Github Drama ^🌩️

Curated Collection of Notorious GitHub Drama & Controversies
📰 Subscribe for Updates · 🤝 Contribute

---

📑 Table of Contents

• About
• Phylogenetic Tree
• Drama Archive
• See Also
• Contributing

---

🧐 About

github-drama is a curated, community-driven archive of the most dramatic, controversial, and memorable moments in GitHub and open source history. This project aims to document and preserve links to heated discussions, infamous issues, and contentious pull requests for posterity, learning and archival purposes.

⚠️ Purpose: This repository is for educational and historical reference only. It is not intended to harass or target any individual or group.

For contributing guidelines, see CONTRIBUTING.md.

---

🌳 Phylogenetic Tree

• Current Repo: Nick2bad4u/github-drama
• Forked from: neodrama/github-drama
• Forked from: github-drama/github-drama (privatized in Aug 2023)
• Original: nikolas/github-drama

---

🎭 Drama Archive

This is a curated collection of “dramatic” GitHub interactions.

Legcord/Legcord

• Legcord/Legcord/issues/745
  • The project received a cease and desist from ARM LLC, requiring the removal of “Arm” from “ArmCord.” The team announced rebranding efforts to “Legcord” and detailed ongoing and completed tasks for renaming packages and updating distribution channels. The official notice is available here. Issue is closed as completed.

ventoy/Ventoy + ventoy/PXE

• ventoy/Ventoy/issues/2795
  • Issue raised concerns about the presence of prebuilt binary blobs (“BLOBs”) in the source tree, especially after the XZ-Utils incident. The reporter urged a shift to reproducible builds and build-from-source practices. The issue was closed as a duplicate, with extensive discussion (170 comments).
• ventoy/PXE/issues/106
  • Security concerns were raised regarding iVentoy, specifically that it installs unsafe Windows kernel drivers and a self-signed root certificate, potentially exposing users to attacks. The report includes detailed technical analysis and links to VirusTotal results for the identified files. Issue is closed as completed.

actix/actix-web

• actix/actix-web/issues/1289
• fafhrd91/actix-web-postmortem
  • The project’s maintainer, fafhrd91, announcing his departure from the project leadership.
  • Journalistic Media: TheRegister.com

albertodemichelis/squirrel

• albertodemichelis/squirrel/pull/67
  • A pull request to remove a redundant assert(0) statement to fix a GCC6 warning led to a lengthy debate about compiler behavior, code correctness, and whether the assert should remain for safety.

Alex313031/thorium

• Alex313031/thorium/issues/463
• Alex313031/thorium/issues/468
  • Chrome fork with Windows 7 support includes furry porn in chrome:/// pages for whatever reason.

ambv/black

• ambv/black/issues/118
  • A heated debate erupts over Black’s strict formatting rules, with users arguing about code style enforcement and the project’s “opinionated” approach. The thread becomes a battleground for code formatting philosophies.

audacity/audacity

• audacity/audacity/pull/835 (archive: 1)
  • Audacity maintainers propose adding Analytics to the open-source audio editor, sparking immediate backlash from privacy-conscious users.

angular/angular-cli

• angular/angular-cli/issues/1252
  • A long-standing issue where users complain about the CLI’s handling of dependencies and build output.

ansible/ansible

• ansible/ansible/issues/10530
  • Users are surprised by the appearance of “cowsay” ASCII art in Ansible output, enabled by default if the cowsay binary is present.

ant-design/ant-design

• ant-design/ant-design/issues/13098
  • A Christmas-themed easter egg in the UI library triggers a request for a prop to disable it.

ariya/phantomjs

• ariya/phantomjs/issues/15345
  • A new maintainer announces his suspension of PhantomJS development.

aspnet/Home

• aspnet/Home/issues/2022
  • ASP.NET Core 2.0 packages dropped support for .NET Desktop.

atom/tree-view

• atom/tree-view/pull/804
  • A pull request aimed to restore single-click file opening in Atom’s tree view.

atom-minimap/minimap

• atom-minimap/minimap/issues/588 (archive: 1, 2)
  • Atom Minimap package integrated Kite, an AI-powered coding assistant.

AUTOMATIC1111/stable-diffusion-webui

• AUTOMATIC1111/stable-diffusion-webui/issues/6359 (archive.vn) (archive.org)
  • ⚠️ Sensitive Topic

ayojs/ayo

• ayojs/ayo/issues/36 (archive: 1, 2)
  • Ayo.js forked from Node.js due to accusations of numerous violations of the Code of Conduct of Node.js.

badges/shields

• badges/shields/pull/9474
  • A new contributor attempted to add a Bazel logo to Shields.io.

bitwarden/clients

• bitwarden/clients/issues/11611
  • Bitwarden’s desktop version 2024.10.0 introduced a proprietary SDK, making it impossible to build the client without it.

bower/bower

• bower/bower/issues/1102
  • Bower’s first-run prompt asking for anonymous usage reporting disrupted automated workflows.
• bower/bower/pull/1748
  • Bower’s LockFile feature was proposed, aiming to introduce dependency locking.

causiq/logary

• causiq/logary/issues/345
  • Logary introduced a licensing model that required commercial IIS/Kestrel users to pay fees, sparking debate over fairness and F# ecosystem support.

chrisaljoudi/uBlock

• chrisaljoudi/uBlock/pull/1517
  • A contributor accused the maintainer of soliciting donations for work done by others.
• chrisaljoudi/uBlock/issues/1153
  • Ownership of the repository was transferred to the another user, causing confusion.

