7 ms·

> As someone not in the know, Rich's post seems like an extremely aggressive and arrogant piece. It seems that way? To me, it seems like a reasonable response

> As someone not in the know, Rich's post seems like an extremely aggressive and arrogant piece. It seems that way? To me, it seems like a reasonable response to how many people treat any kind of volunteer-led effort. For example, I help mod a fairly popular subreddit, r/cscareerquestions. Now, we don't have a problem with people suggesting changes to sub rules or have meta discussions and even complaints. No community is perfect, the mods certainly aren't, etc. However, the vast majority of complaints are of the completely useless variety. They're the vague one-liners -- "this sub used to be good, and is now bad for generic reasons I will not elaborate on" -- that usually have no clear basis in reality, nor any practical solutions even to the extent they're true. And when I try to earnestly engage with people who have the most upvoted complaints, 95%+ of the time, there's nothing there. Probably half the time they just don't respond, half the remaining time they just loose another snipe or parting shot before disappearing, and most of the rest is something in the set of {doesn't actually happen/no evidence; assumes everyone agrees with them; problem is actually well-diagnosed but the proposed solutions are laughably naive}. The number of complaints or suggestions that are meaningfully actionable is very, very low. What I've found looking at other subs and ours, is that generic complaints about sub quality and mod team actions are a quick and easy way to upvotes, but it's rare for someone to actually be well-informed on the topic and have actually thought through the problem and solutions they suggest. So when Rich says, "Did you know that most patches/issues have poor problem statements, no description of the plan (read my code!), no consideration of alternatives, no tests, no designs, and are ill-conceived and/or broken in some way?" that doesn't surprise me in the least. Even when people nominally want to contribute, they usually don't seem to try very hard. For me, it's gotten to the point where I'm writing a guide for subreddit criticism and suggestions to try and improve the quality of the complaining. tl;dr - even when something is reasonably well run by volunteers, people love their low-effort gripes and snipes

bananamerica 8y ago
I don't have any reason to doubt the truth and logic consistency of either Rich's post or your reply. The problem is not the logic, it's the rhetoric. For anyone out of the loop, he sounds like an interstellar douchebag. And, because the article is public, this can become a problem.
- dcow 8y ago
  I’m not in any loop and nothing about the post came across as douchey. In fact, it seems many people need to be reminded about who is responsible for putting open source code in any project especially after reading the disgustingly entitled comment thread on the recent nodejs security issue.
  - bartread 8y ago
    > recent nodejs security issue. Uh-oh. I hadn't been aware of this. Do you have a link, please? (Quick google didn't help much.)
    - BlahBoy3 8y ago
      It's possible that they're referring to this crypto-currency backdoor that was slipped into the event-stream dependency? https://github.com/dominictarr/event-stream/issues/116 https://github.com/dominictarr/event-stream/issues/116 Edit: it attempts to steal crypto-currency; it doesn't mine it.
      - bartread 8y ago
        Thanks!
      - bartread 8y ago
        Also, er, bloody hell. These comments are completely out of hand. Examples: "You put at risk millions of people, and making something for free, but public, means you are responsible for the package." "There is a huge difference between not maintaining a repo/package, vs giving it away to a hacker (which actually takes more effort than doing nothing), then denying all responsibility to fix it when it affects millions of innocent people." Where do these people get off?
  - michaelmrose 8y ago
    You think its disgustingly douchey for people to be dismayed that software from a trustworthy dev was turned over to someone who turned it into malware? The dev isn't responsible for the giant mound of stupid that is npm but we all have to take the world as we find it or fix it. In the context of the world as it is projects deps having deps having deps where the practical protection against a developers machine getting pwned and eventually millions of users getting pwned is more or less developers checking to ascertain that a given library is bob who works for google and not lame hacker number 2388 its poorly considered to hand over libraries to people you have no reason to suppose are trustworthy. A reasonable person could suppose that might not end well for a multitude of projects where 182 deps of deps of deps aren't vetted again per point release because in practical fact its impractical to do so while it is very practical for individual authors to not transfer control of names and publish info about their authorship. Unlike never updating or expecting individual orgs to vet 182 deps written by anon people with every bump so a reasonable person ought to do their best to make the workflow that might have some hope of working work. If you didn't want ANY responsibility whatsoever you could have not published it globally. Anyone who imagines that responsibility is merely transcriptional that it only attaches when money changes hands has literally missed the majority of human civilization including the more recent parts where people that give away free food are still expected to wash their hands, get food handlers cards, practice food safety, pass inspections etc. You aren't required to provide a vegan or kosher option or even make good food but you can't behave maliciously or negligently. Given how projects are actually used by virtually everyone authors actions appear negligent. Given the hypothetical bad actually already happened it appears that judgement is irrefutable. You are your brothers keeper whether you want to be or not. Software isn't special it works like every other civilized endeavor. Wash your hands and don't scratch your ass please.
threatofrain 8y ago
The person in question isn't some random dude who just makes demands, but a visible volunteer. Otherwise the tweet would have no voice, and Rich Hickey wouldn't feel like spending the time to tell someone how they weren't worth the time.

