Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open Source is one person

opensourcesecurity.io

Post reply on HN
Print view View original

121–130 of 184 posts

Re: Open Source is one person

#121

Post by AlienRobot »

ysofunny wrote: post #17
blueflow wrote: post #4

If they had done an activity check they would have seen that half of all projects have zero maintainers.

software once "perfected" (working well enough long enough) needs NO maintenance. No cleaning. No calibrating/tunning. updating is a systemic issue, not a per-project matter

You'd think so, but you make something then it doesn't work on a new version of windows, or it doesn't work on a new version of python because one of your dependencies isn't available for that version of python, or it doesn't work on linux if it doesn't have a specific version of packages, or it doesn't work on the browser because they're ditching manifest v2, or it doesn't work on android because you need to provide more personal information or your app will be unpublished.

At this point I have a feeling "perfect" software only exists in hardware like consoles where updates just stop one day.

Re: Open Source is one person

#122

Post by kazinator »

conartist6 wrote: post #70
kube-system wrote: post #25

I feel like there's a lot of misunderstanding of this issue in the software community, because primarily, supply chain risk isn't a software or engineering issue. It's a governance issue. Someone doesn't have to be a bad actor for a project to have supply chain risk. Nor do all who evaluate supply chain risk have the same security posture and evaluate risks the same as others might. The DoD likely has a very differen…

Huh? The DoD would not have used the package if they hadn't read every line, locked it down for updates, and were ready to patch it themselves if needed. Can you really imagine in a war they'd be like "damn, if only there were a second person we also don't trust at all to do this work for us cause otherwise we'd just be SOL"

> DoD would not have used the package if ...

That's a lot of faith in military intelligence.

Re: Open Source is one person

#123

Post by const_cast »

kube-system wrote: post #25

I feel like there's a lot of misunderstanding of this issue in the software community, because primarily, supply chain risk isn't a software or engineering issue. It's a governance issue. Someone doesn't have to be a bad actor for a project to have supply chain risk. Nor do all who evaluate supply chain risk have the same security posture and evaluate risks the same as others might. The DoD likely has a very differen…

Guys say it with me: vendor your packages! VENDER YOUR PACKAGES!

Re: Open Source is one person

#125

Post by phkahler »

Most the stuff on github is something one person wrote, stuck on there, and nobody uses. Then there's a bunch of things that are one person, but some small number of people use or have used it. Most big OSS programs have more than one person behind them. The vulnerable things tend to be dependencies of larger projects - small, but useful enough to get used in larger things.

Re: Open Source is one person

#126

Post by renewiltord »

idiotsecant wrote: post #119
renewiltord wrote: post #113

Earlier quoted context omitted.

The US is a constitutional democracy with a free market and I consider it successful. The definitions of these words can be the predominant use of these words in the English language. But if you want "constitutional democracy" here use this: https://civiced.org/lesson-plans/constitutional-democracy And for free market here, use this: https://www.investopedia.com/terms/f/freemarket.asp People frequently misunderstand…

The vast majority of markets in the US are hardly free. Every single large company in the US is heavily government subsidized, market protectionism is rife, and regulatory capture and artificial moat-building is the norm. I think it's quite a stretch to day we have a free market. Maybe a 'free-er' market.

So be it. s/free/free-er/g in comments above if that will lead to convergence.

Re: Open Source is one person

#127

Post by lern_too_spel »

dzonga wrote: post #85

the west or those with largely liberal viewpoints who think in black and white vs seeing the world as grey are gonna cost the west a lot. we already saw this - with 'cancel' mafia. because russia or i.e putin invaded ukraine doesn't mean the whole russia is bad. or you shouldn't interact with russia at all. no one stopped interacting with usa after they invaded iraq. just because russia doesn't give a shit about lgbt…

You are not familiar with how Putin thinks. https://en.wikipedia.org/wiki/Foundations_of_Geopolitics

Re: Open Source is one person

#128

Post by popalchemist »

didgetmaster wrote: post #49

Has anyone seen any stats on what happens to a single maintainer project when said person is hit by a bus (or meets some other demise)? With that many data points, there should be enough of them by now to study it. Is the project taken over by another, single developer? Is it replaced by a similar project? Does it just go away?

If it's open-source, and the original breaks for any reason, it's typically forked and continues life. See: Redis (recently).

Re: Open Source is one person

#129

Post by seangrogg »

renewiltord wrote: post #113
seangrogg wrote: post #108

Earlier quoted context omitted.

Curious how we're defining "democracy" and "free market" with this one. I wonder how countries with a pure democracy and an actually free market compare to the republic and regulated market we have in the US.

The US is a constitutional democracy with a free market and I consider it successful. The definitions of these words can be the predominant use of these words in the English language. But if you want "constitutional democracy" here use this: https://civiced.org/lesson-plans/constitutional-democracy And for free market here, use this: https://www.investopedia.com/terms/f/freemarket.asp People frequently misunderstand…

> The free market is an economic system based on supply and demand with little or no government control.

Given the amount of government subsidy and regulation that exists in our markets I assume this, too, is a simply ESL error that can be fixed quickly?

Re: Open Source is one person

#130

Post by M95D »

ysofunny wrote: post #17
blueflow wrote: post #4

If they had done an activity check they would have seen that half of all projects have zero maintainers.

software once "perfected" (working well enough long enough) needs NO maintenance. No cleaning. No calibrating/tunning. updating is a systemic issue, not a per-project matter

Nicely said, but the reality is that no software is "perfected", just abandoned.

Hell, even sysvinit had some big updates recently.

Post reply on HN