CleverRaven/Cataclysm-DDA

• CleverRaven/Cataclysm-DDA/pull/51079
  • ⚠️ Sensitive Topic

cloudflare/wildebeest

• cloudflare/wildebeest/issues/303 (archive: 1, 2, 3, 4)
  • Cloudflare’s embrace-and-extend Fediverse software posts private messages to the local public timeline. Cloudflare maintainers have flagged several comments that go into technical detail about the bug as spam.

crablang/crab

• crablang/crab/issues/14
  • User opens an issue calling the project pointless.

daeuniverse/dae

• daeuniverse/dae/issues/368
  • Journalistic Media: Y Combinator
  • Project maintainers made a bot that automatically closes reported issues if the issuer didn’t star the repo.

deepseek-ai/DeepSeek-LLM

• deepseek-ai/DeepSeek-LLM/issues/51
  • A User brought up the alleged pro-China political bias of the LLM, causing a flamewar in the comments.

dear-github/dear-github

• dear-github/dear-github/issues/107
  • ⚠️ Sensitive Topic

Delgan/loguru

• Delgan/loguru/issues/563
  • Loguru’s use of pickle for exception serialization was flagged as a security risk by a user’s company.

django/django

• django/django/pull/2692
  • Django replaced occurrences of master/slave terminology with leader/follower.

docker/docker

• docker/docker/pull/31075

  • Docker switched to a YY.MM versioning scheme, sparking debate over semantic versioning and release cadence.

• docker/docker.github.io/issues/6910

  • Docker required users to log in to download Docker CE.

docker/for-mac

• docker/for-mac/issues/1120
  • Docker users requested the ability to download old releases, citing issues with newer versions and the lack of an official archive.

doktornotor/pfsense-still-closedsource

• doktornotor/pfsense-still-closedsource
  • A repository was created to document claims that pfSense falsely advertises itself as open-source, arguing that key components are not publicly available.

dominictarr/event-stream

• dominictarr/event-stream/issues/116 (archive: 1, 2, 3)
  • Malicious owner takeover of npm package (@right9ctrl) causes cryptocurrency related problems.

dotnet/cli

• dotnet/cli/issues/3093
  • .NET Core’s telemetry feature was criticized for being enabled by default.

dotnet/csharplang

• dotnet/csharplang/issues/993
  • A proposal suggested creating a Chinese version of C#, F#, and VB.

dotnet/maui

• dotnet/maui/issues/35
  • .NET MAUI’s name clashed with existing projects Maui Linux and MauiKit

dotnet/roslyn

• dotnet/roslyn/pull/3507

  • Roslyn removed occurrences of the term “whitelist” from its codebase, replacing it with alternative terminology.

• dotnet/roslyn/issues/24031

  • VS2017express replaced tabs with spaces despite user settings.

• dotnet/roslyn/issues/68873

  • Pressing Tab after certain keywords in Visual Studio caused unintended code changes

dotnet/runtime

• dotnet/runtime/issues/27939
  • Tuple member naming conventions in .NET were debated, with discussions on whether PascalCase or camelCase should be used.
• dotnet/runtime/issues/92849
  • Math.Round failed to round 0.50 values correctly, leading to an argument over whether it should round to the nearest even number or always round up.

dotnet/sdk

• dotnet/sdk/issues/22247
  • Hot Reload was removed from dotnet watch, making it exclusive to Visual Studio

dotnet-foundation/Home + reactiveui/splat

• dotnet-foundation/Home/discussions/39
• reactiveui/splat/pull/778
• dotnet-foundation/Home/discussions/40
  • The .NET Foundation’s Executive Director merged a PR in ReactiveUI’s Splat project without maintainer approval.

EpicGames/Signup

• EpicGames/Signup/pull/24
  • Journalistic Media: Y Combinator
  • Notification spam of 400k GitHub users due to tagging @EpicGames/developers on GitHub

facebook/react

• facebook/react/issues/10191
  • A user request for Facebook to re-license React from the BSD+Patents license to a more permissive license like Apache 2.0, following RocksDB’s example.

facebookresearch/llama

• facebookresearch/llama/pull/73 (archive: 1, 2, 3)
  • Summary:
    • Meta’s LLaMA is a 65-billion-parameter large language model.
    • The Register reported that “someone on 4Chan posted details on how to obtain the whole model via peer-to-peer file sharing, and eventually instructions on how to download it all were published on GitHub.” (source: The Register, March 8, 2023)
    • The Guardian reported, “Initially posted to 4Chan, a link to the BitTorrent mirror of LLaMA eventually made it to GitHub” (source: The Guardian, March 7, 2023)
    • A GitHub user opened a pull request containing the magnet link originated from 4chan /g/. (source: pull/73)
  • Journalistic Media:
    • The Guardian (archive: 1, 2, 3)
    • The Register (archive: 1, 2, 3)
    • 4Chan /g/ 91850335 (archive: 1, 2)
    • 4Chan /g/ 91870752 (archive: 1, 2)
    • DesuArchive /g/ 91850335 (archive: 1, 2, 3)
    • DesuArchive /g/ 91870752 (archive: 1, 2, 3)
    • Hacker News (archive: 1, 2, 3)
    • Hacker News page 2 (archive: 1, 2, 3)
    • Hacker News page 3 (archive: 1, 2, 3)
    • rDrama (archive: 1, 2, 3)
    • Reddit r/MachineLearning (archive: 1, 2, 3)

fasterthanlime/42da9378768aebef662dd26dddf04849

• fasterthanlime/42da9378768aebef662dd26dddf04849
  • Summary:
    • In May 2023, @fasterthanlime published a widely discussed article, “Rust: The wrong people are resigning,” raising concerns about the resignation of key contributors from the Rust language community and the project’s governance. The article and its themes sparked extensive debate across Hacker News, Reddit, rDrama, Kiwifarms, and 4chan.
  • Journalistic Media:
    • Hacker News 36090512
    • Hacker News 36091242
    • Hacker News 36101501
    • Hacker News 36105637
    • Hacker News 36106942
    • Reddit r/Rust 13sqdt7
    • Reddit r/Rust 13tsmht
    • Reddit r/Rust 13u8car
    • rDrama 173622
    • rDrama 174098
    • Kiwifarms (Clearnet)
    • Kiwifarms (Tor)
    • 4chan /g/ 93695805 (archive: 1, 2, 3)
    • 4chan /g/ 93710005 (archive: 1, 2, 3)
    • desuarchive /g/ 93695805
    • desuarchive /g/ 93710005

