is 97% Muslims. For most here, Christmas means at most the beginning of "white, European tourist season". My SO thought until 2 days ago that Europeans simply have a week long warmup to the new year celebrations...
qwerty456127 8y ago
> The timing is sensitive and unfortunate as local governments in China are cracking down Christmas celebrations. I'd say this is the perfect time then. Governments cracking down Christmas celebrations should be fought back and ridiculed.

143 points by druml 8y ago

tzh 8y ago

Interesting question: should organised projects, tech or otherwise, cater to the cultural intricacies of third world countries?

crooked-v 8y ago
I know the US and various western European countries have been having all kinds of trouble lately, but I don't think they're "third world" quite yet.
- jmvoodoo 8y ago
  US, Western EU countries, and even China are by definition not third world.
  - crooked-v 8y ago
    You missed the point of the joke.
- seniorsassycat 8y ago
  First and third world country refers to cold war alegiences not development status, the first world is The US and it's allies, second world is USSR and it's allies, and the rest of countries are third world.
  - crooked-v 8y ago
    You missed the point of the joke.
delinka 8y ago
To answer your question: if you want your project used by others, it's best not to rock the boat. Which leads me to ask why anyone would muck about with something that could affect other projects' production code? My response to this little fiasco: why is anyone relying on externally-hosted, malleable code in a production environment? Run a repo, package it with your app ... whatever it takes to have a stable release.
- crooked-v 8y ago
  It sounds from the description like this "feature" was added in an earlier version, not something literally released on Christmas.
  - c22 8y ago
    The point still stands. If open source code is vital to your business you should probably at the very least audit it.
    - mp3k 8y ago
      Good advice. Funny thing is, from May I'm working on a big project, where we use ant extensively. We pushed the limits of almost all the available components, found several issues, enhanced it in our custom wrappers. In that time, I was going through the sources of components several times, not only of the ant itself but also through sources of react-components on which the ant is built. YET I HAVEN'T EVER INSPECTED THE BUTTON COMPONENT. Would be super funny if I would have found that christmas egg this summer... Now as I'm thinking about it, we have EnhancedButton, which gets 'block' boolean prop to make it full-width. I was used to that from react-bootstrap and even had the idea to open feature request on antd... In that case I would certainly open the button.tsx... Anyway, great episode in the frontend world.
    - aaron695 8y ago
      Do you audit Linux if you use it? Why only audit open source? Part of the whole reason of open source is trust. At what point does an audit cost more than doing it yourself? Then do you need to audit the audit since you have no trust? Can't we not pass the buck in a just world situation and blame the user and instead encourage open source not to mess with the codebase.
- mp3k 8y ago
  The code was there for months, there was just time trigger for 25th of Dec. I'm loving ant, but this was stupid. At least it's free advertising so the project's user base can grow.
ars 8y ago
Obviously they should try. And since when is not wanting a Christian holiday displayed on your site a third world country thing?
- monochromatic 8y ago
  Why is that obvious?
jdietrich 8y ago
"Third world" is a nonsense term that gives a completely misleading picture of global wealth distribution and helps to perpetuate negative stereotypes [0]. China's PPP GDP per capita is almost exactly the global average and higher than many Eastern European countries. They are practically the definition of a middle-income country. How would American companies react if their website suddenly started showing messages celebrating Eid al-Fitr for no apparent reason? Would you expect them to blithely laugh it off as harmless festive high-jinks? [0] https://www.gapminder.org/videos/hans-rosling-ted-2006-debunking-myths-about-the-third-world/ https://www.gapminder.org/videos/hans-rosling-ted-2006-debun...
- tzh 8y ago
  Nobody who celebrates Eid al-Fitr makes any useful contribution to mankind, so that situation you mention is unlikely to ever happen.
deleted 8y ago
[deleted]
PhasmaFelis 8y ago
"Third-world countries" is both inaccurate and misses the point. A much better question is, should we cater to autocracies trying to suppress their citizens' religious freedom? I'd say the answer is no, whether it's China, the actual third world, or the USA or Europe. https://www.theguardian.com/world/2018/dec/24/china-cracks-down-on-christmas-celebrations https://www.theguardian.com/world/2018/dec/24/china-cracks-d...

crooked-v 8y ago

Well, there goes any chance of me ever using this project.

matte_black 8y ago
Unfortunately there’s not many sensible alternatives for what Ant design does.
- druml 8y ago
  What do you think about Semantic-UI?
- ng12 8y ago
  What does Ant give you that Material-UI, Kendo, or Blueprint don't?
  - matte_black 8y ago
    A complete set of useful and practical components for enterprise applications. Have you used Ant??
    - ng12 8y ago
      There are many such frameworks including the three I mentioned. I haven't used Ant, but I've looked at it and didn't find a compelling reason to use it over the others.
monochromatic 8y ago
How awful for Ant.

