Instead of providing a mirrored repository, they decided to intentionally not fixing the correctly identified problem while simultaneously still living 30 years in the past.
Setting up a git mirror that auto syncs takes less than 2mins of effort. And way less time than writing up this README that's just there to lecture people. If it's about disagreement with github, there's also better alternatives.
You can still setup the mirror and be done with it, and put the original repo links at the top in the README.
It's obvious that the author wants to make a statement, and has their own reason to not expose their work on GitHub. Setting up a mirror would probably contradict these reasons.
The upstream has no public repository, neither on GitHub nor anywhere else.
JWZ might not even use git in the first place, the source might be in a local SVN repo, or just a series of tarballs and patches, assuming it is version controlled at all.
I didn't criticize the motivations to ditch GitHub. I applaud that.
I criticized the intentional creation of a GitHub account just to write a README file wherein they say that there's no repository, instead of providing any useful information for people looking for a repository.
If there's no repository and you go to such great lengths just to clarify that there isn't any, then maybe you can just push your code to codeberg or gitlab or a selfhosted gogs instance if you don't trust them?
Nobody said that he MUST accept pull requests or MUST engage with any community at all. You can just disable all the features, I do that too since 4chan raided my repos in 2021 and GitHub didn't do shit about it.
But this way at least there's no risk for people installing malware infiltrated forks of xscreensaver on their machines. And that's what is the important part that wasn't actually solved/avoided/prevented with that README file.
The page provides useful information. It tells you where you can download the XScreenSaver source code (from https://www.jwz.org/xscreensaver/), and how you can send patches (via email)
It doesn't need to provide anything else. Nobody is required to sign up to your preferred platform, or make their work available in a way you prefer to consume it. Get over yourself. If you want to contribute, contribute as requested. Or don't, the license allows you to host your own version, just be clear it's your version.
JWZ went to great lengths on github.com, solely because some other shitheel registered the "xscreensaver" organisation and went out of their way to make it seem like it's official, and github.com's google juice means it outranks the real site. Hence the need for the effort to solve that problem (reputation management and SEO after a copycat misrepresents themselves as you)
Putting a repo on Github, versus putting a notice on Github that there's no repo, does not change the risk of people installing malware. While someone else still has the top ranked page for your software, they remain the most likely place a moron in a hurry[0] will download from. You adding a repo doesn't help, you getting their repo removed, and salting it to prevent recreation, does help.
Having spent (way too much) time on HN, I have come to realize that there are people in this industry -- in fact quite a few of them -- who cares nothing about being nice/cooperative/helpful/pragmatic and getting things done, but just want to show off their ego/opinion and make a statement.
Many names come to mind but I am too scared to post that list.
> Why do you presume he uses git, though? He might, but he may as well use cvs or sccs or just a set of dated folders named “…-final2(7)”.
He might also still be using SunOS or HP/UX or maybe even 386BSD.
But is that likely? Not being pwned/hacked for 25+ years while still using the same old OS? On the internet that changed quite a bit since HTTP/0.9? While using the GitHub website with TLS and HTML5 and JS requirements to register an account which doesn't run in such an outdated browser?
I think your assumptions about statistical likeliness are a bit off.
I'm not sure if you know who jwz is, because I wouldn't put any of those in the realm of impossibility.
But I think it's plausible that he might not've migrated his ancient codebase (not meant as a pejorative, but just factually) to broadly multiuser tooling. If he's maintaining the project locally, I can imagine him having spun up a svn repo way back when and not moving past it. While I love git, it might not have a lot of advantages for his specific use case.
I am pretty sure the distro packagers all know where to get the real code from, and its packaged for everything that runs X so minimal risk.
Also assuming something on github is the official repo is dangerous anyway. There might be multiple repos with the same name, there might be a more actively developed fork and the official one might be unmaintained, etc.
Because I do not think making github a way of verifying things is a good idea. It encourages people to assume that whatever they find on github is safe.
As for "happens every day". How often, really? JWZ says "I strongly recommend that you install a binary package rather than compiling it yourself." I would guess very few end users compile xscreensaver themselves.