Feodor2/Mypal

• Feodor2/Mypal/issues/3 (archive: 1, 2, 3)
  • Related GitHub issues:
    • jasperla/openbsd-wip/issues/86 (archive: 1, 2, 3)
    • Feodor2/Centaury/issues/39 (archive: 1, 2, 3)
    • Feodor2/Centaury/issues/40 (archive: 1, 2, 3)
  • People Involved:
    • Matt A. Tobin (New Tobin Paradigm) @mattatobin (archive: 1, 2, 3)
    • M. C. Straver (Moonchild) @wolfbeast (archive: 1, 2, 3)
    • OpenBSD volunteers
    • Mypal volunteers
  • Summary:
    • OpenBSD-WIP volunteers were porting the Pale Moon browser to OpenBSD.
    • Mypal volunteers were porting the Pale Moon browser to Windows XP.
    • Pale Moon developers filed DMCA takedown notices against these forks, leading to significant controversy and debate over open source licensing and project forking.
  • DMCA takedown notices on GitHub:
    • 2021-10-14-pale-moon.md (archive: 1, 2, 3)
    • 2021-10-27-pale-moon.md (archive: 1, 2, 3)
    • 2021-10-28-binoc-central-mirror.md (archive: 1, 2, 3)
    • 2021-10-12-boc-uxp.md (archive: 1, 2, 3)

github/dmca

• github/dmca/pull/8122 (archive: 1, 2)

• github/dmca/pull/8140 (archive: 1, 2)

  • GitHub processed a DMCA takedown request targeting youtube-dl.
• github/dmca/blob/master/2021/02/2021-02-19-take-two.md
• github/dmca/pull/8839 (archive: 1)
• GTAmodding/re3 drama

golang/go

• golang/go/issues/21956
  • A user advocated for moving Go’s development workflow entirely to GitHub.
• golang/go/issues/33021
• A proposal suggested removing the Google logo from the Go website.

google/googletest

• google/googletest/issues/1660
  • Google Test’s documentation was criticized for being unclear
• google/googletest/issues/1666
  • A user described Google Test as difficult to install and configure.

GoogleCloudPlatform/click-to-deploy

• GoogleCloudPlatform/click-to-deploy/pull/209
  • A pull request proposed replacing “slave” with “agent” in Google Click-to-Deploy.

greatsuspender/thegreatsuspender

• greatsuspender/thegreatsuspender/issues/1175
  • The Great Suspender’s original maintainer announced a change in project ownership, leading to concerns about the new owner’s identity and about potential malware.

Homebrew/homebrew-core

• Homebrew/homebrew-core/issues/24654 (archive: 1, 2)
  • Homebrew user questioned whether Apache httpd should be a dependency for PHP.
• Homebrew/homebrew-services/issues/151 (archive: 1)
  • A Homebrew user requested finer control over starting and stopping services, arguing that the –all flag was too broad and led to unintended dependencies being launched.
• Homebrew/legacy-homebrew/issues/50683 (archive: 1)
  • A Homebrew user questioned the removal of the rtorrent formula.

lllyasviel/stable-diffusion-webui-forge

• lllyasviel/stable-diffusion-webui-forge/discussions/169
  • ComfyUI (Stable Diffusion frontend) devs accuse Forge (another SD frontend) of using their code, license drama ensues.

indutny/node-ip

• github/advisory-database/pull/3504
  • Journalistic Media: socket.dev/blog
  • A GitHub Advisory Database entry flagged the NPM IP package as vulnerable to Server-Side Request Forgery (SSRF) attacks.

iperov/DeepFaceLive

• iperov/DeepFaceLive/issues/41
  • A user argued that DeepFaceLive should cease development, claiming the technology is primarily used for scams and deception.

irungentoo/toxcore

• irungentoo/toxcore/issues/1227
  • An issue is opened that criticized the management of the Toxcore repository.

jashkenas/underscore

• jashkenas/underscore/issues/1805
  • A new update version 1.7.0 - introduced breaking changes without a major version bump.

jdm-contrib/justdelete.me

• jdm-contrib/justdelete.me/issues/86 (archive: 1)
  • JustDeleteMe fork mass-tagged users who had starred the original repository, asking them to support the new project.

Jguer/yay

• Jguer/yay/issues/496
  • An issue is opened about removing packages with Yay

joyent/libuv

• joyent/libuv/pull/1015
  • ⚠️ Sensitive Topic

jquery/download.jqueryui.com

• jquery/download.jqueryui.com/issues/359
• jquery/download.jqueryui.com/issues/390
  • jQuery UI Download Builder encountered an Error 502 (Bad Gateway) when users attempted to download files.

JuliaLang/IJulia.jl

• JuliaLang/IJulia.jl/issues/398
  • A user reported that Pkg.add(“IJulia”) failed due to BinDeps errors and calls the developer an “amateur”.

katharostech/bevy_retrograde

• katharostech/bevy_retrograde/issues/1
  • Users questioned the Katharos License, arguing that its religious alignment and legal ambiguity posed adoption and contribution risks.

keepassxreboot/keepassxc

• keepassxreboot/keepassxc/issues/10725
  • A Debian package change removed browser integration from KeePassXC

kenwheeler/slick

• kenwheeler/slick/issues/681
  • A user reported that swiping left or right on linked images in the Slick slider would activate the link, which was considered undesirable behavior. The user compared it to RoyalSlider, which required a tap to activate the link.

kmmbvnr/django-jenkins

• kmmbvnr/django-jenkins/issues/349
  • A user suggested moving the tutorial to ReadTheDocs to make it easier for contributors to edit and fix typos. The user even set up a ReadTheDocs project and offered to help migrate the documentation.

kraih/mojo

• kraih/mojo/issues/656

  • A user criticized the project’s practice of instructing users to run curl get.mojolicio.us

    sh, citing security concerns about piping untrusted network data directly to a shell, use of HTTP without TLS, and multiple redirects.

Ksh93/Ksh

• original ksh kinda blew up - ksh fallout.
• original ksh rewound.
• ksh-community stalled.
• ksh93 seems to be active now though.

Ldapjs/Node-Ldapjs

• Ldapjs/Node-Ldapjs/commit/8ffd0bc
  • Journalistic Media: Hacker News, 4chan
  • Developer of a Node library calls quits after receiving an email reminiscent of Xbox Live chat.

