Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open Source is one person

opensourcesecurity.io

Post reply on HN
Print view View original

31–40 of 184 posts

Re: Open Source is one person

#31

Post by ridifndnwj »

kube-system wrote: post #28
ysofunny wrote: post #17

Earlier quoted context omitted.

software once "perfected" (working well enough long enough) needs NO maintenance. No cleaning. No calibrating/tunning. updating is a systemic issue, not a per-project matter

Under a microscope, maybe. But if you had a "perfect" piece of software that used Log4j in 2020, it wouldn't have been perfect for long. Unfortunately, there's a lot of reasons that software needs maintenance, even if it was thought to be perfect when it was originally written. Hardware changes. The software landscape changes. Dependencies are deprecated, or are found to have their own problems. Vulnerabilities are d…

Ironically if you didn’t upgrade from 1.x you didn’t get the new features or the bug you’re referring to

Re: Open Source is one person

#32

Post by lo_zamoyski »

tarvaina wrote: post #27
ChrisMarshallNY wrote: post #6

I've heard good things about work done by this guy Linus. I'm pretty sure that I've used his work. I think he comes from a country that borders Russia, so should we be worried? I've done OSS for decades; mostly by myself, but sometimes, in teams of volunteers. If anyone has any experience, working in teams of volunteers, it can be ... challenging . It can definitely work, but not as often as you'd think. If it works,…

(Off topic.) Not only that, but Linus's parents were politically active communists and young Linus was a pioneer (like a boy scout but for communists). His father also lived in Moscow for several years on two separate occasions.

> Linus was a pioneer

Being a Young Pioneer or joining the Komsomol was not officially mandatory, but it functioned as a gatekeeper for any kind of advancement. Party membership operated the same way.

So, by themselves, they don't tell you whether the person in question is a communist.

Re: Open Source is one person

#33

Post by ChrisMarshallNY »

tarvaina wrote: post #27
ChrisMarshallNY wrote: post #6

I've heard good things about work done by this guy Linus. I'm pretty sure that I've used his work. I think he comes from a country that borders Russia, so should we be worried? I've done OSS for decades; mostly by myself, but sometimes, in teams of volunteers. If anyone has any experience, working in teams of volunteers, it can be ... challenging . It can definitely work, but not as often as you'd think. If it works,…

(Off topic.) Not only that, but Linus's parents were politically active communists and young Linus was a pioneer (like a boy scout but for communists). His father also lived in Moscow for several years on two separate occasions.

I don't think Russia (or China, either) has been truly communist, in a long time.

Not sure there are any real communist nations left. It's one of those ideologies that looks good on paper, but falls apart, as soon as humans get added to the soup.

Idealists never seem to account for base human nature.

Re: Open Source is one person

#34

Post by [deleted] »

ridifndnwj wrote: post #31
kube-system wrote: post #28

Earlier quoted context omitted.

Under a microscope, maybe. But if you had a "perfect" piece of software that used Log4j in 2020, it wouldn't have been perfect for long. Unfortunately, there's a lot of reasons that software needs maintenance, even if it was thought to be perfect when it was originally written. Hardware changes. The software landscape changes. Dependencies are deprecated, or are found to have their own problems. Vulnerabilities are d…

Ironically if you didn’t upgrade from 1.x you didn’t get the new features or the bug you’re referring to

[deleted]

Re: Open Source is one person

#35

Post by speakingmoistly »

sorrythanks wrote: post #9
speakingmoistly wrote: post #3

[Relevant xkcd.]( https://xkcd.com/2347/ ) It's interesting to see the periodic rediscovery of "capitalism + technology relies on unpaid, voluntary labour", or as the author puts it, "Open source, the thing that drives the world, the thing Harvard says has an economic value of 8.8 trillion dollars". The one flaw that I see in the author's analysis though is that they don't seem to account for whether the packages acc…

half way down the page: > So now, let’s look at the number of maintainers for projects with over 1 million downloads this month.

Fair point, I glossed over that part a bit fast.

It does go in the direction I thought it would though. I'd be curious to see (or to take) a look a little deeper at what those thousand of packages are.

Re: Open Source is one person

#36

Post by kube-system »

ridifndnwj wrote: post #31
kube-system wrote: post #28

Earlier quoted context omitted.

