Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Xz: A microcosm of the interactions in open source projects

robmensching.com

Post reply on HN
Print view View original

321–330 of 353 posts

Re: Xz: A microcosm of the interactions in open source projects

#321

Post by figassis »

johannes1234321 wrote: post #202
figassis wrote: post #109

Earlier quoted context omitted.

Usually, I try to use projects in languages I work with so if the issue is not important enough for me to make a PR, then it’s not important enough. One thing I wish were possible is to sponsor an issue. I don’t usually sponsor open source projects, but I would likely sponsor a lot of issues just to speed up resolution. I think this could move a lot of projects in the right direction. Depending on difficulty, the mai…

An issue is that the maintainer may have other priorities. By sponsoring an item you "force" them to look at that sooner.

Probably, it is their choice to fix the issue and collect. An unresolved issue in the agreed timeline automatically refunds the money. Maintainer has the option to request more time. Donors can accept or reject. Ideally multiple people would sponsor an issue, so some percentage of funding would back out as deadlines are missed, but not all funding. Incentive is more delay, less reward.

Re: Xz: A microcosm of the interactions in open source projects

#322

Post by IshKebab »

kqr wrote: post #290
IshKebab wrote: post #285

Earlier quoted context omitted.

The former is more implausible because Chinese people with that level of English are quite rare, whereas English people able to create a fake Chinese username are not.

I feel like you're making three statistical mistakes at once. - First, we're not discussing the English level of the general Chinese population, but specifically of the group that's also good at programming. That conditional probability is much higher. - Even if we did speak of the general Chinese population, that is a lot of people so something rare in that group is true for many people still! - It's not like everyo…

> but specifically of the group that's also good at programming. That conditional probability is much higher.

That's the group I was discussing. Higher for sure, but still not high. (Remember we're talking about Chinese nationals, not Chinese ethnicity.)

> so something rare in that group is true for many people still

Yes but we're talking probabilities so the total population size is irrelevant. You're the one making the statistical mistake here.

> It's not like everyone in the US has great English either. (Though open source maintainers are again probably more likely to.)

Answered your own question there.

Re: Xz: A microcosm of the interactions in open source projects

#323

Post by lrvick »

ris wrote: post #289
lrvick wrote: post #248

Earlier quoted context omitted.

Debug it with a binary with debugging enabled on a debug dev system. Just like you would any other immutable firmware appliance. You could also in some cases have a debug container you pull in on demand, say if the host OS is an appliance-style k8s runtime like TalosOS.

Except the debug environment isn't _quite_ like the production environment, is it? Now you've got it working on the debug environment but weirdly broken on prod still..

They should be identical except for any debug tools. In fact they should ideally share the exact same root filesystem bit-for-bit, but then you can overlay mount debug tools in place in a dev/staging instance when required.

E.g. if you are running an immutable k8s runtime distro like TalosOS or Metropolis, you can choose to pull and mount a debug container with strace and gdb into the same process namespace of a problem pod, and when you are done all those debugging tools evaporate.

System mutability is why most bugs happen in the first place.

There should be no tools or services in prod except those required to run or monitor prod at runtime.

Re: Xz: A microcosm of the interactions in open source projects

#324

Post by lrvick »

rafpin wrote: post #234
lrvick wrote: post #171

Earlier quoted context omitted.

I do not use or recommend security through obscurity. Such things can always be automatically discovered. https://github.com/eliemoutran/KnockIt Any effort spent on setups like this is likely better spent removing the need for having ssh at all by moving to immutable appliance distros be they specialized like homeassistant or general purpose like TalosOS.

> Such things can always be automatically discovered. Wouldn't fail2ban + reasonably sized (10+ ports using a mix of udp and tcp) knock sequence prevent brute force attacks like these?

You can potentially go down those rabbit holes, then an attacker gets fixated on you for being so unusual and they come back doing only 2 attempts per ip per day with thousands of IPs. I have been on both sides of this game many times.

Better time investment in security is just do not have ssh or a shell in production in the first place, because ssh is probably not required for your production application to function.