bananamerica 8y ago

I don't have any reason to doubt the truth and logic consistency of either Rich's post or your reply. The problem is not the logic, it's the rhetoric. For anyone out of the loop, he sounds like an interstellar douchebag. And, because the article is public, this can become a problem.

dcow 8y ago
I’m not in any loop and nothing about the post came across as douchey. In fact, it seems many people need to be reminded about who is responsible for putting open source code in any project especially after reading the disgustingly entitled comment thread on the recent nodejs security issue.
- bartread 8y ago
  > recent nodejs security issue. Uh-oh. I hadn't been aware of this. Do you have a link, please? (Quick google didn't help much.)
  - BlahBoy3 8y ago
    It's possible that they're referring to this crypto-currency backdoor that was slipped into the event-stream dependency? https://github.com/dominictarr/event-stream/issues/116 https://github.com/dominictarr/event-stream/issues/116 Edit: it attempts to steal crypto-currency; it doesn't mine it.
    - bartread 8y ago
      Thanks!
    - bartread 8y ago
      Also, er, bloody hell. These comments are completely out of hand. Examples: "You put at risk millions of people, and making something for free, but public, means you are responsible for the package." "There is a huge difference between not maintaining a repo/package, vs giving it away to a hacker (which actually takes more effort than doing nothing), then denying all responsibility to fix it when it affects millions of innocent people." Where do these people get off?
- michaelmrose 8y ago
  You think its disgustingly douchey for people to be dismayed that software from a trustworthy dev was turned over to someone who turned it into malware? The dev isn't responsible for the giant mound of stupid that is npm but we all have to take the world as we find it or fix it. In the context of the world as it is projects deps having deps having deps where the practical protection against a developers machine getting pwned and eventually millions of users getting pwned is more or less developers checking to ascertain that a given library is bob who works for google and not lame hacker number 2388 its poorly considered to hand over libraries to people you have no reason to suppose are trustworthy. A reasonable person could suppose that might not end well for a multitude of projects where 182 deps of deps of deps aren't vetted again per point release because in practical fact its impractical to do so while it is very practical for individual authors to not transfer control of names and publish info about their authorship. Unlike never updating or expecting individual orgs to vet 182 deps written by anon people with every bump so a reasonable person ought to do their best to make the workflow that might have some hope of working work. If you didn't want ANY responsibility whatsoever you could have not published it globally. Anyone who imagines that responsibility is merely transcriptional that it only attaches when money changes hands has literally missed the majority of human civilization including the more recent parts where people that give away free food are still expected to wash their hands, get food handlers cards, practice food safety, pass inspections etc. You aren't required to provide a vegan or kosher option or even make good food but you can't behave maliciously or negligently. Given how projects are actually used by virtually everyone authors actions appear negligent. Given the hypothetical bad actually already happened it appears that judgement is irrefutable. You are your brothers keeper whether you want to be or not. Software isn't special it works like every other civilized endeavor. Wash your hands and don't scratch your ass please.

threatofrain 8y ago

The person in question isn't some random dude who just makes demands, but a visible volunteer. Otherwise the tweet would have no voice, and Rich Hickey wouldn't feel like spending the time to tell someone how they weren't worth the time.