4 ms·

> I’m not convinced FOSS is even a good idea at this point, but with the advent of widespread cyberwarfare we need to either introduce a sophisticated accompany

> I’m not convinced FOSS is even a good idea at this point, but with the advent of widespread cyberwarfare we need to either introduce a sophisticated accompanying trust model, or exclude FOSS when working commercially. So, you are saying that we should prefer code where it is impossible to have a look at the source because that solves the problem of having to trust the developers of that code?

randomsearch 8y ago
1. Commercial does not imply closed source. 2. It’s about legal responsibility and recourse.
- zAy0LfpBZLC8mAC 8y ago
  > 1. Commercial does not imply closed source. How is that relevant? > 2. It’s about legal responsibility and recourse. How is that relevant?
  - andrewflnr 8y ago
    You pay for the software, you get the source. I gather this used to be the default distribution method, and I think it still gets used for game engines.
  - peteradio 8y ago
    > you are saying that we should prefer code where it is impossible to have a look at the source Just because not everybody has access != a person inside a gated area doesn't get to see. You made that leap. If you are building software on top of software that carries no guarantees then you are liable unless you also somehow make no guarantees. Are you able to sell software without guarantees? Maybe?
    - zAy0LfpBZLC8mAC 8y ago
      > Just because not everybody has access != a person inside a gated area doesn't get to see. You made that leap. Well, I guess that was somewhat of a leap, but it doesn't really make a difference to the argument: The point is that they are suggesting that preferring code that fewer people can look at somehow solves a problem. > If you are building software on top of software that carries no guarantees then you are liable unless you also somehow make no guarantees. Well, yeah? But what does that have to do with FOSS? Neither does FOSS imply that there are no guarantees, nor does proprietary software imply that there are guarantees. Hence: What is the relevance? The only difference between FOSS and proprietary software in this regard is that with FOSS you have the option to do an audit yourself and offer guarantees on that basis without creating a huge unknown risk for yourself, or you could possibly buy auditing services on the free market that come with some sort of guarantee from a third party. There is no option that you have with proprietary software that is somehow impossible with FOSS, which is why the suggestion that not using FOSS for commercial projects somehow solves a problem is strange at best. > Are you able to sell software without guarantees? Maybe? Well, given the tons of massively broken proprietary commercial software out there? Yeah, obviously you can?
TheOtherHobbes 8y ago
No, the point is that in practice FOSS code is not any more open than closed source. That's the point of this piece. For any non-trivial edit on a real project with real deadlines the source code is effectively useless, because no one has the time, the resources, or possibly even the inclination to fix bugs, do full-coverage testing, or make custom modifications. So you have to take the internals on trust. Which is a ridiculous situation when so many packages are created as hobby projects with - literally - no guarantee of performance or reliability. I realise it's hard for FOSS advocates to understand this, because it's a fundamental flaw with the FOSS philosophy. The benefits are "obvious" to crusaders, but the objective reality is that large swathes of FOSS are full of casual or hobby code that barely works, has gaping security vulns, and/or is nowhere close to being robust enough for production. "Make software simpler" is a good goal, but hard to do. Other solutions are also possible. They're hard too. So it goes. But there will be no solutions at all until the FOSS community starts dealing with professional reality instead of relying on free-to-tinker-without-consequences rhetoric - and understands that there are real problems that need real answers, and not just more "Clap Louder" and "At least we're not Microsoft".
- zAy0LfpBZLC8mAC 8y ago
  > No, the point is that in practice FOSS code is not any more open than closed source. You seriously believe this? I mean, it's so obviously nonsensical I can hardly believe you are seriously making that point. With FOSS, you have the option to look at the code, with closed source you don't. And you are seriously saying that that is the same level of openness? Also, even if it were true: How is that relevant? FOSS is just as bad as closed source, therefore you should exclude FOSS? How does that follow?! > So you have to take the internals on trust. So, I can not look at FOSS code? Like, you are telling me it is impossible for me to look at the code that I am in fact looking at when selecting code to use for something? I mean, really? That is your point? And the solution then is to not use FOSS, because then you don't have to take the internals on trust?
  - throwawayaway12 8y ago
    I think you have pretty much proved his point. >I realise it's hard for FOSS advocates to understand this, because it's a fundamental flaw with the FOSS philosophy. The benefits are "obvious" to crusaders, but the objective reality is that large swathes of FOSS are full of casual or hobby code that barely works, has gaping security vulns, and/or is nowhere close to being robust enough for production. >And the solution then is to not use FOSS, because then you don't have to take the internals on trust? I think the point is to realize FOSS is not a utopia and has tradeoffs like everything else.