Under a microscope, maybe. But if you had a "perfect" piece of software that used Log4j in 2020, it wouldn't have been perfect for long. Unfortunately, there's a lot of reasons that software needs maintenance, even if it was thought to be perfect when it was originally written. Hardware changes. The software landscape changes. Dependencies are deprecated, or are found to have their own problems. Vulnerabilities are d…

Ironically if you didn’t upgrade from 1.x you didn’t get the new features or the bug you’re referring to

2.x had been out for about six years by the time the vulnerability was discovered.

Re: Open Source is one person

#37

Post by oneshtein »

kube-system wrote: post #30
ChrisMarshallNY wrote: post #18

Earlier quoted context omitted.

Many of them don't live in Russia. Some of the best engineers that I've worked with (in the US and Europe) are Russian. I've also been quite impressed with other former Iron Curtain developers. A lot of Chinese folks I've worked with have been good. I know that some nations are known for threatening the relatives of expats, to get them to work on their behalf. Not very nice. But state-sponsored Russian (or other nati…

> Many of them don't live in Russia. Well Malinochkin does. His GitHub profile says he is located in a suburb 30 minutes from the Kremlin. Of course, there's a lot of smart software engineers in major cities all around the world.

The FSB is looking for people they can recruit, even here, on HackerNews, too. Look at the HN news history. You will find stories about Russian history or culture. In comments, some people are expressing their fascination with Russia or its culture. This is how FSB identifies potential sympathizers, who are easy to recruit. Most likely, some of those, who expressed their sympathy under such news articles a year or two ago, are already recruited by FSB.

Re: Open Source is one person

#38

Post by pabs3 »

actionfromafar wrote: post #14
poulpy123 wrote: post #7

The title of the register article is completely disgusting > Putin on the code: DoD reportedly relies on utility written by Russian dev then in the article: > Hunted Labs told us that it didn't speak to Malinochkin prior to publication of its report today, and that it found no ties between him and any threat actor.

Aren't Russian developers on average more susceptible to the "wrench attack" though?

Not necessarily, Australia has a law allowing the government to compel software devs to add backdoors and gag them to prevent people hearing about the backdoors.

https://scarff.id.au/blog/2023/state-actors-can-add-a-backdo...

Re: Open Source is one person

#39

Post by weirdpickles »

poulpy123 wrote: post #7

The title of the register article is completely disgusting > Putin on the code: DoD reportedly relies on utility written by Russian dev then in the article: > Hunted Labs told us that it didn't speak to Malinochkin prior to publication of its report today, and that it found no ties between him and any threat actor.

Yeah, it is pretty amazing but not surprising. The Register has taken to a certain kind of sensationalism as of late.

I found this interesting:

> "Every piece of code written by Russians isn't automatically suspect, but popular packages with no external oversight are ripe for the taking by state or state-backed actors looking to further their aims," Smith told us in an email. "As a whole, the open source community should be paying more attention to this risk and mitigating it."

Uh, I guess? The nature of open source is supposed to be that the dev provides the effort and the code, and that's where the guarantee stops. It is up to the people who uses it to implement and ensure security. People treat OSS like it is a business product that must have drop-in replacement ready at all times.

The modern nature of development is perhaps my biggest gripe as a professional. There is little care given. Projects begin with importing dozens of other packages and libraries that we never look at, let alone fully understand. And it is normalized.

Re: Open Source is one person

#40

Post by ii41 »

ChrisMarshallNY wrote: post #33
tarvaina wrote: post #27

Earlier quoted context omitted.

(Off topic.) Not only that, but Linus's parents were politically active communists and young Linus was a pioneer (like a boy scout but for communists). His father also lived in Moscow for several years on two separate occasions.

I don't think Russia (or China, either) has been truly communist, in a long time. Not sure there are any real communist nations left. It's one of those ideologies that looks good on paper, but falls apart, as soon as humans get added to the soup. Idealists never seem to account for base human nature.

Your parent comment labeled themselves off-topic but I'd say they were still pretty on it, but you're like way too off-topic. The point isn't whether some country or some people are real communists or not, but that an individual shouldn't be harassed for maintaining open source software and can somehow be linked to some rival of the West.
Post reply on HN