Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open Source is one person

opensourcesecurity.io

Post reply on HN
Print view View original

101–110 of 184 posts

Re: Open Source is one person

#101

Post by vitonsky »

msgodel wrote: post #98
vitonsky wrote: post #11

Huh, I just checked stats on ecosyste.ms It looks they consider as maintainer only those people who listed on package.json, not a real number of contributors on github or anything. So all conclusions in this post is based on wrong assumption and incorrect data interpretation. That's all you need to know about it. I think you could list random people on github in your package.json to looks cool in eyes of stats cultis…

Maintainers and contributors have overlapping but subtly different responsibilities AFAIK. Maintainers are the ones responsible in the end for the state of the repo while contributors suggest changes.

I have couple open source NPM packages I develop together with other developers. In some of this packages I have less than 50% contributions in code. But I listed as contributor on NPM, just because I found this packages and did not update contributors list a long time.

So definitions does not matter when stats that author refers, does not include a developers who own over 50% code in repo, but includes me as contributor.

That's widely known problem of programmers to believe that world is perfect and all data are always actual. Actually it won't.

Re: Open Source is one person

#102

Post by kube-system »

socksy wrote: post #99
kube-system wrote: post #28

Earlier quoted context omitted.

Under a microscope, maybe. But if you had a "perfect" piece of software that used Log4j in 2020, it wouldn't have been perfect for long. Unfortunately, there's a lot of reasons that software needs maintenance, even if it was thought to be perfect when it was originally written. Hardware changes. The software landscape changes. Dependencies are deprecated, or are found to have their own problems. Vulnerabilities are d…

Plenty of Clojure projects are "done" (the only community I'm aware of that actually believes in this) that presumably specified the vulnerable log4j versions. In reality, it's not an issue, because you can deal with it in your own deps.edn/project.clj/maven.xml, by excluding the dependency, or overriding it with a newer one.

> In reality, it's not an issue, because you can deal with it in your own deps.edn/project.clj/maven.xml, by excluding the dependency, or overriding it with a newer one.

This is maintenance. Maintenance is not an issue if you deal with it, if you don't deal with it, then it is an issue.

Re: Open Source is one person

#103

Post by renewiltord »

skeeter2020 wrote: post #57
ChrisMarshallNY wrote: post #33

Earlier quoted context omitted.

I don't think Russia (or China, either) has been truly communist, in a long time. Not sure there are any real communist nations left. It's one of those ideologies that looks good on paper, but falls apart, as soon as humans get added to the soup. Idealists never seem to account for base human nature.

>> It's one of those ideologies that looks good on paper, but falls apart, as soon as humans get added... Name an ideology where this doesn't happen.

Constitutional democracies with a free market have had a long run so far. We shall see if they last.

Re: Open Source is one person

#104

Post by lo_zamoyski »

ChrisMarshallNY wrote: post #41
ii41 wrote: post #40

Earlier quoted context omitted.

Your parent comment labeled themselves off-topic but I'd say they were still pretty on it, but you're like way too off-topic. The point isn't whether some country or some people are real communists or not, but that an individual shouldn't be harassed for maintaining open source software and can somehow be linked to some rival of the West.

Fair point. But, to be fair, the note about not taking human nature into account, applies everywhere . I think that we've all seen very smart people fail to account for human nature, and things go badly. Open source/free work is very human, and I have found it important to keep human nature in mind, as I work.

I agree that ignoring human nature is a bad move. In fact, a recipe for disaster for many reasons. Repress or disrespect it, and it will come back roaring with a vengeance.

I also agree that empirically, communism is always a disaster.

But I would also say that communism doesn't even look good on paper. It looks terrifying! To naive and frankly clueless young minds with no appreciation of human nature, human society, and so on, a superficial acquaintance with the subject matter might seem nice, as it might play on tropes and juvenile grievances, envies, and sentiments. But an honest look at it by an intellectually properly formed and informed mind will inspire horror. It is a dehumanizing ideology.

Now, that doesn't mean our hyperindividualist, capitalistic, and liberal consumerist societies don't have their share of poison. They do, and again, to a good degree because they misconstrue human nature. But communism or even socialism are no solution to these ills.

