Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Xz: A microcosm of the interactions in open source projects

robmensching.com

Post reply on HN
Print view View original

211–220 of 353 posts

Re: Xz: A microcosm of the interactions in open source projects

#211

Post by forgotmyinfo »

stavros wrote: post #120
arp242 wrote: post #111

Earlier quoted context omitted.

Anything can be viewed as a judgement statement if you paraphrase or stretch things enough. I don't think your paraphrasings are a fair representation of what I actually said. But you can insert "I'm not trying to blame anyone, but here are some suggestions to modify cultural norms so these things are less likely to happen in the future" if you want. Or you can just assume good faith and take that as implied unless d…

But what's the advice here? "When people are trying to peer pressure you, don't accept?"

Yes? Block, move on. It's the internet, you aren't forced to interact with anyone. If you are, get a better source code hosting platform.

Re: Xz: A microcosm of the interactions in open source projects

#212

Post by ninkendo »

noobermin wrote: post #188
nuc1e0n wrote: post #157

My take away from this is that people are still far too blasé about introducing hard dependencies and complexity, even after the left-pad incident as a warning. OpenSSH is a massive wall of code. Such complex systems are inherently untrustworthy to me, no matter what language they might be written in. Even with ernest devs there are still more opportunities for mistakes.

This wasn't a vulnerability in openssh though, this was from systemd, where I think your point in fact is stronger.

It’s not a vulnerability in systemd either, it’s a vulnerability in xz, which libsystemd depends on, and libsystemd is only integrated into OpenSSH in certain distributions, and only to avoid writing ~5 lines of C code to write the string “READY=1” to a socket specified in an environment variable.

Systemd itself doesn’t even use lzma/xz… libsystemd does, and that’s a library meant to help other software integrate with systemd. It’s not really the same thing.

Re: Xz: A microcosm of the interactions in open source projects

#213

Post by bityard »

ninkendo wrote: post #192
aumerle wrote: post #65

Earlier quoted context omitted.

You dont need to wonder. Any long term maintainer of even semi popular open source projects will tell you that engaging with the peanut gallery is completely counter productive. Engage with people that have earned it in your eyes, whether by contributing to your project via code, assets, bug triage, writing a good and effortful bug report, whatever. Just ignore what the larger internet has to say about you and your c…

What form should this ignoring take, in your eyes? I’ve never maintained an open source project but I’d imagine this is the hard part, how to politely decline the peanut gallery’s feedback. Do you disable GH issues? Leave them open and ignore them? Decline with some boilerplate language? How do you stop people from being mad that you’re ignoring them? (IME these types of people are likely to take things personally an…

You say, "Sorry, I don't have the bandwidth for this right now. I am closing this issue for now but it can be reopened if anyone else is sufficiently motivated to submit a patch."

> How do you stop people from being mad that you’re ignoring them? (IME these types of people are likely to take things personally and start harassing you or complaining loudly in other forums…)

You don't (and can't) stop people from being unreasonable, mad, angry, or upset. That is their own choice. What you describe is bullying, plain and simple. Being nice to them because they might escalate later is counter-productive to your own mental health and gives them agency over your own time and energy. With bullies, the only way to win is to not play the game.

Re: Xz: A microcosm of the interactions in open source projects

#214

Post by mrob »

rrr_oh_man wrote: post #195
PaulRobinson wrote: post #94

Earlier quoted context omitted.

I've been thinking about contributing to some open source projects, and starting a couple of things of my own, and the community aspect is a significant downside for me, and I say that as somebody who was quite active in several open source projects and things like the IETF years ago. I'm not saying the community shouldn't be there, it's just that the barrier to entry is so low, that people can "contribute" with very…

> I think this is why I don't do social media any more Guess what you’re doing here, buddy.

IMO, it's not social media unless there's a social graph. HN has no way to follow or otherwise establish some relationship with specific users, so it's just a forum, not social media.

Re: Xz: A microcosm of the interactions in open source projects

#215

Post by 2OEH8eoCRo0 »

arp242 wrote: post #39
SuperHeavy256 wrote: post #10

So the first step of this huge mess was: a social engineering attack. Attacking a tired, burnt-out open source project developer and peer pressuring him into giving more control of the repo to the attacker.