CJefferson 8y ago

I am increasingly of the opinion that free open source software should include fun things like this. It is an easy way to remind people just what "free, but with no warranty" means.

crooked-v 8y ago
That sounds like an excellent way to get people to stop using any new open source software.
- CJefferson 8y ago
  Well, if they don't want me to have any fun, they can pay me.
  - crooked-v 8y ago
    If you want to make proprietary software, make proprietary software. Don't make open source software and intentionally put traps in it.
    - CJefferson 8y ago
      Your message has really annoyed me, I just wanted to say that. I found the tone quite upsetting, although I hope it's just because our only communication is through this brief chat, and we don't really know each other. I've never made proprietary software. I've written hundreds of thousands of lines of open source code in dozens of projects. I make releases of those projects, answer bug reports and issues, review PRs, all for free. Often I get annoying demanding emails for support for something I give away for free, which is quite annoying, but I usually answer anyway unless the sender is really annoying. In a couple of them, there are features which are the because they amused me when I wrote them. Nothing that would lead to a wrong answer. Maybe if someone wants to base their business on my free labor, they have to put up with that.
      - lox 8y ago

EamonnMR 8y ago

Pipenv did this for Halloween. https://github.com/pypa/pipenv/issues/786 https://github.com/pypa/pipenv/issues/786

xkcd-sucks 8y ago
Yeah but everyone already knows pipenv is buggy as yesterday's turds

mac_was 8y ago

Seems to me that they’ve lost credibility by injecting these sort of ‘joke’ into open-source software used in prod in many companies. How would I use it for a new project now?

zorpner 8y ago

This is a long-standing feature of VLC which I enjoy (the santa hat on the icon), but is similarly not enjoyed by everyone: https://forum.videolan.org/viewtopic.php?t=96539 https://forum.videolan.org/viewtopic.php?t=96539 My opinion about people who demand professional perfection from software they neither pay for nor can be bothered to review the source of are probably well-indicated by the tone of this sentence.

saghm 8y ago
I think there's a difference between putting a cosmetic thing like this in an application rather than a library; if you put it in your application, you're not going to change the experience of anything other than your own product, but by putting it in a library, you're changing the experience of other people's applications. From reading other comments here though, it seems like this isn't a universal opinion though.
- djsumdog 8y ago
  Yea, and VLC is really just a media player. Sure someone might be using it in production at a Kiosk, but that little icon change literally doesn't affect production use at all.

mp3k 8y ago

The event was certainly interesting enough so it was worth to setup a new jekyll blog, right?

deleted 8y ago

[deleted]

molszanski 8y ago

They could've at least limited it to a DEV environment or a whitelist of Ant Project related domains. I hope they've learned the lesson.

DoreenMichele 8y ago

I have really mixed feelings about this. To my mind, the larger outrage is that people were fired over this. I'm aware of the tendency to try to focus on what it seems like we can control rather than on actual justice. In this case, I'm so far only seeing outrage about the Easter Egg. I'm not seeing outrage about "They fired people over this???!!! People whose only crime was using Ant??!" I'm not a fan of what Christmas has mostly turned into these days. I'm ambivalent about leaving a remark that could easily be wildly misinterpreted as supporting and encouraging cultural insensitivity by Americans/Westerners. Anyway, I may seriously regret commenting at all. This seems like a can of worms for various reasons. I just dislike the idea of standing idly by while the developers get lambasted, as if they should have known ahead of time that people would be fired over this because of stuff happening in China. I'm also leery of the possibility that the other answer will be to ignore the seriousness of the situation for some people and act like "not my problem." So there's my 2 cents.

