5 ms·

Here is a picture from the Reddit thread [0]. Absolutely unacceptable design not to account for something like that when programming software. There should be

Here is a picture from the Reddit thread [0]. Absolutely unacceptable design not to account for something like that when programming software. There should be an explicit notice of where the message is coming from. I see people blaming users for trusting a new GitHub repository, but the fault rests solely on the contributors to the project responsible for this. [0] https://user-images.githubusercontent.com/29142493/50359293-8780b500-055c-11e9-8cfd-83b342edeffb.png https://user-images.githubusercontent.com/29142493/50359293-...

Meekro 8y ago
You're right, and Electrum actually has a history of severe security bugs. I think there was one a while back where any website you visit could use JS to connect to Electrum's RPC interface and do things on your behalf.
nradov 8y ago
It seems unfair to claim that anything is "unacceptable" in free software. If you're not paying for it then be thankful for whatever you get. No one is forced to use it.
- baddox 8y ago
  I don’t get it. Why should anyone be thankful that they lost bitcoins, simply because the software was free? I really dislike this trend of absolving free software of literally any quality standards whatsoever. Don’t act entitled, sure, but you’re doing no one any favors by refusing to even express desire for better quality.
  - nradov 8y ago
    If a friend gave me a free safe, and then a thief cracked it open easily due to a fragile lock and stole my money, I wouldn't blame my friend.
    - hopler 8y ago
      What if your friend gave you a free coffee with poison in it?
      - nradov 8y ago
        All coffee has poison in it. Acrylamide is a known carcinogen. Caffeine is also poisonous: if you drink about 100 cups of coffee it will literally kill you. You'll have to be more specific about the type and quantity of poison.
        ouid 8y ago
        have you ever considered acting in good faith on the internet?
        nradov 8y ago
        Have you considered that the question was obviously not asked in good faith? Ask a silly question, get a pedantic answer.
        dang 8y ago
        Personal attacks are not ok here, regardless of how wrong or annoying some other comment is. Please review https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and post civilly and substantively, or not at all.
    - baddox 8y ago
      The word “blame” carries a different connotation than the word “unacceptable” which was used in this thread.
    - IshKebab 8y ago
      I would!
- Kaveren 8y ago
  If you're going to be so negligent that you don't care to design your free product in such a way that it doesn't let people's money get stolen so easily, it's better not to release at all. Complicated security vulnerabilities, I get. It's tough. But just the basic thought to inform someone that a message is not from the Electrum "team" would be nice. It's unreasonable to expect everyone to read every bit source code of all open (or closed) source software they use. If I were to use Linux for free, and in this imaginary world all of the sudden I had my banking credentials stolen from a similar lack of care, I think I'd be justifiably upset. Should the people who lost money be thankful they got to use Electrum in the first place?
  - nradov 8y ago
    There's no negligence in giving software away for free. No one is stopping users from doing their own security audits, or hiring experts to do it for them. Beggars can't be choosers, and if users are upset at anyone it should be the thief. Cryptocurrencies are speculative trading vehicles, not money. No one actually lost anything of real value. A fool and his coins are soon parted.
    - Kaveren 8y ago
      If Visual Studio Code, which is open source software I use daily and have not audited, tells me to update and I lose something of value to me from it, I'm going to be furious. You can debate about the "real value" of Bitcoin or lack thereof, but I'm sure it had "real value" to the people who lost it. If people will pay $5 for Bitcoin, its worth at the time is $5, if $3,000, "real value" is $3,000. But that's besides the point. Again, I've never really used Bitcoin and don't find it particularly promising, it's not my hill to die on. I do care about an issue like this, though.
      - nradov 8y ago
        If having quality software is important to you then you might want to actually pay a vendor that you can hold accountable rather than depending on the kindness of strangers. Free software is great! I use it all the time. But I'm under no illusions about imaginary negligence or accountability.
- freshhawk 8y ago
  So does that extend to publishing text without software? No one is forced to believe my free phishing message right? Or my free advice about drinking arsenic to cure cancer? It is a growing trend to annotate the readme of an open source repo with a kind of statement of confidence. "This is code I'm not vouching for but want to share because it may be useful to others" and "this is my open source project that I consider to be production ready and will tie my reputation to" are very different things. This was very obviously the second, so ethical duties involving lying to people for your own benefit and concepts of due diligence clearly come in to play. And even if this makes no sense in your ethical system, at least be aware that people think that way and will remember your name in these kinds of circumstances even if they have no legal recourse.
  - nradov 8y ago
    In a worldwide software ecosystem there is no universal standard for ethics or diligence. Unhappiness in human interactions can usually be traced back to a mismatch of expectations. When I use software I expect nothing more than the formal legal agreement explicitly spells out. That way I'm often pleasantly surprised when software does anything useful at all! For production software I've found it's wise to have a paid vendor to hold accountable (single throat to choke). Paid support is available for most major FOSS packages.
    - freshhawk 8y ago
      Ok, you convince everyone in the world of that system of ethics and problem solved! Until then, set expectations explicitly so that people who make different assumptions from you don't get mad at you. It takes 5 minutes to be explicit in your readme. Somehow everyone else in the world deals with similar issues without the special pleading so common in software. Software isn't that different, despite your wish to be unbound from normal expectations to not cause harm through misleading communication because you are behind a screen.
- dang 8y ago
  Can you please not take HN threads on flamewar tangents, and please not post in the flamewar style? Some of your comments have crossed into incivility, or at least testiness. That has a degrading effect on discussion. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