Lerna/Lerna

• Lerna/Lerna/pull/1616
  • Lerna maintainers added a clause to the MIT license banning use by companies and organizations that collaborated with US Immigration and Customs Enforcement (ICE), including Microsoft, Amazon, Palantir, and others.
• Lerna/Lerna/pull/1619
  • Many users and contributors objected, arguing that the new license was no longer MIT, violated open source principles, and created legal and compliance confusion. Automated license checkers and companies relying on Lerna were affected.
• Lerna/Lerna/issues/1622
  • At least one contributor requested removal of their code from the project, condemning the politicization of open source.
• Lerna/Lerna/issues/1625
  • Same complaints as issue 1619 above.
• Lerna/Lerna/issues/1628
  • Users requested that any license change be released as a major version bump to avoid breaking builds.
• Lerna/Lerna/issues/1630
  • Some called for the removal of the maintainer responsible for the change, citing Code of Conduct violations and unprofessional behavior.
• Lerna/Lerna/pull/1631
  • There were attempts to remove specific companies (e.g., Microsoft) from the blacklist, with debate about the accuracy and fairness of the list.
• Lerna/Lerna/issues/1632
  • Same complaints as issue 1619 above.
• Lerna/Lerna/pull/1633
  • The Lerna team reverted the license change, restoring the original MIT license. The maintainer responsible for the controversial change was removed from the project.

Marak/Colors.js and Marak/Faker.js

• colors.js/issues/285
• colors.js/issues/290
• faker.js/issues/1046
  • In early 2022, the maintainer of colors.js and faker.js, Marak Squires, intentionally corrupted the codebases of both libraries. He introduced infinite loops and nonsensical output, causing widespread breakage for projects and applications that depended on these popular npm packages.

mdn/yari

• mdn/yari (archive: 1, 2, 3)
• mdn/yari/issues/9208 (archive: 1, 2, 3) (locked as too heated)
• mdn/yari/issues/9230 (archive: 1, 2, 3)
  • Summary:
    • The Register wrote,

      “Mozilla Developer Network, a widely used technical resource for web developers, this week introduced an assistive service called AI Help.” in July 2023. (source: The Register)

    • A GitHub user, @eevee, opened an issue and wrote,

      “MDN has generated a convincing-sounding lie and there is no apparent process for correcting it” in July 2023. (source: mdn/yari/issues/9208)

  • Journalistic Media:
    • The Register (2023/07/03) (archive: 1, 2, 3)
    • The Register (2023/07/06) (archive: 1, 2, 3)
    • Hacker News (archive: 1, 2, 3)
    • 4Chan /g/ 94460477 (archive: 1, 2, 3)
    • 4Chan /g/ 94686609 (archive: 1, 2, 3)
    • DesuArchive /g/ 94460477 (archive: 1, 2, 3)
    • DesuArchive /g/ 94686609 (archive: 1, 2, 3)
    • Kiwifarms (.net)
    • Kiwifarms (.onion) (archive: 1, 2)
    • Kiwifarms (sneed.today) (archive: 1, 2, 3)
    • rDrama (archive: 1, 2, 3)
    • Reddit r/webdev (archive: 1, 2, 3)

Microsoft/Terminal

• Microsoft/Terminal/issues/10362
  • A user reported that Windows Terminal had extremely slow performance when processing virtual terminal sequences, especially with per-character color codes, resulting in a 40x slowdown.

Microsoft/TypeScript

• Microsoft/TypeScript/pull/3622
  • This pull request introduced intersection types to TypeScript. While the technical discussion was extensive, it also became contentious. Several users expressed confusion and frustration over the conceptual model and terminology, especially those coming from statically typed language backgrounds.

Microsoft/vscode

• Microsoft/vscode/issues/32405
• Microsoft/vscode/issues/54261
• Microsoft/vscode/issues/191229
  • A Chinese company created a fork of VSCode named CEC-IDE, but claims all credit done for it as a “Chinese Home-grown IDE”, violating the MIT license.
• Microsoft/vscode/issues/87268
• Microsoft/vscode/issues/87440
  • A user opened an issue requesting that VSCode remove the “Santa Hat” easter egg.

Microsoft/vsmarketplace

• Microsoft/vsmarketplace/issues/1114
  • The PlatformIO IDE extension, with over 4.5 million installs, was suddenly removed from the Visual Studio Marketplace.
• Microsoft/vsmarketplace/issues/1168
  • A user reported that the popular “Material Theme” extension was deleted from the marketplace due to alleged malicious activity, possibly by Microsoft.

Microsoft/web-build-tools

• Microsoft/web-build-tools/issues/673
  • This issue concerns a license compliance question about whether Microsoft’s Rush project was derived from Lerna, following public claims by a Lerna maintainer.

Mishoo/UglifyJS2

• mishoo/UglifyJS2/issues/2054
  • A user reported that installing uglify-js@2.8.28 via npm resulted in files with a timestamp of December 31, 1969, which is a classic Unix epoch issue.

Moment/Moment

• moment/moment/issues/1407
  • Moment.js deprecated constructing dates from non-ISO strings due to unpredictable behavior across browsers, especially with legacy formats and the JavaScript Date constructor.

Moq/Moq

• Moq/Moq/issues/1370
• Moq/Moq/issues/1372
• Moq/Moq/issues/1374
  • Users have reported privacy issues with SponsorLink.

Moxystudio/Node-Cross-Spawn

• moxystudio/node-cross-spawn/pull/102
  • A user proposed removing the nice-try dependency, arguing it was unnecessary and contributed to dependency bloat for a package used by thousands of projects.

MrGlockenspiel/Activate-Linux

• MrGlockenspiel/activate-linux/issues/138
  • A user opened an issue simply stating “This is a waste of time. Spend your time better.”

MrMEEE/Bumblebee-Old-and-Abbandoned

• MrMEEE/bumblebee-Old-and-abbandoned/issues/123
  • A critical bug was reported: an extra space in the install script caused it to run rm -rf /usr, deleting the entire /usr directory on Ubuntu systems.