Warning: it persists somehow, so you can't click on a link from HN, realise the problem, then copy+paste to correct it. Looks like you need to open an incognito window, use a different browser, or maybe otherwise clear your session.
Jeff Merkey is the person claiming the "xscreensaver" organisation on GitHub, despite it not being, and never has been, his project.
He has promised to drop that and move the repo to /hisname/xscreensaver, but only if JWZ flatters his ego first. Sounds like he knows he's squatting on someone else's good name, but thinks he's so clever and well versed in trademark law that he'd be deliberately antagonistic all the way to the end of a huge legal bill. Just to force him to do the right thing.
He knows what the right thing is and could do it at any time, but just look at his priors and tell me he'll do that:
When looking into screensavers on Wayland I stumbled across his articles and found them interesting enough to subscribe to his RSS feed, only to unsubscribe a day later after finding out he's an insufferable egomaniac (who treats his RSS feed as Twitter)
another con is that you have to agree to the ToS etc. of GitHub, which might be a con depending on how pedantic you want to be about your software license.
> It's worth noting that the phrase "It's fine. You'll get over it." is doing an enormous amount of emotional heavy lifting. It's not dismissive — it's pre-emptive closure. It anticipates your grief and resolves it in seven words.
This is amazing, pretty much every single thing I hate with all the AI-generated documentation nowadays, all in one repo! And conveniently organized across >20 separate files haha
altairprime | 12 hours ago
cookiengineer | 12 hours ago
Setting up a git mirror that auto syncs takes less than 2mins of effort. And way less time than writing up this README that's just there to lecture people. If it's about disagreement with github, there's also better alternatives.
You can still setup the mirror and be done with it, and put the original repo links at the top in the README.
messe | 12 hours ago
Feel free.
pil0u | 12 hours ago
amiga386 | 10 hours ago
Microsoft destroyed his company via illegal means.
Microsoft own GitHub.
https://en.wikipedia.org/wiki/United_States_v._Microsoft_Cor....
https://en.wikipedia.org/wiki/Browser_wars
angry_octet | 9 hours ago
[OP] st_goliath | 11 hours ago
JWZ might not even use git in the first place, the source might be in a local SVN repo, or just a series of tarballs and patches, assuming it is version controlled at all.
cookiengineer | 9 hours ago
I criticized the intentional creation of a GitHub account just to write a README file wherein they say that there's no repository, instead of providing any useful information for people looking for a repository.
If there's no repository and you go to such great lengths just to clarify that there isn't any, then maybe you can just push your code to codeberg or gitlab or a selfhosted gogs instance if you don't trust them?
Nobody said that he MUST accept pull requests or MUST engage with any community at all. You can just disable all the features, I do that too since 4chan raided my repos in 2021 and GitHub didn't do shit about it.
But this way at least there's no risk for people installing malware infiltrated forks of xscreensaver on their machines. And that's what is the important part that wasn't actually solved/avoided/prevented with that README file.
amiga386 | 9 hours ago
It doesn't need to provide anything else. Nobody is required to sign up to your preferred platform, or make their work available in a way you prefer to consume it. Get over yourself. If you want to contribute, contribute as requested. Or don't, the license allows you to host your own version, just be clear it's your version.
JWZ went to great lengths on github.com, solely because some other shitheel registered the "xscreensaver" organisation and went out of their way to make it seem like it's official, and github.com's google juice means it outranks the real site. Hence the need for the effort to solve that problem (reputation management and SEO after a copycat misrepresents themselves as you)
Putting a repo on Github, versus putting a notice on Github that there's no repo, does not change the risk of people installing malware. While someone else still has the top ranked page for your software, they remain the most likely place a moron in a hurry[0] will download from. You adding a repo doesn't help, you getting their repo removed, and salting it to prevent recreation, does help.
[0]: https://en.wikipedia.org/wiki/A_moron_in_a_hurry
fg137 | 9 hours ago
Many names come to mind but I am too scared to post that list.
antiloper | 11 hours ago
Which problem?
cxr | 11 hours ago
There is no original repo to link to. That's why the README says that there isn't one.
> Setting up a git mirror that auto syncs takes less than 2mins
Prove it.
cookiengineer | 9 hours ago
There's enough demo videos on how to use gogs, github or forgejo on YouTube.