randomsearch 8y ago

1. Commercial does not imply closed source. 2. It’s about legal responsibility and recourse.

zAy0LfpBZLC8mAC 8y ago
> 1. Commercial does not imply closed source. How is that relevant? > 2. It’s about legal responsibility and recourse. How is that relevant?
- andrewflnr 8y ago
  You pay for the software, you get the source. I gather this used to be the default distribution method, and I think it still gets used for game engines.
- peteradio 8y ago
  > you are saying that we should prefer code where it is impossible to have a look at the source Just because not everybody has access != a person inside a gated area doesn't get to see. You made that leap. If you are building software on top of software that carries no guarantees then you are liable unless you also somehow make no guarantees. Are you able to sell software without guarantees? Maybe?
  - zAy0LfpBZLC8mAC 8y ago
    > Just because not everybody has access != a person inside a gated area doesn't get to see. You made that leap. Well, I guess that was somewhat of a leap, but it doesn't really make a difference to the argument: The point is that they are suggesting that preferring code that fewer people can look at somehow solves a problem. > If you are building software on top of software that carries no guarantees then you are liable unless you also somehow make no guarantees. Well, yeah? But what does that have to do with FOSS? Neither does FOSS imply that there are no guarantees, nor does proprietary software imply that there are guarantees. Hence: What is the relevance? The only difference between FOSS and proprietary software in this regard is that with FOSS you have the option to do an audit yourself and offer guarantees on that basis without creating a huge unknown risk for yourself, or you could possibly buy auditing services on the free market that come with some sort of guarantee from a third party. There is no option that you have with proprietary software that is somehow impossible with FOSS, which is why the suggestion that not using FOSS for commercial projects somehow solves a problem is strange at best. > Are you able to sell software without guarantees? Maybe? Well, given the tons of massively broken proprietary commercial software out there? Yeah, obviously you can?

TheOtherHobbes 8y ago

No, the point is that in practice FOSS code is not any more open than closed source. That's the point of this piece. For any non-trivial edit on a real project with real deadlines the source code is effectively useless, because no one has the time, the resources, or possibly even the inclination to fix bugs, do full-coverage testing, or make custom modifications. So you have to take the internals on trust. Which is a ridiculous situation when so many packages are created as hobby projects with - literally - no guarantee of performance or reliability. I realise it's hard for FOSS advocates to understand this, because it's a fundamental flaw with the FOSS philosophy. The benefits are "obvious" to crusaders, but the objective reality is that large swathes of FOSS are full of casual or hobby code that barely works, has gaping security vulns, and/or is nowhere close to being robust enough for production. "Make software simpler" is a good goal, but hard to do. Other solutions are also possible. They're hard too. So it goes. But there will be no solutions at all until the FOSS community starts dealing with professional reality instead of relying on free-to-tinker-without-consequences rhetoric - and understands that there are real problems that need real answers, and not just more "Clap Louder" and "At least we're not Microsoft".

zAy0LfpBZLC8mAC 8y ago
> No, the point is that in practice FOSS code is not any more open than closed source. You seriously believe this? I mean, it's so obviously nonsensical I can hardly believe you are seriously making that point. With FOSS, you have the option to look at the code, with closed source you don't. And you are seriously saying that that is the same level of openness? Also, even if it were true: How is that relevant? FOSS is just as bad as closed source, therefore you should exclude FOSS? How does that follow?! > So you have to take the internals on trust. So, I can not look at FOSS code? Like, you are telling me it is impossible for me to look at the code that I am in fact looking at when selecting code to use for something? I mean, really? That is your point? And the solution then is to not use FOSS, because then you don't have to take the internals on trust?
- throwawayaway12 8y ago
  I think you have pretty much proved his point. >I realise it's hard for FOSS advocates to understand this, because it's a fundamental flaw with the FOSS philosophy. The benefits are "obvious" to crusaders, but the objective reality is that large swathes of FOSS are full of casual or hobby code that barely works, has gaping security vulns, and/or is nowhere close to being robust enough for production. >And the solution then is to not use FOSS, because then you don't have to take the internals on trust? I think the point is to realize FOSS is not a utopia and has tradeoffs like everything else.