Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open source ‘protestware’ harms Open Source

opensource.org

Post reply on HN
Print view View original

211–220 of 575 posts

Re: Open source ‘protestware’ harms Open Source

#211

Post by pelasaco »

zucker42 wrote: post #152
ksec wrote: post #104

Earlier quoted context omitted.

You pretty much summarise what is wrong with the title. It is not "Protestware" that harms open source. It is politics and ideology harms open source. And the rate things are going may be Open Source will not only be split between permissive and copyleft, but progressive and libreRight. Edit: Now I remember Douglas Crockford's "The Software shall be used for Good, not Evil." license. I wonder if there are still any o…

> It is politics and ideology harms open source. The movement towards free and open source software was created in no small part do to activists with a very strong ideology. Open source would not exist to the same extent without the ideology espoused by the FSF. The problem is that abandoning a key tenant of the free software movement, neutrality towards different uses (part of freedom 0 of the free software definiti…

That's exactly what I would write here. FLOSS is basically a political movement against the software industry since 1960...

Re: Open source ‘protestware’ harms Open Source

#212

Post by FredPret »

mothsonasloth wrote: post #35

Thankfully none of my Java deps have turned my files into digital swiss cheese.... yet! What is it with some people wanting to "make the world a better place", but end up starting fires and making it worse. Is it just middle class western liberal arrogance manifesting through a software developer's actions? I don't want to make the world a better place, I just want to keep it from burning.

I just want to use Javascript to display the odd modal!

Re: Open source ‘protestware’ harms Open Source

#213

Post by tjpnz »

kekebo wrote: post #174

Could (/should) this be mitigated on the repository host side by scanning for and flagging malicious commits? A paper from last year evaluating this on Github achieves a ~50% success rate[0]. Given Github already training ml models across all repositories for Copilot I would guess higher rates would be possible. [0] https://arxiv.org/abs/2103.03846 Edit: add link

IIRC the recent examples of genuine "protestware" included a modification to the license. There are already tools on the SCM side which will detect that (Whitesource being one).

Re: Open source ‘protestware’ harms Open Source

#214

Post by HideousKojima »

devmunchies wrote: post #203
HideousKojima wrote: post #184

Earlier quoted context omitted.

Sure, just like most men aren't violent criminals but men are still statistically more likely to be violent criminals. The point is that JS devs seem (perhaps a proper statistical study will show otherwise) more likely per capita to shit up their ecosystem. There are several reasons contributing to this (the limited JS standard lib being a big one) but a major part of it really seems to be that JS devs are a differen…

> men are still statistically more likely to be violent criminals I think your meant criminals are more likely to be men.

No, I meant exactly what I said, more men are violent criminals per capita than women. What you said is also true, but it's not what I meant.

Re: Open source ‘protestware’ harms Open Source

#215

Post by dmos62 »

ekianjo wrote: post #147
dmos62 wrote: post #118

Earlier quoted context omitted.

> How about not taking sides instead of acting like a kid If you have the power to do something and you don't, that's taking a side. You either oppose something or you enable it. At least own that. If you're saying you're neutral, you either agree with the unpopular side and are scared to admit it, or you can't form an opinion because you're uninformed and thus uncivil, or you feel unaffected by what's happening and…

> If you have the power to do something and you don't, that's taking a side. Pushing political commit messages is not "power". If you like like everyone around you you are not a rebel, just a conformist. And using indiscriminate IP-location malware to annoy people is the textbook definition of evil child behavior. I'm not sure what exactly you are trying to defend here. > By the way, everything is not propaganda: ant…

> Pushing political commit messages is not "power".

I'm not debating whether it works or whether it's the right form of activism. I'm responding to your comment. Namely you saying that taking a side is childish.

> If you like like everyone around you you are not a rebel, just a conformist.

If your goal is to follow the herd, that's bad. If it's to go in the opposite direction, that's the same thing. I'd encourage a person like that to think about more than himself.

> How do you know what the truth is when you have no foot on the ground?

Are you disputing the recent Russia's invasion of Ukraine?

Re: Open source ‘protestware’ harms Open Source

#216

Post by avgcorrection »

matsemann wrote: post #99
ekianjo wrote: post #91

Earlier quoted context omitted.

No, not taking sides is just not taking sides. There's no need to turn such a position into a shortcut to something else. It's as stupid as the kids saying "if you are not with us you are against us". Typical populist bullshit.

How hard is it to just say "I think Russia is wrong for invading Ukraine and killing people"? That's all you have to do. Just write it. If you can't do that, but still want to engage in the discussion on the topic, your standpoint is clear. You're not some holier person not taking a stand. You have taken one, you just don't dare to spell it out.

People with a contrarian streak are never going to performatively denounce something on command if they want to make a point which is unrelated to that denounciation.

Re: Open source ‘protestware’ harms Open Source

#217

Post by JumpCrisscross »

FerociousTimes wrote: post #182
JumpCrisscross wrote: post #29

Earlier quoted context omitted.

Charitably, it creates a new friction for Russian business in deploying open-source software. That drag further diminishes Russia’s economy, and thus, its warmaking ability.

At best, this operation could be construed as an act of vandalism or at worst an act of CYBER terrorism. This indiscriminate and malicious act of hostility was carried by what amounted to be a cyber weapon (think IED) housed in a very ordinary and non-suspicious package to cause the greatest damage to the users' data.

> this operation could be construed as an act of vandalism or at worst an act of CYBER terrorism

Could be. But by whom? To what effect?

One of the downsides of losing credibility as a nation state is the concepts of deference, retaliation and proportionality lose weight. There is no indication that the facts on the ground would affect whether Putin deems something a cyber attack. Worse, one's own policing actions are likely to cause more damage as propaganda pieces than ignoring the issue.

Yes, in an international law framework this would be prosecuted in the U.S. But in that framework Russia wouldn't be in Ukraine. Add to that it's tacit approval of its own hackers, and it's difficult--in a realpolitik frame--to find support for doing anything about this other than minor finger wagging.

Re: Open source ‘protestware’ harms Open Source

#218

Post by Aperocky »

Traster wrote: post #204

>The “weaponization of open source” as Gerald Benischke calls it in his March 16 blog post is indiscriminate, and the collateral damage it causes damages the work of developers and operators solely because they have a Russia-assigned IP address. It harms peacemakers as much as the warmongers—even ethical hackers using a VPN to work against the invasion might become collateral damage. I think this is a weirdly bad arg…

> same way that hundreds of western countries have pulled their businesses out of China.

First of all, there aren't 100s of western countries...

Re: Open source ‘protestware’ harms Open Source

#219

Post by pelasaco »

bjt2n3904 wrote: post #18
commandlinefan wrote: post #5

I'm in Texas. A LOT of Californians disagree with some of the laws that Texas has passed. How long will it be until my hard drive gets reformatted by some protestor in San Francisco who localizes my IP address?

I have legitimately argued against using NodeJS as the foundation of our next product for this very reason. NodeJS' culture is very much "move fast and break things", and "all software is political". Look at the TSC drama. Leftpad.js. This isn't an ecosystem that you want to build and maintain a product on.

again, nothing blocks you to have a better supply chain to your software:

Download all dependencies and freeze them, fork the dependencies and groom your fork or have dependantbot or depfu managing your dependencies for you and keep a delay between merging the PRs, have manual review, etc..

You shouldn't be pulling stuff from internet and pushing to production without take a look into that anyway...

Post reply on HN