NanoAdblocker/NanoCore

• NanoAdblocker/NanoCore/issues/362
• Journalistic Media: Reddit.com
• Ownership transfer drama

NationalSecurityAgency/Ghidra

• NationalSecurityAgency/ghidra/issues/371

Nextcloud/Android

• nextcloud/android/issues/13738
• nextcloud/android/issues/13872
  • Unintentional synchronization of all files: An upgrade to the Nextcloud Android app causes all files on the remote server to be downloaded. This results in phones running very hot, running out of storage, and racking up high data fees.

Nextcloud/Server

• Nextcloud/Server/issues/51335
• Nextcloud puts out fire after data leak panic
  • An issue is reported where Federated Cloud Sharing was leaking data.

NixOS/Foundation

• NixOS/foundation/issues/110
  • Journalistic Media:
    • save-nix-together.org
    • TheRegister.com
  • Anduril sponsorship drama

NixOS/Nixpkgs

• NixOS/nixpkgs/issues/4952
  • A frustrated user details their struggles building Emacs and SBCL on NixOS, criticizing the project’s documentation, package management, and the complexity of the Nix language.
• NixOS/nixpkgs/pull/381817
  • A PR to disable telemetry by default in the devenv package is merged without maintainer consent, triggering a heated debate.

Nixxquality/WebMConverter

• nixxquality/WebMConverter/commit/c1ac0baac06fa7175677a4a1bf65860a84708d67
  • The project is renamed from “WebM for Retards” to “WebM for Gits,” with all references to the former term replaced in code and documentation.

Nodejs/Inclusivity

• nodejs/inclusivity/issues/9
  • Node.js maintainers discuss how to avoid problematic or offensive language in APIs and documentation.

Nodejs/Node

• Nodejs/Node/issues/3721
  • A proposal to replace the use of “suicide” as a verb in the Node.js codebase leads to a sensitive discussion about language, mental health, and the impact of terminology in open source projects.
• Nodejs/Node/pull/4765
  • Microsoft proposes enabling Node.js to run on the ChakraCore JavaScript engine, sparking a massive, technically complex debate about cross-engine support, project scope, maintenance burden, and the risk of ecosystem fragmentation.

Nodejs/Readable-Stream

• nodejs/readable-stream/pull/238
  • A PR to inline a trivial isArray function instead of depending on a tiny npm package ignites a surprisingly intense debate about micro-dependencies, licensing, copyright, and the philosophy of code reuse.

Nodejs/TSC

• nodejs/TSC/issues/8
  • A Node.js TSC member temporarily bans a user for making an inappropriate comment in the inclusivity repo.

Npm/Npm

• npm/npm/issues/19883
  • A user opens an issue to report that npm’s package-lock.json is being automatically updated even when running npm install –no-save, which they argue is unexpected and undesirable behavior.

Obsproject/Obs-Studio

• obsproject/obs-studio/pull/2868
  • A long-running and heated pull request to add AppImage support to OBS Studio for Linux devolved into a major conflict between the AppImage developers and OBS maintainers.
• obsproject/obs-studio/pull/10043
  • Single JSON change that adds another streaming service rejected by maintainer with zero commits in the last few days, citing not meeting unspecified requirements.

Oerdnj/Deb.sury.org

• oerdnj/deb.sury.org/issues/1768 (archive: 1, 2)
  • A user reported that the PHP APT GPG key was unavailable over IPv6, leading to a protracted and increasingly hostile discussion.

Omnivore-App/Omnivore

• omnivore-app/omnivore/issues/4459
• Omnivore Blog: Details on Omnivore shutting down
  • Omnivore shutdown due to ElevenLabs purchase

opal/opal

• opal/opal/issues/941 (archive: 1, 2, 3)
  • Dramatis Personae:
    • Coraline Ada Ehmke, @CoralineAda (GitHub, Wikipedia)
    • @meh (GitHub)
  • Summary:
    • A core maintainer of Opal made transmisic and transphobic comments on the Internet.
    • The creator of the Contributor Covenant opened an issue to kick the maintainer out of the Opal development community.
    • Another core maintainer of Opal replied hostilely and closed the GitHub issue dismissively.
  • Journalistic Media:
    • Hacker News (archive: 1, 2, 3)
    • kiwifarms (archive: 1, 2)
    • 4chan /g/ 48559828 (archive: 1, 2, 3, 4)
    • 4chan /g/ 48569752 (archive: 1, 2, 3, 4)
    • 4chan /g/ 48575151 (archive: 1, 2, 3, 4)
    • 4chan /g/ 90214421 (archive: 1, 2, 3, 4)

openbb-finance/OpenBBTerminal

• OpenBB-finance/OpenBBTerminal/issues/1625 (archive: 1, 2, 3)
  • Summary:
    • Someone from OpenBB was scraping GitHub for emails and sending out marketing spam.
    • SinSiXX opened an issue titled “Shit SPAM” on GitHub in April 2022.
  • Journalistic Media:
    • Hacker News (archive: 1, 2, 3)

Opencart/Opencart

• opencart/opencart/pull/219
  • A user submitted a bugfix for a checkout issue affecting customers without predefined addresses. The maintainer dismissed the fix.
• opencart/opencart/issues/1269
  • A user reported that OpenCart’s password hashing was insecure, providing technical details and recommendations.
• opencart/opencart/issues/1534
  • A security researcher reported a PHP object injection vulnerability after a failed attempt to contact the maintainer privately.
• opencart/opencart/pull/1594
  • A contributor pointed out cryptographic flaws in OpenCart’s encryption implementation.
• opencart/opencart/issues/3834 (archive: 1, 2)
  • A user urged OpenCart users to switch to OpenCart-CE, a community-driven fork, due to the original project’s lack of updates and security patches.

OpenTTD/OpenTTD

• OpenTTD/OpenTTD/issues/7731
  • A user reported a bug about savegame sorting on Windows XP.

Orgs/Community

• orgs/community/discussions/65343
  • Major user backlash against GitHub’s feed redesign, with hundreds of comments criticizing the removal of chronological order, algorithmic curation, and lack of user control.