In the end you're only pressured as much as you allow yourself to be pressured. "I don't feel like it, if it's important to you then feel free to fork". That's really all that's needed. "I don't feel like it" is all the justification you need. Some guy just made a compression tool, because some people like doing that kind of thing, or because it was useful for him. He didn't ask to be made "critical infrastructure" o…

You don't even have to say, "I don't feel like it." You don't have to say anything.

Re: Xz: A microcosm of the interactions in open source projects

#216

Post by keybored »

AnonymousPlanet wrote: post #173
ginko wrote: post #166

Earlier quoted context omitted.

>They also used a sock puppet with a seemingly German name (Hans Jansen). However "Hans" has not been a popular baby name in German speaking countries for many decades. You'd expect any "Hans" to be over 70 or 80 by now. Unless they are American, like Hans Niemann. Jansen is a Danish/Norwegian surname and Hans is still fairly popular in Denmark. https://www.dst.dk/en/Statistik/emner/borgere/navne/navne-i-...

Interesting. Jansen is pretty common in Germany aswell. How old would a typical Danish Hans be? From what I can see in [1], Hans hasn't been a popular baby name for decades in Denmark either. Edit: Another country that seems to have retained popularity for "Hans" for a longer time than Germany is the Netherlands. According to [2], its popularity seems to have gone down significantly as well, with a further sharp drop…

> Interesting.

Ironic.

> > This could be a cultural oversight on the attacker's side,

Re: Xz: A microcosm of the interactions in open source projects

#217

Post by [deleted] »

ninkendo wrote: post #192
aumerle wrote: post #65

Earlier quoted context omitted.

You dont need to wonder. Any long term maintainer of even semi popular open source projects will tell you that engaging with the peanut gallery is completely counter productive. Engage with people that have earned it in your eyes, whether by contributing to your project via code, assets, bug triage, writing a good and effortful bug report, whatever. Just ignore what the larger internet has to say about you and your c…

What form should this ignoring take, in your eyes? I’ve never maintained an open source project but I’d imagine this is the hard part, how to politely decline the peanut gallery’s feedback. Do you disable GH issues? Leave them open and ignore them? Decline with some boilerplate language? How do you stop people from being mad that you’re ignoring them? (IME these types of people are likely to take things personally an…

[deleted]

Re: Xz: A microcosm of the interactions in open source projects

#219

Post by barcist »

creato wrote: post #61
b112 wrote: post #38

Earlier quoted context omitted.

This is why OSS can be more secure. How much software has the build scripts, the code, all of it, locked away and hidden behind propriety software? Instead of lots of eyes, just 2 DEVs? Yes, this almost succeeded... but can you imagine how many scenarios where someone such as Andres Freund would have found irregularities, but then.. what? Just had to report it to some webpage's contact page? Without being able to eve…

I think there are huge factors that push things both for and against open source here. Yes, you get more eyes and people like Andres Freund. However, if this had been a mole in a company, he wouldn't be able to hide behind a possibly anonymous fake persona and (likely) be immune from any consequences/fallout from this attack. It would be harder to gain entry in the first place, he would have needed a real identity. B…

In a corporate proprietary code base this is REALLY easy. Just commit a bug. Happens every day, everywhere. Just that normally these are mistakes. You can easily mask a deliberately inserted exploitable bug as a mistake. Make the code a bit convoluted, leave out a crucial corner case from your test, slip this in in a moment when your code reviewers have time pressure and/or are stressed somehow, and even if you are caught, the plausible deniability is convincing. How many eyes will see it after the fact? None.

Re: Xz: A microcosm of the interactions in open source projects

#220

Post by krupan »

rhdunn wrote: post #110
ribasushi wrote: post #7

Earlier quoted context omitted.

> Help in maintainship how? Pay.

Pay is not the only thing regarding maintainership. Time is another factor. It takes time to maintain software, improve the codebase, add features, etc. Then there are the other tasks such as answering questions, reviewing PRs, triaging bugs and feature requests, etc. So getting more contributors, people to assist with bugs and bug investigations, etc. is arguably more important. Especially projects developed by a si…

Time is money

Time and money are not actually 100% fungible, but there is a lot of truth to it, especially given enough money.

Maintainers are human. They need to eat, to sleep, to visit the doctor, to rest when they get sick, to participate in activities that reduce stress and foster human relationships. Money makes all of that much easier.

Post reply on HN