Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open Source is one person

opensourcesecurity.io

Post reply on HN
Print view View original

161–170 of 184 posts

Re: Open Source is one person

#161

Post by mike_hearn »

ChrisMarshallNY wrote: post #33
tarvaina wrote: post #27

Earlier quoted context omitted.

(Off topic.) Not only that, but Linus's parents were politically active communists and young Linus was a pioneer (like a boy scout but for communists). His father also lived in Moscow for several years on two separate occasions.

I don't think Russia (or China, either) has been truly communist, in a long time. Not sure there are any real communist nations left. It's one of those ideologies that looks good on paper, but falls apart, as soon as humans get added to the soup. Idealists never seem to account for base human nature.

Don't forget about North Korea.

China is still pretty communist, even if you define it purely economically rather than by all the other traits too (e.g. heavy censorship). The list of largest employers in the world has a lot of state owned Chinese firms.

Re: Open Source is one person

#162

Post by blueflow »

supportengineer wrote: post #132
M95D wrote: post #130

Earlier quoted context omitted.

Nicely said, but the reality is that no software is "perfected", just abandoned. Hell, even sysvinit had some big updates recently.

qmail, djbdns, grep, awk, sed, TeX, SQLite, zlib, curl

runit. Every other year someone forks it because they think its abandoned, make some commits for some weeks, and then find nothing else to change and start to look abandoned themselves.

Re: Open Source is one person

#163

Post by johneth »

Just FYI: I got a modal in Chrome asking "Did you mean opensource.google? Attackers sometimes mimic sites by making hard-to-see changes to the web address."

I'm sure there's nothing you can do about it, but thought you might want to know.

Re: Open Source is one person

#164

Post by qn9n »

didgetmaster wrote: post #49

Has anyone seen any stats on what happens to a single maintainer project when said person is hit by a bus (or meets some other demise)? With that many data points, there should be enough of them by now to study it. Is the project taken over by another, single developer? Is it replaced by a similar project? Does it just go away?

When Bram passed away Vim was passed on to the core maintainers there.

Re: Open Source is one person

#165

Post by firesteelrain »

pabs3 wrote: post #158
firesteelrain wrote: post #156

Earlier quoted context omitted.

> If who wrote some code matters to you, then your supply chain management is simply insufficient. I am not following. Source country is absolutely a thing when certain industries look at open source. That’s what Hunted Labs does

Its completely irrelevant if you are doing things properly.

Can you elaborate?

Re: Open Source is one person

#166

Post by bitwize »

kqr wrote: post #110
didgetmaster wrote: post #49

Has anyone seen any stats on what happens to a single maintainer project when said person is hit by a bus (or meets some other demise)? With that many data points, there should be enough of them by now to study it. Is the project taken over by another, single developer? Is it replaced by a similar project? Does it just go away?

The ones that come to mind are - Hans Reiser, maintainer of ReiserFS. I think very few people use ReiserFS these days. - Ian Murdock, creator of the Debian distribution. Debian lives on, but the project was also set up specifically to distribute maintenance. - Jim Weirich, creator of the Rake build tool. I'm not a Rubyist so I don't know how it was affected, but I assume it's such a big part of Ruby other people took…

Reiserfs died because alternatives, like ext3/ext4 and btrfs, became readily available.

TempleOS has a fork called ZealOS. Terry Davis really was the "Wesley Willis of programming", and he had friends and fans worldwide, some of whom have taken up TempleOS development under the ZealOS banner.

Re: Open Source is one person

#167

Post by Ygg2 »

const_cast wrote: post #123
kube-system wrote: post #25

I feel like there's a lot of misunderstanding of this issue in the software community, because primarily, supply chain risk isn't a software or engineering issue. It's a governance issue. Someone doesn't have to be a bad actor for a project to have supply chain risk. Nor do all who evaluate supply chain risk have the same security posture and evaluate risks the same as others might. The DoD likely has a very differen…

Guys say it with me: vendor your packages! VENDER YOUR PACKAGES!

Vendor or fork?

Re: Open Source is one person

#168

Post by EdiX »

wolvesechoes wrote: post #160
EdiX wrote: post #115

Earlier quoted context omitted.

> capitalism + technology relies on unpaid, voluntary labour You are falling into the breadtube trap of faulting capitalism for a societal issue that has nothing to do with it. Did capitalism force people to have productive hobbies? Would you prefer a system, other than capitalism, that prevented people from having productive hobbies? Often times this error relies on the assumption that capitalism is what's preventin…

It is funny how you recognize the "breadtube trap", yet you are so invested in the "no alternative" ideology.

Maybe it would help if you articulated it even a little bit.

Re: Open Source is one person

#169

Post by kpcyrd »

const_cast wrote: post #123
kube-system wrote: post #25

I feel like there's a lot of misunderstanding of this issue in the software community, because primarily, supply chain risk isn't a software or engineering issue. It's a governance issue. Someone doesn't have to be a bad actor for a project to have supply chain risk. Nor do all who evaluate supply chain risk have the same security posture and evaluate risks the same as others might. The DoD likely has a very differen…

Guys say it with me: vendor your packages! VENDER YOUR PACKAGES!

How about: commit your dependency lockfiles, make sure they use content-addressing cryptographic checksums like Cargo.lock does.

This is also needed for both reproducible builds and SBOMs.

If you commit the actual source code you're making things worse, because it makes coordinated source code review efforts a lot harder. Also patch management with actual vendored source code is terrible.

Re: Open Source is one person

#170

Post by kube-system »

ridifndnwj wrote: post #145
kube-system wrote: post #36

Earlier quoted context omitted.

2.x had been out for about six years by the time the vulnerability was discovered.

And 1.x was and has been logging for a decade or more before that which is why I thought it relevant to the ‘no need to upgrade’ discussion

The world didn't stop building new software for that 6 year period, is my point. One would have picked the latest version to build something during that time period.
Post reply on HN