Palantir/Tslint

• Palantir/Tslint/issues/4132
• Palantir/Tslint/issues/4140
• Palantir/Tslint/issues/4141
  • ⚠️ Sensitive Topic

P-H-C/Phc-Winner-Argon2

• P-H-C/phc-winner-argon2/issues/182
  • Technical discussion about a cryptographic attack and whether the project should update its default parameters.

PiotrGrochowski/Consolas

• PiotrGrochowski/Consolas/issues/1 (archive: 1)
  • A user brings up that the project has no license file.

Pkgxdev/Pantry

• pkgxdev/pantry/issues/5358
  • User criticized the use of AI-generated, inaccurate, or nonsensical package descriptions on the pkgx.dev site, expressing concern about trust and suggesting using real metadata instead.

PolyMC/PolyMC

• PolyMC/PolyMC/commit/ccf2825
  • The commit deleted the CODE_OF_CONDUCT.md file with a commit message referencing reclaiming the project from “leftoids.”
• PolyMC/PolyMC/issues/656
  • User accused PolyMC maintainers of abusing GitHub takedown requests to suppress forks, arguing this violates the GPLv3 and calling for adherence to open source principles.

Portainer/Portainer

• portainer/portainer/issues/8452
  • Summary:
    • Portainer developers add an obnoxious e-begging button and call the built-in begware a new feature, not a bug.
    • Kubernetes users install ad blockers in their development environment to suppress the nagware.
    • The community then creates new ad-free forks and Docker images.

PowerShell/PowerShell

• PowerShell/PowerShell/pull/1901
  • A user proposed removing the curl and wget aliases from PowerShell due to confusion and incompatibility with the real tools.

Prettier/Prettier

• prettier/prettier/issues/6360 (archive: 1, 2, 3)
  • A user requested an option to disable Prettier’s behavior of always adding a newline at the end of files.

Probonopd

• https://gist.github.com/probonopd/9feb7c20257af5dd915e3a9f2d1f2277
  • Developer posts a gist of his objective grievances with Wayland, holywar in comments ensues. Rust Evangelism Strike Force derails the thread as usual.

Projecthamster/Hamster

• projecthamster/hamster/issues/574
  • The maintainer responded with a status update, acknowledging slow progress and inviting new contributors.

Promises-Aplus/Promises-Spec

• promises-aplus/promises-spec/issues/94
  • A proposal to incorporate monads and category theory into the Promises/A+ spec sparked debate.

ptsteadman/notebook

• ptsteadman/notebook/pull/1 (archive: 1, 2)
  • A minor typo fix PR led to off-topic comments and direct message drama, with the maintainer stepping in to request that discussions remain relevant and civil.

Pyca/Cryptography

• pyca/cryptography/issues/5771
  • Users raised concerns about the project’s increasing reliance on Rust dependencies, especially regarding platform support and installation difficulties.

Pypa/Pipenv

• pypa/pipenv/issues/1050
  • Longstanding requests for supporting multiple python_version values in Pipfile remain unresolved.

p0deje/maccy

• p0deje/Maccy/issues/482 (archive: 1, 2, 3)
  • Some users can’t figure out why they can’t copy or paste with the clipboard manager and can’t find any fix. Several people with the problem complain, and the problem is widespread due to the Ventura update. Finally, after much struggle, the issue is closed.

Qbittorrent/QBittorrent

• qbittorrent/qBittorrent/issues/9407

• qbittorrent/qBittorrent/issues/18618

  • Summary:
    • Without first consulting the qBittorrent developers privately, an alt account publicly disclosed a path traversal vulnerability by opening a GitHub issue in February 2023. (Coordinated Vulnerability Disclosure, CVD, Wikipedia)
    • One GitHub user responded, “That doesn’t respect my freedom™ to use a better client.” Many reacted to the reply with a thumbs-down emoji. (Source)
    • Another GitHub user commented, “What is your problem with using civilized language?” A qBittorrent maintainer marked the comment as abuse. (Source)

Rails/Rails

• rails/rails/commit/b83965785db1eec019edf1fc272b1aa393e6dc57
• Rails/Rails/issues/5228
  • Mass assignment vulnerabilities, where developers forget to use attr_accessible or attr_protected, allowing attackers to set protected attributes via crafted HTTP requests.
• Rails/Rails/pull/5329
  • This PR proposed making the request.xhr? predicate method return a strict boolean (true/false) instead of “truthy” values like 0 or nil.
• Rails/Rails/issues/9894
  • A bug where callbacks on ActiveRecord.where(…).create inherit the where clause, leading to unexpected behavior.

raivo-otp/ios-application

• raivo-otp/ios-application/issues page
• raivo-otp/ios-application/issues/328
• raivo-otp/ios-application/discussions/369
• raivo-otp/ios-application/discussions/372
  • Formerly source-available OTP authenticator for iOS suddenly deleted user data after update, and is suggested to be paywalling the backup import function.
  • Journalistic Media: Hacker News

Redis

• redis/redis/pull/13157
  • Redis Inc. submitted a pull request to change the Redis database’s license from the open-source BSD 3-Clause to the Redis Source Available License (RSAL) and Server Side Public License (SSPL).

Redis-Rs

• redis-rs/redis-rs/issues/1419
  • Following Redis’s license change, the maintainer of the popular Rust client redis-rs opened an issue to discuss the project’s future. The issue revealed that Redis Inc. had contacted the maintainer, pressuring them to change the crate’s name and branding due to trademark concerns.

Resque/Resque

• resque/resque/issues/1406
  • A proposal to add a Code of Conduct (CoC) to the Resque project

Restic

• restic/issues/1786
  • A user requested that restic, a backup tool, allow repositories to be created with empty passwords.

RIAEvangelist/Node-ipc

• RIAEvangelist/node-ipc/issues/233 (archive: 1)
  • The maintainer of node-ipc, a widely used npm package, published a version that, under certain conditions, overwrote files on users’ systems with a peace message.

