Dear clueless assholes: stop bashing bash and GNU • Hacker News Board

Re: Dear clueless assholes: stop bashing bash and GNU

#61

Post by dschiptsov » Sun, Sep 28, 2014, 2:50 PM UTC

The clueless assholes could not be stopped, because it is another name for the vast majority - the 84%.)

The problem is the same as with openssl's flaws - when we accept all the contributions without detailed code-review we often incorporate code written by over-enthusiastic amateurs (and sometimes even over-confident idiots).

Lots of problem of really open open-source projects (sorry for this tautology) are from the fact that they are open for everyone.

Imagine everyone could commit (without code review) in Haskell compiler tree, Linux kernel or, say, OpenBSD. But in early times of GNU movements this was a very common case.

So, the problem is in the lack of code-reviews, not in GNU movement, let alone Stallman himself.

It is quite easy for ignorant to under-emphasize the importance of GNU tools to what we now call the Internet. It is not just bash, which is very important tool, but in the first place Emacs, GCC, Binutils, GNU make, flex, bison - all the development tools which made possible the raise of early BSD and Linux systems. It is impossible to imagine the world of free, open source software without GNU toolchan.

Nowadays I very much like the example of nginx - it has bigger market share than IIS, while originally was a solo effort, compared to millions of dollars and man-hours which have been spent on development and marketing of IIS. This is how open source model works. Another good example is Erlan/OTP.

Re: Dear clueless assholes: stop bashing bash and GNU

#62

Post by jiggy2011 » Sun, Sep 28, 2014, 2:52 PM UTC

zak_mc_kracken wrote: post #57

jiggy2011 wrote: post #18

Earlier quoted context omitted.

Think of it this way. Say that a car manufacturer builds a car for city driving and doesn't warrant or recommend it's use for off roading. However it just so happens that the car is tough enough that it makes a good offroader anyway and soon people start to buy the car for the express purpose of offroading even though the manufacturer does not recommend this use. Some time later it becomes apparent that there is a we…

Except the FSF never said anything like "Please don't use bash for CGI, it's not secure enough". If they had, then they would have to recognize that bash is not secure enough for other uses as well.

Wouldn't that violate freedom 0?

Re: Dear clueless assholes: stop bashing bash and GNU

#63

Post by gggmaster » Sun, Sep 28, 2014, 2:52 PM UTC

jiggy2011 wrote: post #41

XorNot wrote: post #21

Earlier quoted context omitted.

Proprietary software gets compromised all the time. In serious ways. A simple example is the sheer number of bank websites which get taken down, and then we all yell at the guy who discovered it to absolutely not disclose it for fear of prosecution. The point is, when FOSS software has a bug, there's no small set of developers who are responsible. It's, in some small way, collectively all our faults. Like in the case…

Most people are incapable of taking any responsibility for issues in bash or openssl, in fact people who rely on them might not even know they exist , let alone be able to fix them. If you buy something from Microsoft you are paying them to take care of everything from the kernel upwards so that you don't need to worry about the details.

You can pay someone to improve open source tools, too.

Re: Dear clueless assholes: stop bashing bash and GNU

#64

Post by jjnoakes » Sun, Sep 28, 2014, 2:55 PM UTC

thegeomaster wrote: post #35

I think that bashing bad code , bad practices and whatever lead to any security-critical bug (and any bug whatsoever, for that matter), should happen. If there weren't rants, flame wars and insults in the free software movement, I guarantee it wouldn't have come near where it is today. It's a big part of what drives innovation in all spheres, not just this one: the harsh (and not-so-harsh, sure) comments, the passive…

I see many people calling him out not for making a mistake, but for downplaying its significance when confronted with its full ramifications.

I agree that mistakes happen. But someone who deserves respect, in my opinion, owns up to mistakes and tries to get them fixed.

Someone who downplays the mistakes in order to save face deserves nothing from me.

Re: Dear clueless assholes: stop bashing bash and GNU

#65

Post by jiggy2011 » Sun, Sep 28, 2014, 2:58 PM UTC

jameshart wrote: post #58

jiggy2011 wrote: post #18

Earlier quoted context omitted.

Think of it this way. Say that a car manufacturer builds a car for city driving and doesn't warrant or recommend it's use for off roading. However it just so happens that the car is tough enough that it makes a good offroader anyway and soon people start to buy the car for the express purpose of offroading even though the manufacturer does not recommend this use. Some time later it becomes apparent that there is a we…

Except that, in a world where Unix systems are almost exclusively used to handle network traffic, that off-road usecase should probably be considered the default. They've been selling city cars in a country that doesn't actually have any paved roads.

That doesn't mean that bash is suitable for handling network traffic!