Meekro 8y ago

You're right, and Electrum actually has a history of severe security bugs. I think there was one a while back where any website you visit could use JS to connect to Electrum's RPC interface and do things on your behalf.

nradov 8y ago

It seems unfair to claim that anything is "unacceptable" in free software. If you're not paying for it then be thankful for whatever you get. No one is forced to use it.

baddox 8y ago
I don’t get it. Why should anyone be thankful that they lost bitcoins, simply because the software was free? I really dislike this trend of absolving free software of literally any quality standards whatsoever. Don’t act entitled, sure, but you’re doing no one any favors by refusing to even express desire for better quality.
- nradov 8y ago
  If a friend gave me a free safe, and then a thief cracked it open easily due to a fragile lock and stole my money, I wouldn't blame my friend.
  - hopler 8y ago
    What if your friend gave you a free coffee with poison in it?
    - nradov 8y ago
      All coffee has poison in it. Acrylamide is a known carcinogen. Caffeine is also poisonous: if you drink about 100 cups of coffee it will literally kill you. You'll have to be more specific about the type and quantity of poison.
      - ouid 8y ago
        have you ever considered acting in good faith on the internet?
        nradov 8y ago
        Have you considered that the question was obviously not asked in good faith? Ask a silly question, get a pedantic answer.
        dang 8y ago
        Personal attacks are not ok here, regardless of how wrong or annoying some other comment is. Please review https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and post civilly and substantively, or not at all.
  - baddox 8y ago
    The word “blame” carries a different connotation than the word “unacceptable” which was used in this thread.
  - IshKebab 8y ago
    I would!
Kaveren 8y ago
If you're going to be so negligent that you don't care to design your free product in such a way that it doesn't let people's money get stolen so easily, it's better not to release at all. Complicated security vulnerabilities, I get. It's tough. But just the basic thought to inform someone that a message is not from the Electrum "team" would be nice. It's unreasonable to expect everyone to read every bit source code of all open (or closed) source software they use. If I were to use Linux for free, and in this imaginary world all of the sudden I had my banking credentials stolen from a similar lack of care, I think I'd be justifiably upset. Should the people who lost money be thankful they got to use Electrum in the first place?
- nradov 8y ago
  There's no negligence in giving software away for free. No one is stopping users from doing their own security audits, or hiring experts to do it for them. Beggars can't be choosers, and if users are upset at anyone it should be the thief. Cryptocurrencies are speculative trading vehicles, not money. No one actually lost anything of real value. A fool and his coins are soon parted.
  - Kaveren 8y ago
    If Visual Studio Code, which is open source software I use daily and have not audited, tells me to update and I lose something of value to me from it, I'm going to be furious. You can debate about the "real value" of Bitcoin or lack thereof, but I'm sure it had "real value" to the people who lost it. If people will pay $5 for Bitcoin, its worth at the time is $5, if $3,000, "real value" is $3,000. But that's besides the point. Again, I've never really used Bitcoin and don't find it particularly promising, it's not my hill to die on. I do care about an issue like this, though.
    - nradov 8y ago
      If having quality software is important to you then you might want to actually pay a vendor that you can hold accountable rather than depending on the kindness of strangers. Free software is great! I use it all the time. But I'm under no illusions about imaginary negligence or accountability.
freshhawk 8y ago
So does that extend to publishing text without software? No one is forced to believe my free phishing message right? Or my free advice about drinking arsenic to cure cancer? It is a growing trend to annotate the readme of an open source repo with a kind of statement of confidence. "This is code I'm not vouching for but want to share because it may be useful to others" and "this is my open source project that I consider to be production ready and will tie my reputation to" are very different things. This was very obviously the second, so ethical duties involving lying to people for your own benefit and concepts of due diligence clearly come in to play. And even if this makes no sense in your ethical system, at least be aware that people think that way and will remember your name in these kinds of circumstances even if they have no legal recourse.
- nradov 8y ago
  In a worldwide software ecosystem there is no universal standard for ethics or diligence. Unhappiness in human interactions can usually be traced back to a mismatch of expectations. When I use software I expect nothing more than the formal legal agreement explicitly spells out. That way I'm often pleasantly surprised when software does anything useful at all! For production software I've found it's wise to have a paid vendor to hold accountable (single throat to choke). Paid support is available for most major FOSS packages.
  - freshhawk 8y ago
    Ok, you convince everyone in the world of that system of ethics and problem solved! Until then, set expectations explicitly so that people who make different assumptions from you don't get mad at you. It takes 5 minutes to be explicit in your readme. Somehow everyone else in the world deals with similar issues without the special pleading so common in software. Software isn't that different, despite your wish to be unbound from normal expectations to not cause harm through misleading communication because you are behind a screen.
dang 8y ago
Can you please not take HN threads on flamewar tangents, and please not post in the flamewar style? Some of your comments have crossed into incivility, or at least testiness. That has a degrading effect on discussion. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html