Rms-Open-Letter

• rms-open-letter
  • In March 2021, an open letter was published calling for the removal of Richard Stallman (RMS) from leadership positions in the Free Software Foundation (FSF) and related organizations, following his return to the FSF board.

rupertbenwiser/web-environment-integrity

• RupertBenWiser/Web-Environment-Integrity (archive: 1, 2, 3)
• rupertbenwiser/web-environment-integrity/issues/28 (archive: 1, 2, 3)
• rupertbenwiser/web-environment-integrity/pull/29 (archive: 1, 2, 3)
  • Summary:
    • Google is prototyping a browser fingerprinting API that detects the browser’s build, extensions, and overall environment around it.
    • This API allows for websites to collectively exclude all browsers and users that do not use any browser, extension, or OS approved (attested) by Google themselves, essentially forcing all browser developers to register their web browser to Google for testing, and disallowing most Chromium forks.

Robertdavidgraham/Masscan

• robertdavidgraham/masscan/issues/482
  • This issue was opened to request the removal of “master/slave” terminology from the Masscan codebase, citing the terms as outdated and offensive.

Rollup/Rollup

• rollup/rollup/issues/2716
  • A request that the Rollup project stop using “master/slave” terminology.

rubocop/rubocop

• rubocop/rubocop/issues/8091 (archive: 1, 2)
  • This issue was opened to request the removal of the term “slave” from the RuboCop codebase.

SerenityOS/Serenity

• SerenityOS/serenity/pull/6814
  • ⚠️ Sensitive Topic

Signalapp/Signal-Android

• signalapp/Signal-Android/issues/8974
  • Signal developers removed a passphrase and forced users to use a fingerprint. User claims that they received money from secret service for reducing a privacy of their app.

snarfed/bridgy-fed

• snarfed/bridgy-fed
  • Mastodon users in denial of the fact that their posts are public flood the BlueSky-ActivityPub bridge repo with opt-out requests.
  • /issues/835 (archive: 1)
  • /issues/841 (archive: 1)
  • /issues/869 (archive: 1)

Spatie/Laravel-Newsletter

• spatie/laravel-newsletter/pull/228
  • A contributor submits a PR to add a new feature, but the maintainer closes it, stating the project is feature-complete.

Spring-Projects/Spring-Hateoas

• spring-projects/spring-hateoas/issues/66
  • A user criticizes the library’s restrictive API, arguing it forces a specific resource representation and limits flexibility.

Standard/Standard

• standard/standard/issues/1381
  • The maintainers experiment with showing a funding message during npm install.

Stevemao/Left-Pad

• stevemao/left-pad/issues/4
  • The infamous left-pad incident: the package is unpublished, breaking thousands of builds and sparking widespread discussion about npm’s package management and the fragility of the ecosystem.

Strongloop/Loopback

• strongloop/loopback/issues/1079
  • Controversy erupts when users discover the package phones home via optionalDependencies, causing slow installs and privacy concerns.

Syl20bnr/Spacemacs

• syl20bnr/spacemacs/pull/3484
  • A massive, contentious debate over adding a Code of Conduct.

Systemd/Systemd

• systemd/systemd/issues/1143
  • A user reports that setting the system date far in the future causes systemd to get stuck printing “Time has been changed” repeatedly, leading to confusion and jokes about time travel bugs.
• systemd/systemd/issues/2402
  • Mounting efivarfs read/write by default allows accidental deletion of EFI variables, resulting in bricked hardware.
• systemd/systemd/issues/5644
  • A bug in tmpfiles allows a specific glob pattern to recursively delete the root directory, prompting alarm over the potential for catastrophic data loss.
• systemd/systemd/issues/5755
  • A user requests that systemd-resolved select DNS servers in a round-robin fashion, but the actual behavior differs.
• systemd/systemd/issues/6237
  • Systemd fails to handle usernames starting with a digit, causing privilege escalation and service failures.
• systemd/systemd/issues/6259
  • A follow-up to the previous issue, this thread debates whether usernames starting with digits should be allowed, referencing standards and real-world usage.
• systemd/systemd/issues/6369
  • A bug is reported where systemd’s hostnamed mishandles FQDNs with trailing dots, leading to incorrect hostname settings and confusion over DNS conventions.

Tc39/Proposal-Cancelable-Promises

• tc39/proposal-cancelable-promises/issues/70
  • The proposal for cancelable promises is abruptly withdrawn, leaving the community confused and frustrated.

Telegramdesktop/Tdesktop

• telegramdesktop/tdesktop/issues/96
  • A long-standing request for spellchecking support in Telegram Desktop gathers hundreds of comments, with users expressing frustration over the lack of progress and maintainers citing technical challenges.

tenacityteam/tenacity

• tenacityteam/tenacity/issues/99 (archive: 1, 2)
  • Tenacity, an Audacity fork, is an easy-to-use multi-track audio editor and recorder. A GitHub user named Cookiengineer was the leader and one of the developers of Tenacity.
  • Some 4chan users doxxed and attempted to murder Cookiengineer in a coordinated attack campaign in July 2021.
  • Journalistic Media:
    • TheRegister.com
• tenacityteam/tenacity/issues/99
  • Cookiengineer quit after the harassment and stabbing from the 4chan users.

Tiangolo/Fastapi

• tiangolo/fastapi/issues/3273
  • A user complains that the FastAPI documentation’s “Concurrency and async/await” section uses too many emojis, making it distracting and hard to read.

Tip4commit/Tip4commit

• tip4commit/tip4commit/issues/127
  • Mitsuhiko requests the removal of all their repositories from Tip4commit, objecting to third-party sites “gamifying” their projects.

Tj-Actions/Changed-Files

• Tj-Actions/Changed-Files/issues/2464
• Journalistic Media: TheRegister.com
• Github Actions was leaking secrets from 23,000 projects due to a vulnerability.

Todogroup/Opencodeofconduct

• todogroup/opencodeofconduct/pull/70
  • A major rewrite of the Open Code of Conduct template sparks heated debate over language, tone, and the handling of free speech.

Tootsuite/Mastodon

• tootsuite/mastodon/pull/9898
  • A PR to add underlines to links in Mastodon to improve accessibility triggers a long, passionate debate.

