Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dear clueless assholes: stop bashing bash and GNU

weev.livejournal.com

Post reply on HN
Print view View original

91–100 of 107 posts

Re: Dear clueless assholes: stop bashing bash and GNU

#91

Post by quakershake »

teamhappy wrote: post #89
quakershake wrote: post #85

Earlier quoted context omitted.

"There are loads of tools that should have never been implemented in C/C++ in the first place (SSH, Make, APT, etc.). I'd say the best idea is to port a lot of these code bases to languages like Go or Rust maybe, but if that's not feasible for some reason, at least write some unit tests and do static code analysis." This is the exact problem with everything today. Languages do not make bugs, people do. If that weren'…

> Languages do not make bugs, people do. Right. That's why it's a good idea to use languages that help people to avoid common mistakes. > Rewriting something is only guaranteeing that more bugs be created initially. Neither of us has empirical evidence for that (or maybe you do, I don't know), but let's say your right. A rewrite would at least give us a sane way to move forward (see the first item on my list). > You…

> I'm voting blue.

lol

> Given that you're a Linux user, you should be familiar with Einstein's definition of insanity. :P

+1 - I just don't see any real solution to the problem. I do think that because Linux is more widely used it is running into the same issues Microsoft has/had where the vulnerabilities are more widely exploitable.

Diversity definitely has it's benefits.

Re: Dear clueless assholes: stop bashing bash and GNU

#92

Post by mackwic »

dschiptsov wrote: post #80
mackwic wrote: post #70

Earlier quoted context omitted.

Oh come on, you can't seriously say that Erlang/OTP is good open source . It's mildly-good corporate open-source, that's not making it good open source in any way. But that's off-topic. The thing is, code review is a necessary thing where the audience is large, the tool is critical, and the tooling (here, the compiler) doesn't give any warranty in term of code correctness. Code review are important, but it's an human…

Why, after OTP has been open sourced the project got lots of reviews, bug-reports and bug-fixes and overall quality has been even more improved. The same ideas works with crucial projects such as openssh. No one could count how many eyes was on the code to find a flaw in the code or a way to exploit. btw, Erlang/OTP is so good, that nowadays when you are using your mobile, your data most probably at least once is goi…

It is very good software, no doubt. Erlang wouldn't be so efficient without OTP. It's just a bad example of a good OSS project because it's not really a community project but more like "some guys from ericson which accepted some contributions and opened the code". It's like saying that the C# compiler is a good OSS project. It's a good project, sure, but not a good OSS one (yes, the C# compiler is now open source, and the code is amazing).

You want a good OSS project ? Take Gnome, take VLC, take Qt, take the libc^W^W^W, well not the libc. ;-)

You got the idea.

About code review, I persist in my point: it's a good practice, but we need this only because a code that pass the checks (compilation, analysis, tests) doesn't mean that this code works. There was an article about "security by being careful" but I don't find the url anymore. Shame.

Anyway, I'm a Ocaml believer and be assured that when your compiler can give you that level of assurance, you don't review the same: you know you're not half as good as the compiler to catch errors, and that's a damn good feeling.

Re: Dear clueless assholes: stop bashing bash and GNU

#93

Post by XorNot »

jiggy2011 wrote: post #67
gggmaster wrote: post #63

Earlier quoted context omitted.

You can pay someone to improve open source tools, too.

There are hundreds, maybe thousands of programs that make up a full open source system and frequently they are maintained by different groups of people with very different situations as regards to motivations and funding. There's no reasonable way that anyone outside of a few big tech companies can possibly review all of these and ensure that funding is distributed appropriately.

But relatively few of them are internet/user-facing in any given deployment. You only need to secure/audit the attack surface, not the whole stack.

Re: Dear clueless assholes: stop bashing bash and GNU

#94

Post by jiggy2011 »

XorNot wrote: post #93
jiggy2011 wrote: post #67

Earlier quoted context omitted.

There are hundreds, maybe thousands of programs that make up a full open source system and frequently they are maintained by different groups of people with very different situations as regards to motivations and funding. There's no reasonable way that anyone outside of a few big tech companies can possibly review all of these and ensure that funding is distributed appropriately.

But relatively few of them are internet/user-facing in any given deployment. You only need to secure/audit the attack surface, not the whole stack.

Until a few days ago , I would not have called bash "internet facing".

Re: Dear clueless assholes: stop bashing bash and GNU

#95

Post by jjnoakes »

Donzo wrote: post #84
jjnoakes wrote: post #64

Earlier quoted context omitted.