I have faith in your ability to use the YouTube search.
kstrauser | 6 hours ago
cookiengineer | 4 hours ago
He might also still be using SunOS or HP/UX or maybe even 386BSD.
But is that likely? Not being pwned/hacked for 25+ years while still using the same old OS? On the internet that changed quite a bit since HTTP/0.9? While using the GitHub website with TLS and HTML5 and JS requirements to register an account which doesn't run in such an outdated browser?
I think your assumptions about statistical likeliness are a bit off.
kstrauser | 3 hours ago
But I think it's plausible that he might not've migrated his ancient codebase (not meant as a pejorative, but just factually) to broadly multiuser tooling. If he's maintaining the project locally, I can imagine him having spun up a svn repo way back when and not moving past it. While I love git, it might not have a lot of advantages for his specific use case.
mykhamill | 11 hours ago
frizlab | 10 hours ago
sick_of_slop | 11 hours ago
bcvvvy | 10 hours ago
Also centralising everything in one place is a seriously bad idea.
fg137 | 9 hours ago
NoGravitas | 4 hours ago
createful | 12 hours ago
nevon | 11 hours ago
graemep | 9 hours ago
Also assuming something on github is the official repo is dangerous anyway. There might be multiple repos with the same name, there might be a more actively developed fork and the official one might be unmaintained, etc.
dsr_ | 8 hours ago
So... this doesn't hurt, and can definitely help. It isn't perfect, but it cost JWZ very little to do.
Why are you arguing against it?
graemep | 7 hours ago
The code is not there, but the jwz has a github repo saying it is not there: https://github.com/xscreensaver-official/xscreensaver
As for "happens every day". How often, really? JWZ says "I strongly recommend that you install a binary package rather than compiling it yourself." I would guess very few end users compile xscreensaver themselves.
Svip | 10 hours ago
kouosi | 10 hours ago
scbrg | 10 hours ago
lbriner | 10 hours ago
barrkel | 10 hours ago
severak_cz | 9 hours ago
oneeyedpigeon | 9 hours ago
oneeyedpigeon | 9 hours ago
brewmarche | 9 hours ago
jjav | 6 hours ago
NoGravitas | 4 hours ago
Svip | 4 hours ago
fg137 | 9 hours ago
numpad0 | 9 hours ago
amiga386 | 11 hours ago
He has promised to drop that and move the repo to /hisname/xscreensaver, but only if JWZ flatters his ego first. Sounds like he knows he's squatting on someone else's good name, but thinks he's so clever and well versed in trademark law that he'd be deliberately antagonistic all the way to the end of a huge legal bill. Just to force him to do the right thing.
He knows what the right thing is and could do it at any time, but just look at his priors and tell me he'll do that:
https://www.dmlp.org/threats/merkey-v-does
https://en.wikipedia.org/wiki/Wikipedia:Requests_for_arbitra...
rwmj | 10 hours ago
matsemann | 10 hours ago
without seeing eggballs in a cup due to JWZ's ego. So I say there's no winners with two big egos like these.
RobotToaster | 9 hours ago
NoGravitas | 4 hours ago
graemep | 9 hours ago
graynk | 9 hours ago
brewmarche | 8 hours ago
This was linked in the blog
bcvvvy | 11 hours ago
It’s a huge problem. Glad to see he’s at least put a placeholder on there.
ytxm | 10 hours ago
throwfaraway135 | 10 hours ago
* people can find your project easily
* stars are a pretty good indicator of authenticity
* you can browse, search code right away
* a place for people to contact you
cons:
* some maintenance
* people have a place to contact you
mid-kid | 9 hours ago
vanschelven | 9 hours ago
of which he now has 1000... on a non-project!
lionkor | 2 hours ago
metropolis_pt2 | 10 hours ago
angry_octet | 9 hours ago
twiss | 8 hours ago
AI still isn't great at counting, I suppose.
forgotpwd16 | 8 hours ago
radicality | 4 hours ago
TomMasz | 9 hours ago
johnea | 9 hours ago
Github has gone to shit ever since it's purchase by M$