Torvalds/Linux

• torvalds/linux/commit/6e90b675cf942e50c70e8394dfb5862975c3b3b2
  • A sweeping commit removes numerous entries from the MAINTAINERS file due to compliance requirements, with a note that they can be restored if proper documentation is provided.

Twbs/Bootstrap

• twbs/bootstrap/issues/3057
  • A user reports that missing semicolons in bootstrap-dropdown.js cause minification errors in Firefox.

Twitter/Scrooge

• twitter/scrooge/issues/222
  • A user points out that the project’s build status icon shows a failing build, suggesting it should be fixed or removed

ValveSoftware/Source-1-Games

• ValveSoftware/Source-1-Games/issues/2475

  • A user discovers that having “catbot” in their Linux username triggers an automatic VAC ban in Team Fortress 2.

• ValveSoftware/steam-for-linux/issues/3671

  • A user moves their Steam folder and symlinks it, only to have Steam recursively delete all files owned by their user—including backups—after launch.

Vcflib/Vcflib

• vcflib/vcflib/issues/206
  • A frustrated user reports that the vcf2tsv tool fails to separate per-allele records with newlines, resulting in jumbled output. They also complain about the random reordering of INFO fields.

VHSgunzo/Lutris-Wine

• VHSgunzo/lutris-wine/issues/15
  • This issue has been deleted. No further information or context is available.

Vimeo/Player.js

• vimeo/player.js/issues/28
  • A user asks if it’s possible to hide the control bar using player.js.

Voat/Voat

• Voat/Voat/issues/445
• Voat/Voat/issues/446
  • Scalability drama

Ultralyics/Ultralytics and ltdrdata/ComfyUI-Impact-Pack

• Ultralyics/Ultralytics/issues/18027
• ltdrdata/ComfyUI-Impact-Pack/issues/843
  • Journalistic Media: BleepingComputer.com
  • Ultralytics was compromised by a malicious actor who replaced the official AI model with a backdoored version that installed a cryptominer on users’ systems.

Webpack/Webpack-Cli

• webpack/webpack-cli/issues/1612
  • A user reports that importing fs/promises works with TypeScript but fails with Webpack, triggering a “Can’t resolve ‘fs/promises’” error.

WhisperSystems/Signal-Android

• WhisperSystems/Signal-Android/issues/127
  • A user requests an official download alternative to Google Play for Signal, citing privacy concerns and the inconvenience of building from source.

WICG/Interventions

• WICG/interventions/issues/18
  • A heated debate erupts over Chrome’s intervention to block synchronous XHR requests during page dismissal (e.g., in unload/beforeunload events).

winampdesktop/winamp

• WinampDesktop/winamp/issues/56
• /WinampDesktop/winamp/issues/6
  • Summary:
    • Winamp have open sourced the original player’s code.
    • They have chosen a custom license, forbidding forks, and distributing modifications among other things.
    • Github users are outraged, started arguing in issues, and opened several troll pull requests.
    • Finally, Winamp owners delete the source code repository.
  • Journalistic Media: TheRegister.com

xenia-canary/xenia-canary

• xenia-canary/xenia-canary/pull/180
  • Summary:
    • One of the developers of Xenia, an Xbox 360 emulator, added an anti-feature that plays loud noises when loading ISO images, together with nagging messages about “piracy”.
    • The developer was revealed to be a Discord moderator who was frustrated with users asking for support without proving ownership of the game.
    • After backlash, the developer deleted his account, and other contributors later cleaned up the mess.
  • Journalistic Media:
    • 4chan /g/ 94978918 (archive)
    • Kiwi Farms
    • rDrama

yuzu-emu/yuzu

• yuzu-emu/yuzu/issues/13189 (archive: 1)
  • Summary:
    • Windows 7 user complained about lacking support for his OS.
    • User didn’t like being told to switch to Linux.
    • User intensively messaged Nintendo of America to issue a Cease & Desist letter to developers.
    • Opens issue when they actually did it.
  • Journalistic Media:
    • rDrama
    • 4chan /g/ 99245995 (archive: 1)

Zedeus/Nitter

• zedeus/nitter/issues/983
  • Users report that Nitter, a privacy-focused Twitter/X frontend, has stopped working due to changes or blocks implemented by Twitter/X.

Zenparsing/Es-Observable

• zenparsing/es-observable/pull/97
  • A heated, highly technical debate over the Observable proposal for JavaScript.

zloirock/core-js

• zloirock, the maintainer of the popular core-js library, added a code that printed a promotional message into the postinstall script of his NPM package (issues/548).
• In November 2019, @zloirock lost an appeal to overturn an 18-month prison sentence imposed for causing a lethal road accident (The Register (2020)).
• In February 2023, @zloirock posted a 10,000-word "So, what's next?" article about open source sustainability and maintainer burnout, which was linked in a GitHub issue and elicited hundreds of comments and thousands of reactions (issues/1179).
• "So, what's next?" article: (archive: [1(https://archive.ph/miwZk), 2, 3)
• zloirock/core-js/issues/548 (archive: 1, 2, 3)
• zloirock/core-js/issues/635 (archive: 1, 2, 3)
• zloirock/core-js/issues/708 (archive: 1, 2, 3)
• zloirock/core-js/issues/767 (archive: 1, 2, 3)

• zloirock/core-js/issues/1179 (archive: 1, 2, 3)

  • Summary:
    • The core-js project and its maintainer, zloirock, have been at the center of multiple controversies, including promotional postinstall scripts, legal troubles, and public debates about open source sustainability and maintainer burnout. The project’s issues and related media coverage have sparked widespread discussion in the open source community.
  • Journalistic Media:
    • The Register (2020) (archive: 1, 2, 3)
    • The Register (2023) (archive: 1, 2, 3)
    • Hacker News 22681860 (archive: 1, 2, 3)
    • Hacker News 34780859 (archive: 1, 2, 3)
    • RDrama 149560 (archive: 1, 2)
    • 4chan /g/ 91675671 (archive: 1, 2, 3)
    • DesuArchive 91675671 (archive: 1, 2, 3)
    • Kiwifarms (archive: 1, 2, 3)

---

See also

• Awesome Hilarious GitHub Repositories
• The definitive list of lists