Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

github.com

Post reply on HN
Print view View original

41–50 of 106 posts

Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

#41

Post by joh6nn »

OJFord wrote: post #26
joh6nn wrote: post #18

Earlier quoted context omitted.

Asking in seriousness: did you comment without reading the link? If so, why? I legit don't understand why people comment on things without having read them, and I would like to

I'm not who you asked, but sometimes the comments are more interesting (or perhaps intriguing, enticing, is a better way to put it) than the submission itself. Sometimes of those times my interest in the submission grows with reading some of the discussion, and then I'll read it. (Not to say I always do this, but I do definitely click first into comments more often than I go straight for the article - it allows a muc…

Interesting! But this sounds like an explanation why you read the comments without reading the article, not why you comment without reading, and those aren't inherently the same thing.

So to clarify: do you comment on the content of the post without reading it? I'm specifically interested in why people comment on links and articles they didn't read. And for maximum clarity here, I mean commenting on the content of the article, not just contributing to the various related discussions it spawns.

And to reiterate, I'm asking in earnest. It's not something I would do, so I'd like someone who does to weigh in.

Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

#42

Post by prmoustache »

nindalf wrote: post #33
zokier wrote: post #25

GitHub "community" is just awful. There are people trying to get real work done in that thread, but then there are all these random bystanders piling up to throw in their comments which range from useless to actively harmful and distracting. And it's not an isolated case, this happens pretty much always when some issues attracts attention on GH. Can't we respect the project and give the people there space to work, an…

I like the comment that started with "way too many arm chair 'researchers' in this thread" and then goes on to rudely say that the maintainers are doing a bad job because they merged in the original changes by Jia Tan. What are you sitting on, if not an arm chair? We all agree that the xz attack was of unparalleled sophistication and complexity, spread carefully over years , funded by a State. Many people were taken…

The question is still very relevant. Why are PR like this merged to begin with?

Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

#43

Post by freedomben »

nindalf wrote: post #33
zokier wrote: post #25

GitHub "community" is just awful. There are people trying to get real work done in that thread, but then there are all these random bystanders piling up to throw in their comments which range from useless to actively harmful and distracting. And it's not an isolated case, this happens pretty much always when some issues attracts attention on GH. Can't we respect the project and give the people there space to work, an…

I like the comment that started with "way too many arm chair 'researchers' in this thread" and then goes on to rudely say that the maintainers are doing a bad job because they merged in the original changes by Jia Tan. What are you sitting on, if not an arm chair? We all agree that the xz attack was of unparalleled sophistication and complexity, spread carefully over years , funded by a State. Many people were taken…

I thought that was a good question, and certainly one I'd like to know the answer too, but I very much agree it was done rudely. It didn't seem like it was asked in good faith.

Anyone who has maintained large/complex software like this knows that name recognition is worth a ton, and it kind of has to be that way. It's just not practical at all to scrutinize every commit/change as though the committer is an adversary, and particularly when you know the person it is not a reasonable ask. I would bet the truth is basically "yes, we knew him so it didn't get full scrutiny," and honestly that's an honest (but hard to give) answer.

I do hope (perhaps naively) that this (security code reviews) is something AI can get really good at in the future, because that would be a real value add IMHO.

Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

#44

Post by madeofpalk »

zokier wrote: post #25

GitHub "community" is just awful. There are people trying to get real work done in that thread, but then there are all these random bystanders piling up to throw in their comments which range from useless to actively harmful and distracting. And it's not an isolated case, this happens pretty much always when some issues attracts attention on GH. Can't we respect the project and give the people there space to work, an…

Absolute worst is when you see the "Hi from HN :wave:" comments when Github issues/PRs linked to from here.

Maintainers can 'lock down' the issue to just projects members, but that's very much an after-the-fact thing.

Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

#45

Post by poikroequ »

elric wrote: post #4

I'm a little unclear as to why JiaT75's github account still exists? Surely this should be nuked from orbit so that no one accidentally ends up using their shady code?

It's useful to keep it up so the public can scrutinize all their commits and fix anything suspicious.

Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

#46

Post by AshamedCaptain »

ivanjermakov wrote: post #28
zokier wrote: post #25

GitHub "community" is just awful. There are people trying to get real work done in that thread, but then there are all these random bystanders piling up to throw in their comments which range from useless to actively harmful and distracting. And it's not an isolated case, this happens pretty much always when some issues attracts attention on GH. Can't we respect the project and give the people there space to work, an…

This is why a lot of projects use other tools for bug tracking and merging, e.g. bugzilla, youtrack, atlassian etc.

The opposite. Whenever some project migrates to an inferior alternative like Github or Discord they always claim a number of arguments which boil down to "it's where people go these days" (e.g. less friction for newcomers, most people have an account there already, larger community, whatever excuse you can come up).

So I say they are getting exactly what they wanted to get.

Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

#47

Post by assbuttbuttass »

zokier wrote: post #25

GitHub "community" is just awful. There are people trying to get real work done in that thread, but then there are all these random bystanders piling up to throw in their comments which range from useless to actively harmful and distracting. And it's not an isolated case, this happens pretty much always when some issues attracts attention on GH. Can't we respect the project and give the people there space to work, an…

People treat Github like social media

Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

#48

Post by joh6nn »

freen wrote: post #23
joh6nn wrote: post #18

Earlier quoted context omitted.

Asking in seriousness: did you comment without reading the link? If so, why? I legit don't understand why people comment on things without having read them, and I would like to

Frist Psot culture is real: everyone else sees the “contribution”, and if it happens to be of marginal value, it earns karma. Stochastic karma farming benefits from a larger N, hence posting without reading.

Thanks for weighing in! But this is just speculation, right? Are you speaking from experience? I'm specifically looking for someone who does it to explain it.

I mean, I can make my own guesses about various forms of attention seeking and hopes to somehow cash in on high karma all day long but, to me it feels like HN is among the worst possible venues for that. I'm not aware of easy ways to convert HN karma into cash flow like you maybe could with followers on other platforms. So I don't immediately see a benefit in just farming karma for its own sake.

Is there some benefit to karma farming I'm not aware of? Like, some points-to-dollars conversion stream that I'm not in the loop on?

Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

#49

Post by bibinou »

joh6nn wrote: post #20

I'm confused why this is being posted now? This thread appears to have taken place in the days immediately following the original XZ discovery, with no new activity since very early April. It was discussed heavily at the time that Jia Tan had made contributions to other projects and that those were being investigated as well. Is there something new here I missed, or some additional context that makes this specific co…

Karma farming.

Re: Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)

#50

Post by BalinKing »

freedomben wrote: post #43
nindalf wrote: post #33

Earlier quoted context omitted.

I like the comment that started with "way too many arm chair 'researchers' in this thread" and then goes on to rudely say that the maintainers are doing a bad job because they merged in the original changes by Jia Tan. What are you sitting on, if not an arm chair? We all agree that the xz attack was of unparalleled sophistication and complexity, spread carefully over years , funded by a State. Many people were taken…

I thought that was a good question, and certainly one I'd like to know the answer too, but I very much agree it was done rudely. It didn't seem like it was asked in good faith. Anyone who has maintained large/complex software like this knows that name recognition is worth a ton, and it kind of has to be that way. It's just not practical at all to scrutinize every commit/change as though the committer is an adversary,…

This change doesn’t look like it would’ve required much scrutiny, though… it’s three lines long and seems (admittedly as an uninformed outsider) to be obviously wrong. Like, ignoring the fact that Jia Tan happened to be an adversary, I’m kinda shocked that their code review process let it through—unless the standard quite literally is “recognized contributors get rubber-stamped without further review.”
Post reply on HN