4 ms·

> other projects like scuttlebutt are likely doomed to fail as well because of his wrongheaded views about organization. Define failure. I don’t know Dominic a

> other projects like scuttlebutt are likely doomed to fail as well because of his wrongheaded views about organization. Define failure. I don’t know Dominic and I haven’t looked into the Scuttlebutt project beyond being aware of its existence and what it is, but... He talks about creating a community where anyone is welcome to contribute. It is perfectly fine for an open source project to have the development process and the community as its raison d'être. Just because a project doesn’t outcompete every single alternative doesn’t mean it’s failed. Just because a project isn’t even used by more than a handful of people doesn’t mean it’s failed. It all depends on what the goal of the project was in the first place, and what the goal of the contributors are.

skore 8y ago
> He talks about creating a community where anyone is welcome to contribute. Yes and in this case, that was exactly the problem. > It is perfectly fine for an open source project to have the development process and the community as its raison d'être. Conway's law is not an instruction manual.
- onion2k 8y ago
  The problem was that too few people contributed. A contribution to an open source project doesn't have to be a pull request. Glancing over the code you're pulling down rather than assuming the maintainer is infallible counts just fine. Very, very few people do that in the JS ecosystem though. When a package gets 2m downloads a day and it still takes 2 and a half months to find a problem, a huge number of developers have failed to do their part.
brobdingnagians 8y ago
A security hole and backdoor is always a failure in a software product. Having someone else control your system is just about the worst you can get. It has nothing to do with relative definitions because it always degrades every other objective the project could or does have. If a model of leadership leads naturally and often to security holes, it is time to reconsider the model. If it is a common library, then it is even worse. Open source that is used widely is _even_ more important to protect because the impact can be so much greater.
- Aeolun 8y ago
  I don’t know, if I write open source software, the only definition of success I use is whether or not I had any fun writing it. Anything else is gravy.
- testvox 8y ago
  Lots of projects, including windows and linux have had security holes that allow remote control of your system. Security flaw does not mean failure, its always about weighing the cost of security flaws against the utility the software provides. Even a completely compromised system can provide utility to many users.
- komali2 8y ago
  This sounds like "if it's not perfect, it's a failure." I'm actually not aware of a single piece of software that didn't at some point have a production security vulnerability. Facebook failed. Google failed. Amazon failed.

skore 8y ago

> He talks about creating a community where anyone is welcome to contribute. Yes and in this case, that was exactly the problem. > It is perfectly fine for an open source project to have the development process and the community as its raison d'être. Conway's law is not an instruction manual.

onion2k 8y ago
The problem was that too few people contributed. A contribution to an open source project doesn't have to be a pull request. Glancing over the code you're pulling down rather than assuming the maintainer is infallible counts just fine. Very, very few people do that in the JS ecosystem though. When a package gets 2m downloads a day and it still takes 2 and a half months to find a problem, a huge number of developers have failed to do their part.

brobdingnagians 8y ago

A security hole and backdoor is always a failure in a software product. Having someone else control your system is just about the worst you can get. It has nothing to do with relative definitions because it always degrades every other objective the project could or does have. If a model of leadership leads naturally and often to security holes, it is time to reconsider the model. If it is a common library, then it is even worse. Open source that is used widely is _even_ more important to protect because the impact can be so much greater.

Aeolun 8y ago
I don’t know, if I write open source software, the only definition of success I use is whether or not I had any fun writing it. Anything else is gravy.
testvox 8y ago
Lots of projects, including windows and linux have had security holes that allow remote control of your system. Security flaw does not mean failure, its always about weighing the cost of security flaws against the utility the software provides. Even a completely compromised system can provide utility to many users.
komali2 8y ago
This sounds like "if it's not perfect, it's a failure." I'm actually not aware of a single piece of software that didn't at some point have a production security vulnerability. Facebook failed. Google failed. Amazon failed.