nomel 8y ago
Imagine working for the state. Your non technical boss comes in and asked why you have a holiday theme on the page when policy is to not show celebration on state websites. He asks you why you put this code in. You tell him you didn’t write the code. He asks who did. You tell him it’s open source, many people contributed and someone put this in without telling anyone. At this point, you’ve lost all credibility to you non technical boss and all of his non technical execs. You put a strangers code on the state run website, without reviewing it and without knowing what’s in it.
- DoreenMichele 8y ago
  I worked for a corporation for a few years. We had strict rules about not downloading anything to our work computer because they did an internal study and found that 98% of all malware came from employees downloading music apps and that sort of thing. So they forbade it all wholesale. Breaking that rule could get you in trouble, up to and including being fired for it. So, sure, it's possible that in some cases people were fired because this Easter Egg outed them for violating some rule. And it's entirely possible that some of the cases of "I got fired for this" are that kind of scenario. But if this is not against the rules and the firing is actually because it is Christmas-themed, that's a different situation. I'm also aware that it could be a cultural thing where someone has to be the fall guy and heads will roll to prove our innocence. I see that as deeply problematic. If you didn't forbid open source, firing someone for using it as the "first offense" penalty is not a good policy. I realize we likely have very little information at this point in time about the details behind the firings and it is the norm for early reports to be wildly misconstrued, which is one of the reasons saying anything at all here is potentially something I will regret.

anigbrowl 8y ago

For those outside the USA, I regret to inform you there is no such thing as a 'Christmas egg' and no Christmas traditions involving eggs. May I suggest you calling it a Christmas cracker?

ng12 8y ago
I think it's a pun on easter egg.
- kwhitefoot 8y ago
  True, but it is feeble and misleading. Software Easter eggs have to be searched for but this one seems to be just there.
jeklj 8y ago
Traditions always start somewhere!
bdcravens 8y ago
What is a Christmas cracker?
- code_duck 8y ago
  Ah, the rich, storied tradition of the Christmas Cracker.
- roryokane 8y ago
  https://en.wikipedia.org/wiki/Christmas_cracker https://en.wikipedia.org/wiki/Christmas_cracker “Christmas crackers are festive gifts that make a snapping sound when opened.” For example, a Christmas cracker could contain a paper with jokes on it, a paper crown, and a puzzle where you have to disconnect two linked ring-like metal pieces.
soyyo 8y ago
>For those outside the USA USA did not invent Christmas, even if you are right with your statement about 'Christmas eggs', I don't see the point of remarking that you are American as if that will make you some sort of Christmas authority.

zenexer 8y ago

Is it known whether this was a deliberate political statement in response to recent events in China, or just a festive holiday joke intended to be harmless? Given the current state of affairs in China, I’m inclined to believe this was political. If that’s true, many of the other comments here debating the need for professionalism in FOSS may be missing the point. It could be argued that this fits into the same category as the malicious hijacking of libraries on NPM, although I agree with the political statement being made here. A more appropriate debate may be whether it’s acceptable for FOSS libraries to protest human and civil rights violations.

karmasimida 8y ago
> just a festive holiday joke intended to be harmless Christmas in China is just a shopping holiday for the most. And no reason to make things this complicated, the author has already stated that all this is intended to be an easter egg.
- Stratoscope 8y ago
  > all this is intended to be an easter egg. An easter egg that they put on other people's sites without their knowledge or consent. The correct word for this is malware.
Ahmed90 8y ago
Protest all you want, but use your own productions, not others, can you tell me what would be your feeling getting a call on holidays from an angry client or a manager who might not even be celebrating Christmas? Chinese politics? alright fair enough... but what if some of these companies got punished because of it? or lost business? I'm Arabic, can you imagine the shit a dev will get because of this if he/she used Ant for a political figure or party website? imagine a non-christian religious organization finds their site publically celebrating Christmas? at the end of the day, politics or not the only person that will get all the shit dumped on their head is the poor developer who trusted your product and took you as a responsible person with all the 39k GitHub stars and 692 contributors... if I can't trust that to be mature then eh... good luck reshaping the world with FOSS. Good luck explaining dependencies to the client/manager and how "someone from outside the company can modify our precious little website" and how can you prevent that in the future lol...

conanthe 8y ago

What reaction someone expected by shoving their religion down the throat of the users? This is so sad.

