Reminds me of what was it... Heartbleed? Then everyone realized its a library mostly maintained by one underfunded developer? Critical piece of software, underfunded.
Open Source is one person
171–180 of 184 posts
Re: Open Source is one person
#172I feel like there's a lot of misunderstanding of this issue in the software community, because primarily, supply chain risk isn't a software or engineering issue. It's a governance issue. Someone doesn't have to be a bad actor for a project to have supply chain risk. Nor do all who evaluate supply chain risk have the same security posture and evaluate risks the same as others might. The DoD likely has a very differen…
> And while most people don't prepare for war while choosing their packages, it's not unreasonable for a military to do so. During a war, the ability for people to govern themselves and their own projects often changes dramatically, even in democratic countries. It is entirely routine for countries to require cooperation by the force of law in war time, even the US can and has forced private companies to cooperate with war efforts. This is probably not in the security posture calculation for most of us. But it is for some.
Reading this I'm really hoping the DOD maintains mirrors of GitHub projects that are vital to them.
Re: Open Source is one person
#173Earlier quoted context omitted.
Guys say it with me: vendor your packages! VENDER YOUR PACKAGES!
How about: commit your dependency lockfiles, make sure they use content-addressing cryptographic checksums like Cargo.lock does. This is also needed for both reproducible builds and SBOMs. If you commit the actual source code you're making things worse, because it makes coordinated source code review efforts a lot harder. Also patch management with actual vendored source code is terrible.
And mirror your dependencies.
Re: Open Source is one person
#174Earlier quoted context omitted.
Fair point. But, to be fair, the note about not taking human nature into account, applies everywhere . I think that we've all seen very smart people fail to account for human nature, and things go badly. Open source/free work is very human, and I have found it important to keep human nature in mind, as I work.
I agree that ignoring human nature is a bad move. In fact, a recipe for disaster for many reasons. Repress or disrespect it, and it will come back roaring with a vengeance. I also agree that empirically, communism is always a disaster. But I would also say that communism doesn't even look good on paper. It looks terrifying! To naive and frankly clueless young minds with no appreciation of human nature, human society,…
> But I would also say that communism doesn't even look good on paper. It looks terrifying! To naive and frankly clueless young minds with no appreciation of human nature, human society, and so on, a superficial acquaintance with the subject matter might seem nice, as it might play on tropes and juvenile grievances, envies, and sentiments. But an honest look at it by an intellectually properly formed and informed mind will inspire horror. It is a dehumanizing ideology.
Notice the abundance of adjectives and complete lack of argumentation.
Re: Open Source is one person
#175Earlier quoted context omitted.
I agree that ignoring human nature is a bad move. In fact, a recipe for disaster for many reasons. Repress or disrespect it, and it will come back roaring with a vengeance. I also agree that empirically, communism is always a disaster. But I would also say that communism doesn't even look good on paper. It looks terrifying! To naive and frankly clueless young minds with no appreciation of human nature, human society,…
> But I would also say that communism doesn't even look good on paper. It looks terrifying! To naive and frankly clueless young minds with no appreciation of human nature, human society, and so on, a superficial acquaintance with the subject matter might seem nice, as it might play on tropes and juvenile grievances, envies, and sentiments. But an honest look at it by an intellectually properly formed and informed min…
If you're too lazy to read the linked encyclical, just say so. Don't hide behind vacuous moralizing.
Re: Open Source is one person
#176I've heard good things about work done by this guy Linus. I'm pretty sure that I've used his work. I think he comes from a country that borders Russia, so should we be worried? I've done OSS for decades; mostly by myself, but sometimes, in teams of volunteers. If anyone has any experience, working in teams of volunteers, it can be ... challenging . It can definitely work, but not as often as you'd think. If it works,…
Curious, because just recently he expelled Russian maintainers from the Linux project, just because
Re: Open Source is one person
#177I've heard good things about work done by this guy Linus. I'm pretty sure that I've used his work. I think he comes from a country that borders Russia, so should we be worried? I've done OSS for decades; mostly by myself, but sometimes, in teams of volunteers. If anyone has any experience, working in teams of volunteers, it can be ... challenging . It can definitely work, but not as often as you'd think. If it works,…
Curious, because just recently he expelled Russian maintainers from the Linux project, just because
Just because? I don't think so. I remember the reasoning being provided.
Re: Open Source is one person
#178Too bad the notion of completed/finished/done software is very weak. In theory, there it nothing wrong with an OSS project made by one person. I would like to see the LOC these one-person projects with >1M downloads have. I suspect most of these are a simple Node/browser/OS API single-file wrappers that are simple to get right and treat it as complete. At the same time such projects are easy to verify upon adding as…
> Too bad the notion of completed/finished/done software is very weak.
FWLIW, this simple definition suffices for me: software is complete insofar as it requires no changes to do what its maintainers would like to do with it at the current point in time.
"Complete" software frequently changes to "incomplete" as the desires of the maintainer(s) change(s), and may just as quickly revert to "complete" as changes are made.
This definition does not consider the desires of non-maintainers because there's _always_ at least one such person who wants a given pieces of software to do their one weird thing (which the maintainer(s) will not ever add).
Re: Open Source is one person
#179Re: Open Source is one person
#180Earlier quoted context omitted.
Curious, because just recently he expelled Russian maintainers from the Linux project, just because
Just because? I don't think so. I remember the reasoning being provided.
Yes but it’s essentially just because they are Russian, which again, is curious