Re: Dear clueless assholes: stop bashing bash and GNU

#66

Post by hobs » Sun, Sep 28, 2014, 2:58 PM UTC

jiggy2011 wrote: post #15

ClashTheBunny wrote: post #9

Earlier quoted context omitted.

I think it's more of a point that if you are using something for free, you should think more in terms of "What did I do wrong to cause this? Who did I not support that put us in this situation?". People pointed out that OpenSSL had a miniscule budget and provided tons of value to the world. Once again, all you can say is mea culpa. Either that or they should be creating alternatives and moving away from poorly writte…

Isn't that then an argument against using free software? If the best way to have secure software without being a security expert is to use proprietary software, then that is what we should encourage. FOSS advocates make the opposite argument that FOSS is more secure because there are more eyes on the code.

I think its more an argument for supporting software, free or proprietary and making sure it is good via transparency and continuous improvement.

I do agree that code should be able to be critiqued, but criticism is generally taken poorly by an individual when your critique is hyperbolic.

Anyone who has the ability to critique it should have spent the time it took to write an outraged blogpost and try to contribute back to the project, it would both make you feel better and look better.

Re: Dear clueless assholes: stop bashing bash and GNU

#67

Post by jiggy2011 » Sun, Sep 28, 2014, 3:04 PM UTC

gggmaster wrote: post #63

jiggy2011 wrote: post #41

Earlier quoted context omitted.

Most people are incapable of taking any responsibility for issues in bash or openssl, in fact people who rely on them might not even know they exist , let alone be able to fix them. If you buy something from Microsoft you are paying them to take care of everything from the kernel upwards so that you don't need to worry about the details.

You can pay someone to improve open source tools, too.

There are hundreds, maybe thousands of programs that make up a full open source system and frequently they are maintained by different groups of people with very different situations as regards to motivations and funding. There's no reasonable way that anyone outside of a few big tech companies can possibly review all of these and ensure that funding is distributed appropriately.

Re: Dear clueless assholes: stop bashing bash and GNU

#68

Post by jiggy2011 » Sun, Sep 28, 2014, 3:07 PM UTC

hobs wrote: post #66

jiggy2011 wrote: post #15

Earlier quoted context omitted.

Isn't that then an argument against using free software? If the best way to have secure software without being a security expert is to use proprietary software, then that is what we should encourage. FOSS advocates make the opposite argument that FOSS is more secure because there are more eyes on the code.

I think its more an argument for supporting software, free or proprietary and making sure it is good via transparency and continuous improvement. I do agree that code should be able to be critiqued, but criticism is generally taken poorly by an individual when your critique is hyperbolic. Anyone who has the ability to critique it should have spent the time it took to write an outraged blogpost and try to contribute b…

The time commitment for open source contribution and for writing blogposts isn't even in the same ballpark.

Re: Dear clueless assholes: stop bashing bash and GNU

#69

Post by theoh » Sun, Sep 28, 2014, 3:08 PM UTC

I think this post misses the point. It is notoriously difficult to write robust code for most varieties of unix shell. This has been the case for decades. It's a bad situation and the GNU project's attempts to remedy it (e.g. Guile) haven't got any traction. It is an embarrassment.

Re: Dear clueless assholes: stop bashing bash and GNU

#70

Post by mackwic » Sun, Sep 28, 2014, 3:09 PM UTC

dschiptsov wrote: post #61

The clueless assholes could not be stopped, because it is another name for the vast majority - the 84%.) The problem is the same as with openssl's flaws - when we accept all the contributions without detailed code-review we often incorporate code written by over-enthusiastic amateurs (and sometimes even over-confident idiots). Lots of problem of really open open-source projects (sorry for this tautology) are from the…

Oh come on, you can't seriously say that Erlang/OTP is good open source. It's mildly-good corporate open-source, that's not making it good open source in any way. But that's off-topic.

The thing is, code review is a necessary thing where the audience is large, the tool is critical, and the tooling (here, the compiler) doesn't give any warranty in term of code correctness.

Code review are important, but it's an human process, which have its own flows and inconsistence. That's no silver bullet, no more than static checking, strong typing, and test suites. If you want to warrant, you'll have to prove. If you want to prove, you'll have to take time and do it mathematically. This process would have killed any OSS project, that's simply not feasible.

Shit happens, man. That's no reason for protectionism, elitism, and OSS aristocracy. OSS is open and should stay open whatever it cost, period.

Moreover, even if this hole is big, environment has always been a real security hole in Unix. ksh, anyone ? Or worst: csh ? The situation has greatly improved since, and we have all rights to be disappointed to lost a security we all took for granted. That shouldn't make us forget the road we already crossed.