(JPII's "Centesimus Annus"[0], among more academic works by him and others, addresses some of this. People often pay attention to his anti-socialist, anti-communist legacy, but remain unaware of his critical stance toward capitalism and liberalism.)

[0] https://www.vatican.va/content/john-paul-ii/en/encyclicals/d...

Re: Open Source is one person

#105

Post by seangrogg »

conartist6 wrote: post #70
kube-system wrote: post #25

I feel like there's a lot of misunderstanding of this issue in the software community, because primarily, supply chain risk isn't a software or engineering issue. It's a governance issue. Someone doesn't have to be a bad actor for a project to have supply chain risk. Nor do all who evaluate supply chain risk have the same security posture and evaluate risks the same as others might. The DoD likely has a very differen…

Huh? The DoD would not have used the package if they hadn't read every line, locked it down for updates, and were ready to patch it themselves if needed. Can you really imagine in a war they'd be like "damn, if only there were a second person we also don't trust at all to do this work for us cause otherwise we'd just be SOL"

Damn, what country is this in? Maybe the US could learn a thing or two from this level of attention to detail.

Re: Open Source is one person

#106

Post by ozim »

After reading. For a person that calls out how people are not smart the author takes quite of mental shortcuts to make his point work.

NPM downloads are not equal to amount of projects as people plug in their CI/CD to download package on each build.

Then assuming just by sheer number that there must be something critical in the set or at least super important. Without putting effort to track at least one in some way.

That’s at least lazy especially if you call people „smart”. Then throw up some numbers thinking you’re the smart one.

Re: Open Source is one person

#107

Post by keybored »

ChrisMarshallNY wrote: post #33
tarvaina wrote: post #27

Earlier quoted context omitted.

(Off topic.) Not only that, but Linus's parents were politically active communists and young Linus was a pioneer (like a boy scout but for communists). His father also lived in Moscow for several years on two separate occasions.

I don't think Russia (or China, either) has been truly communist, in a long time. Not sure there are any real communist nations left. It's one of those ideologies that looks good on paper, but falls apart, as soon as humans get added to the soup. Idealists never seem to account for base human nature.

> Not sure there are any real communist nations left. It's one of those ideologies that looks good on paper, but falls apart, as soon as humans get added to the soup.

> Idealists never seem to account for base human nature.

Are the implicit “in practice” (cf on paper) and “base human nature” weird synonyms for America invading or doing a coup?

Re: Open Source is one person

#108

Post by seangrogg »

renewiltord wrote: post #103
skeeter2020 wrote: post #57

Earlier quoted context omitted.

>> It's one of those ideologies that looks good on paper, but falls apart, as soon as humans get added... Name an ideology where this doesn't happen.

Constitutional democracies with a free market have had a long run so far. We shall see if they last.

Curious how we're defining "democracy" and "free market" with this one. I wonder how countries with a pure democracy and an actually free market compare to the republic and regulated market we have in the US.

Re: Open Source is one person

#109

Post by krapp »

seangrogg wrote: post #108
renewiltord wrote: post #103

Earlier quoted context omitted.

Constitutional democracies with a free market have had a long run so far. We shall see if they last.

Curious how we're defining "democracy" and "free market" with this one. I wonder how countries with a pure democracy and an actually free market compare to the republic and regulated market we have in the US.

>I wonder how countries with a pure democracy and an actually free market compare to the republic and regulated market we have in the US.

They don't exist.

Re: Open Source is one person

#110

Post by kqr »

didgetmaster wrote: post #49

Has anyone seen any stats on what happens to a single maintainer project when said person is hit by a bus (or meets some other demise)? With that many data points, there should be enough of them by now to study it. Is the project taken over by another, single developer? Is it replaced by a similar project? Does it just go away?

The ones that come to mind are

- Hans Reiser, maintainer of ReiserFS. I think very few people use ReiserFS these days.

- Ian Murdock, creator of the Debian distribution. Debian lives on, but the project was also set up specifically to distribute maintenance.

- Jim Weirich, creator of the Rake build tool. I'm not a Rubyist so I don't know how it was affected, but I assume it's such a big part of Ruby other people took over.

- Peter Hintjens, co-creator of ZeroMQ. From what I understand, Hintjens was never the main developer but an active promoter. The project lives on as far as I know.

- Terry Davis, creator of TempleOS. I think development on TempleOS stopped.

Post reply on HN