I see many people calling him out not for making a mistake, but for downplaying its significance when confronted with its full ramifications. I agree that mistakes happen. But someone who deserves respect, in my opinion, owns up to mistakes and tries to get them fixed. Someone who downplays the mistakes in order to save face deserves nothing from me.

I don't think he wants anything from you. Perhaps you're putting too high a premium on your gratitude.

I sincerely hope that anyone that acts as he does is not looking for anything from me.

> Perhaps you're putting too high a premium on your gratitude.

I think it's quite the opposite - people demand that he be respected solely because of what he's contributed to the free software movement, including even the lowliest gratitude from the smallest voices (of which I'm at the bottom of the list).

But what really should happen is that each individual action and contribution should stand on its own, unmarred by its relationship (through its author) to any other action or contribution.

People (the high and the low of us) should respect the free software movement and some of the software it has provided to the world, and simultaneously deride the position that this serious security problem should be shrugged off or downplayed, despite the fact that the same person or people are responsible for both.

Re: Dear clueless assholes: stop bashing bash and GNU

#96

Post by LeoPanthera »

teamhappy wrote: post #72

Anybody know Bryan Lunduke? He's a guy giving talks called "Linux sucks" in which he basically bashes Linux for 20 minutes and then concludes that Linux is the best FOSS OS community because they can take the bashing (get it?). He's been giving these talks for quite a while now. Everybody knows Theo de Raadt is crazy (and Stallman isn't) and of course everybody knows Apple fanboys tear up every time somebody implies…

> everybody knows Apple fanboys tear up every time somebody implies Apple software has a bug in it

"Everybody knows" this, but I'm pretty sure this hasn't been true since the 90s.

Today, it's super popular and somehow accepted behavior to bash and make fun of people who buy Apple products. I see it all the time. The excuse always given is that they're simply returning what Apple fans give out, but I can't remember the last time I saw an "Apple fan" bash a PC or Android user.

I don't know when this changed, but I don't like it.

Re: Dear clueless assholes: stop bashing bash and GNU

#97

Post by cpncrunch »

cpncrunch wrote: post #90
zak_mc_kracken wrote: post #59

Earlier quoted context omitted.

The problem is not being offensive but being childish. The vocabulary used gives you a hint about the level of arguments you are about to read, and if you read the rest of the article, you realize that the author of the post is indeed quite immature.

The article was fairly mature. However what would make me more skeptical about anything weev writes is the fact that he is an angry paranoid due to his drug use ( http://seclists.org/fulldisclosure/2009/Oct/82 ). His account of his gay hacking incident is interesting. How could he possibly know it was gay people who flagged his posts ? That's either paranoia, ironic trolling, or homophobia. I thought maybe he was jus…

1 downvote, lolz. I wonder who that could be?

Re: Dear clueless assholes: stop bashing bash and GNU

#98

Post by cpncrunch »

cpncrunch wrote: post #97
cpncrunch wrote: post #90

Earlier quoted context omitted.

The article was fairly mature. However what would make me more skeptical about anything weev writes is the fact that he is an angry paranoid due to his drug use ( http://seclists.org/fulldisclosure/2009/Oct/82 ). His account of his gay hacking incident is interesting. How could he possibly know it was gay people who flagged his posts ? That's either paranoia, ironic trolling, or homophobia. I thought maybe he was jus…

1 downvote, lolz. I wonder who that could be?

Everything I said was factual. If I made any errors, feel free to correct me rather than downvoting.

Re: Dear clueless assholes: stop bashing bash and GNU

#99

Post by vacri »

teamhappy wrote: post #72

Anybody know Bryan Lunduke? He's a guy giving talks called "Linux sucks" in which he basically bashes Linux for 20 minutes and then concludes that Linux is the best FOSS OS community because they can take the bashing (get it?). He's been giving these talks for quite a while now. Everybody knows Theo de Raadt is crazy (and Stallman isn't) and of course everybody knows Apple fanboys tear up every time somebody implies…

I'd say the best idea is to port a lot of these code bases to languages like Go or Rust maybe

So your answer to to the criticism of "this code is ancient" for core utils is "let's port them to languages that haven't finished maturing yet"? Rust in particular is only two years old, and the recommended version is "the nightly build". That sounds super-stable for core utils...

Re: Dear clueless assholes: stop bashing bash and GNU

#100

Post by GhotiFish »

anon1385 wrote: post #88
ci257 wrote: post #78

Earlier quoted context omitted.

Was Kathy Sierra garbage?

You are talking to a weev supporter. It is highly likely that rabite views women in general as 'garbage'.

I'm also 100% confident that rabite eats babies, rapes children, and tips waiters below 10%.
Post reply on HN