71–80 of 107 posts
I am not saying programmers who make free software leave it out like garbage. I am saying people who use free software for their benefit treat it that way, yet act as though they bought it.
In my experience it's the exact opposite. I've been hearing a lot of explanations for the bash debacle in the last couple of days and they all amaze me to a certain degree. Let me share a couple of them with you.
1. Total breakdown - "No software is ever safe, so what the hell do you want from me." Yeah, well ... don't write software then.
2. It's not my fault - "Bash is written in C. C is unsafe." Quite a lot of people write safe, well tested, maybe even formally verified C code. So, yeah ... don't hack in C maybe.
3. Linux is still fine - "Bash is just a tiny part of Linux. The rest is still good to go." Turns out the bash codebase looks a lot like the rest of the GNU/Linux universe. Old, untested C code that's hard to read and even harder to understand. That's why nobody dares to touch it in the first place.
4. It's FOSS - "You can't expect anything to work. Cause, you know, it's free." If that were true, using FOSS would be a terrible idea.
5. You're using it wrong. ... just wow.
Can't we just all agree that this kind of thing is an endemic problem in most of the code bases we use (including my beloved FreeBSD) and we have to figure it out over the next couple of years. There are loads of tools that should have never been implemented in C/C++ in the first place (SSH, Make, APT, etc.). I'd say the best idea is to port a lot of these code bases to languages like Go or Rust maybe, but if that's not feasible for some reason, at least write some unit tests and do static code analysis. And, this is probably the most important point, if you don't want to do any of this, please don't make lame excuses when it all falls apart eventually.
Earlier quoted context omitted.
You can pay someone to improve open source tools, too.
There are hundreds, maybe thousands of programs that make up a full open source system and frequently they are maintained by different groups of people with very different situations as regards to motivations and funding. There's no reasonable way that anyone outside of a few big tech companies can possibly review all of these and ensure that funding is distributed appropriately.
Earlier quoted context omitted.
Except the FSF never said anything like "Please don't use bash for CGI, it's not secure enough". If they had, then they would have to recognize that bash is not secure enough for other uses as well.
Wouldn't that violate freedom 0?
The clueless assholes could not be stopped, because it is another name for the vast majority - the 84%.) The problem is the same as with openssl's flaws - when we accept all the contributions without detailed code-review we often incorporate code written by over-enthusiastic amateurs (and sometimes even over-confident idiots). Lots of problem of really open open-source projects (sorry for this tautology) are from the…
Oh come on, you can't seriously say that Erlang/OTP is good open source . It's mildly-good corporate open-source, that's not making it good open source in any way. But that's off-topic. The thing is, code review is a necessary thing where the audience is large, the tool is critical, and the tooling (here, the compiler) doesn't give any warranty in term of code correctness. Code review are important, but it's an human…
Earlier quoted context omitted.
I have to say, it's ironic that weev is feeling offended by mild criticism though. Given he ran the GNAA to deliberately offend , it seems a little rich that he is so upset.
You're missing the point. The GNAA is built to offend worthless parasites who contribute nothing to the world. Social justice whiners, socialites, et al. Such garbage deserve no respect. Stallman is the antithesis of worthless parasitism. Stallman spent his entire life selflessly giving to the world, and the world gave him nothing but disdain in return. He's truly a prophet, like Diogenes or Ezekiel. He deserves resp…
Earlier quoted context omitted.
Agreed. Misuse is a problem. However sometimes being too flexible opens itself up to unintended misuse. It seems as if though foss is so reliable that people start to act entitled when shit hits the fan. Software has never been problem free and never will. I'm just glad I haven't seen a libreBash or some other lame fork instead of just adding more eyes to the existing functioning project.
Isn't Zsh basically libreBash though?
The clueless assholes could not be stopped, because it is another name for the vast majority - the 84%.) The problem is the same as with openssl's flaws - when we accept all the contributions without detailed code-review we often incorporate code written by over-enthusiastic amateurs (and sometimes even over-confident idiots). Lots of problem of really open open-source projects (sorry for this tautology) are from the…
Oh come on, you can't seriously say that Erlang/OTP is good open source . It's mildly-good corporate open-source, that's not making it good open source in any way. But that's off-topic. The thing is, code review is a necessary thing where the audience is large, the tool is critical, and the tooling (here, the compiler) doesn't give any warranty in term of code correctness. Code review are important, but it's an human…
The same ideas works with crucial projects such as openssh. No one could count how many eyes was on the code to find a flaw in the code or a way to exploit.
btw, Erlang/OTP is so good, that nowadays when you are using your mobile, your data most probably at least once is going through an Ericsson hardware and an Erlang VM within it.
As for code review, almost every major project does it nowadays, you like it or not.