PhasmaFelis 8y ago
Snow and "ho ho ho" is hardly a religious statement. If anything, this is the capitalistic "buy lots and lots of presents" version of Christmas, not the religious version.
- monsieurbanana 8y ago
  They are one and the same.
  - PhasmaFelis 8y ago
    They overlap a lot in the West especially, but they're very different phenomena. Look at Japan, where Christmas is hugely popular, Jesus is nowhere to be seen, and a poll of schoolchildren a few years back showed that most of them thought the holiday was about celebrating the birth of Santa Claus.
- conanthe 8y ago
  Right mate and the Christ is just an old action hero.

songco 8y ago

The framework mark itself as enterprise level Used by many small companies in china, and those companies delivers products to many different customers, include chinese gov/military, and maybe some the middle east customers. So the problem is that: 1. Chinese gov/military don't allow celebration of Christmas in their office.(CCP members not allowed to have religious belief) 2. It's a critical thing for some customers like The Middle east 3. If it's a hidden Easter Egg hard to trigger, it's ok; but it's not.

songco 8y ago
Comments from the dev of the Easter Egg: 1. He commented it's a small thing, don't need to include in changelog. So nearly all users don't known this 2. Another his comment: "I have already prepared for the complains"

alangpierce 8y ago

I wonder if it's reasonable in the long run for third-party libraries to run under a restricted permissions model with explicitly-granted capabilities. Just like how it's unreasonable to expect an end-user to audit the code of a phone app they install, it seems almost as unreasonable for a developer to need to audit the code of every third-party library they use. For example, if a library can't access the clock, then it wouldn't be able to implement this sort of "time bomb" behavior. You could also of course limit cookies, XHRs, etc. Certainly a bit hard to know how it would work from a technical standpoint, but I think if done well it would make diligence a lot more manageable.

Something1234 8y ago
I really like this idea. Although permissions will have to become a lot more granular. There may be a little bit of call overhead, but this kind of context level permissions would be amazing.

stickfigure 8y ago

I actually use Ant in my product. I had no idea this would happen. And I think this is... pretty awesome? The world needs more random amusing-but-not-damaging surprises like this. To the Ant team: I'm impressed.

crooked-v 8y ago
> amusing-but-not-damaging Some people got fired because they used this library in sites and this happened.

seabird 8y ago

I don't know what possesses people to implement moronic surprises like this in software that people use to actually get things done. I remember just about shitting my pants when trying to boot a computer using Super GRUB Disk on April 1st and getting a prompt claiming that my hard drive was being formatted [1], or something along those lines. After wasting over a day with a non-booting machine verifying that I didn't catch something, I did some Googling and found out what my issue was. It is this exact kind of stupid bullshit that convinces people that open-source software is a joke that can't be taken seriously, and in some cases (such as this one), they're right. [1] https://www.supergrubdisk.org/2012/04/02/happy-2012-april-fools-day/ https://www.supergrubdisk.org/2012/04/02/happy-2012-april-fo...

franciscop 8y ago
Fun (autonomy + mastery + purpose)! Don't forget that most OSS is still developed for fun, and adding things like this are totally fine in that context. Now, if you want to use thousands (millions?) of hours of development from hundreds of developers for free, you might have to put up with them having a bit of fun. The alternatives are to pay them to make very serious software [tm], use proprietary software or review the code yourself (not viable most times). And I'm not being ironic or anything, really, literally the thing pushing a LOT of OSS is doing it for fun. If people keep complaining and blaming those OSS devs and it stops being fun then they will stop doing OSS, as many have done. Or it will be delegated to big companies like FB, Google, etc. where they get paid for the OSS they make, which is a whooole different can of worms. (there is a thread saying something about a political stance, but I'm not qualified to have an opinion there and most easter eggs are for fun anyway)
- smel 8y ago
  Even if I'm pissed off with this particular incident since I was working on a project using this great library and I was scared by the little snowy button :) ... but I agree with you those people are doing it for fun. I used too but lost interrest in working for free. A lot of companies are making a ton of money using (among many others) my OSS project. Even my current employer (big if not biggest European software vendor) is using it on a major product they're selling for millions the funny thing is that they don't even know and prohabiting employees to work on open source even in their own free time. This particular experience make me understand that working for free on open source is really a foolish idea. I was tempted by changing the license but since there are many others using it to build their business I thought it's better to just keep it as it is by respect to early adopters and users which any project is nothing without them. For a healthy open source project the work needed it's not fun at least for me, it's not just about hacking/problem solving/design, you need actually to do issues triage, answer questions, documentation, extensive testing (with whole infrastructure for builds/releases/communication) those are not fun activities and in most cases done better than paid softwares (because people are passionate about their projects) and in addition to that I need to work fulltime on different (shitty) things to pay the bills and have time for familly ...