Re: Xz: A microcosm of the interactions in open source projects

#325

Post by tgv »

yunohn wrote: post #98
tgv wrote: post #23

Earlier quoted context omitted.

No, maintaining such software should be a paid job. Not that that guarantees all, but it could be a step.

Who is the employer? I’m all for supporting open source and am a maintainer and contributor myself, but I don’t think blindly stating it should be a job is the solution.

That's a thorny question. Self-employed is an option, but it limits the possibilities: a small project/library won't bring enough funding, so you'd have to acquire more projects and funding. A larger company doing only OSS could work. It can help keeping all those languishing projects up to date, because it's simply part of someone's job now instead of voluntary work after hours. Such a company could also organize security checks and vet the contributors. Didn't Redhat work like that?

But it's not a solution for all problems.

Re: Xz: A microcosm of the interactions in open source projects

#326

Post by xtracto »

AnonymousPlanet wrote: post #158
tkiolp4 wrote: post #97

If I were a chinese hacker trying to do something evil, why on earth would I use a chinese handler/username? Wouldn’t it be better to use an English/European name to gain (even more) trust from open source maintainers? On the other hand, if I were a non-chinese hacker trying to do evil, then using a chinese handler does make more sense (China is evil, blah blah blah)

Since we're reading tea leaves: They also used a sock puppet with a seemingly German name (Hans Jansen). However "Hans" has not been a popular baby name in German speaking countries for many decades. You'd expect any "Hans" to be over 70 or 80 by now. Unless they are American, like Hans Niemann. This could be a cultural oversight on the attacker's side, which points towards any culture that has a wide spread belief t…

What? I know at least 2 Hans who are native german, and are no older than 40. And I lived in Germany only for 4 years.

Re: Xz: A microcosm of the interactions in open source projects

#327

Post by rrr_oh_man »

mrob wrote: post #214
rrr_oh_man wrote: post #195

Earlier quoted context omitted.

> I think this is why I don't do social media any more Guess what you’re doing here, buddy.

IMO, it's not social media unless there's a social graph. HN has no way to follow or otherwise establish some relationship with specific users, so it's just a forum, not social media.

Old school Twitter?

Re: Xz: A microcosm of the interactions in open source projects

#328

Post by fl0ki »

gavinhoward wrote: post #218

And this is why, for my build system coming out in two days, you need to pay to have me respond to bug reports.

You just reinvented the "it's open source but we charge for support" model which has been so well known for so long that it was a line in the movie Antitrust (2001).

Re: Xz: A microcosm of the interactions in open source projects

#329

Post by mrob »

rrr_oh_man wrote: post #327
mrob wrote: post #214

Earlier quoted context omitted.

IMO, it's not social media unless there's a social graph. HN has no way to follow or otherwise establish some relationship with specific users, so it's just a forum, not social media.

Old school Twitter?

Was there ever a public release of Twitter with no support for following specific users?

Re: Xz: A microcosm of the interactions in open source projects

#330

Post by tb_technical »

cqqxo4zV46cp wrote: post #112
kimixa wrote: post #31

I do sometimes wonder if by trying to be "nice" to users and try to see the best intentions of commenters, many developers waste huge amounts of mental energy. For context, I've really only worked on "fun" side projects, namely emulators and game remakes, where I've explicitly avoided any mention of donations or similar. Both as it's intended to be a distraction from my job, not become part of it. And generally avoid…

My layperson’s opinion is that anything to do with gaming is particularly riddled with people that interact poorly with maintainers. Again, purely my opinion: gamer culture invites a particular sort of Dunning-Kruger-prone ‘power user’ type. Every gamer community carries with it a corpus of baseless, fictitious, technical information. “The developers didn’t do this because x”, “it’s ridiculous that they didn’t just y…

Games are meant to be accessible to the public (in order to make the most money) - as in, easy to obtain, install, configure, and use. When you interact with the public, you're going to get all kinds of people. Even the crazy awful ones.

As for reddit and forum posts? The people willing to make an account to just to complain online are the most motivated of the negative people.

Post reply on HN