marcus_holmes 8y ago

Another reminder that dependencies are bad. Introducing someone else's code into your production environment without auditing it is a security breach. This "undocumented code change" could easily have grabbed any login details/session cookies/personal data from the page and sent them somewhere, instead of drawing snowflakes. I doubt anyone would have noticed for a while... clearly there were a large number of people who weren't auditing the latest version of the code to see what changed, and only noticed the change because of the visual effects. Sorry, but if you deploy a random chunk of third-party code into your production environment without knowing exactly what it does, you deserve to be sacked.

cyphar 8y ago
> Sorry, but if you deploy a random chunk of third-party code into your production environment without knowing exactly what it does, you deserve to be sacked. Have you reviewed all of Linux, glibc, nginx/Apache, bash, all several thousand node dependencies, and so on? Do you do such a review each time you have to update a package? Don't get me wrong, I think there's a serious problem with the micro-dependency insanity, but every single person on the planet depends on others. "We stand on the shoulders of giants" is more of a truism today than it has ever been. It's not a sacking offense to trust people (because you wouldn't be able to do your job if you spent all of it reviewing other people's work). Most people have a reasonable expectation that maintainers of a project are reasonable people -- which is why the micro-package insanity is particularly problematic. I trust most kernel maintainers and so I don't check each Linux release to see whether a backdoor was added (I only check if I've noticed a problem). The blame should be on the maintainers here -- it isn't acceptable to add Easter eggs like this to a library used by many people (especially if it's being used for Serious Business™). Would you blame every glibc user (which is all Linux users) if they decided to make all math functions return 25 on Christmas? Of course you wouldn't -- you'd blame the maintainers for having lost their minds.
- marcus_holmes 8y ago
  I do deliberately try to limit what goes into my production machines, yes. I choose to trust some things, carefully, and choose not to trust others. No, I can't review everything out there. But technically, I should. And if it goes wrong and there's a problem with some code that I put on the production machine, then that's my problem. I don't really understand why we have "reasonable expectations that maintainers of a project are reasonable people". We absolutely know for a fact that a not-insignificant percentage of our users are malicious. Why do we assume that zero percent of package maintainers are malicious? The only qualification someone has to be a maintainer is to have written something that someone else wants to use, and to publish that thing on a package repository. Or that they volunteered to take over maintenance of a thing that other people want to use. There's nothing in there about not being malicious. And yes, I would absolutely blame every glibc user for trusting the glibc maintainers. Glibc is a gift. I don't have any contract with the maintainers of glibc that says they have to act in my interests. I choose to use their work because it saves me time. If that stops being the case, I'll find an alternative (together with everyone else), or roll back to the last known good version of their work that they let me use. If the glibc maintainers really want to make it Christmas Day every day, then that is entirely their right. I do not have the right to demand anything from them or their code. I don't have to use their code, and they don't have to take my needs into consideration when writing it.

ngcc_hk 8y ago

Why not have a bit Christmas spirit and why not allow a bit Christmas message is the real question.

jlg23 8y ago

I call that Darwinism at work: The author of this surprise disqualified itself for any job that requires trust or at least a minimum of cultural sensitivity [1]; the users of this disqualified themselves from any work that requires attention to detail (like actually reading the code of libraries used or at least checking the issue tracker). [1] I live in a country that is 97% Muslims. For most here, Christmas means at most the beginning of "white, European tourist season". My SO thought until 2 days ago that Europeans simply have a week long warmup to the new year celebrations...

qwerty456127 8y ago

> The timing is sensitive and unfortunate as local governments in China are cracking down Christmas celebrations. I'd say this is the perfect time then. Governments cracking down Christmas celebrations should be fought back and ridiculed.