4 ms·

> But if you allow them blanket access to your github (or gitlab), YOU SHOULD ARGUABLY BE DISQUALIFIED FROM BEING A SOFTWARE DEVELOPER!!! The author would prob

by jart 6y ago

> But if you allow them blanket access to your github (or gitlab), YOU SHOULD ARGUABLY BE DISQUALIFIED FROM BEING A SOFTWARE DEVELOPER!!! The author would probably have himself professionally disbarred if he knew what Disqus was doing with his blog. Which is why I think we should be more forgiving of mistakes than what his tone proposes. GitHub obviously has room to improve, but ultimately the system runs on trust, and sometimes the best we can do when it's violated is react to solve the problem and then write a postmortem.

pdimitar 6y ago
Anyone who would abuse this overly wide access given to their org (by the dev) wouldn't make a single bleep about it and just keep scraping data and code quietly until the door is shut in front of their face. So I don't think your idea about how this should work is good. If somebody wants to just shovel other organization's code into their silo then they are not incentivized to attack the current state of affairs; on the contrary, they are benefiting from them, why would they say anything at all? > The author would probably have himself professionally disbarred if he knew what Disqus was doing with his blog. I agree that we should be conscious of security in all things and apply universal standards but your comment comes off as a whataboutism and a discussion stopper. We can and should address the security issues one by one. That a lot of things are broken does not mean we should throw our hands in the air and give up, no?
- jart 6y ago
  I think what we need is more along the lines of this blog post: https://opensource.googleblog.com/2017/03/operation-rosehub.html https://opensource.googleblog.com/2017/03/operation-rosehub.... Modern tools grant each individual the ability to fix the world's code at scale. All we have to do is get our hands dirty creating the change we want to see in the world. Doing that effectively it helps to not assign blame since we all make mistakes and ultimately the goal is to improve.
  - pdimitar 6y ago
    This is a commendable initiative. From the article: > With the help of GitHub’s GUI, any individual can make such changes to anyone’s codebase in under a minute. Sigh, so yet again the load falls on the normal working programmers' free time. And yet again the effort is vastly underestimated. Sure it took 5-10 minutes (I doubt it took one, as article claims) this time but what about the next 50 times? The article even supports this: > As more work was completed, it was apparent that the problem was bigger than we had initially realized. I am glad several Googlers decided to help. I wish it happened more often with them and other corporations. The normal working programmers are overworked enough already.
    - jart 6y ago
      You have a very negative way of looking at things. Spartacus was born a few miles from you and he was just an ordinary guy. Would he have needed to be a rebel had he been born today, in a time when the system gives each individual the tools they need to make the world a better place? I say why not use them.
      - pdimitar 6y ago
        Because there's a limited amount of hours per day, and even more limited joules of energy. So I'll always disagree that such initiatives must be in one's free time. Guess I am only looking at this as a job now. I do want to work on certain things but nobody is willing to pay for them, AFAIK at least.

by jart 6y ago

pdimitar 6y ago

Anyone who would abuse this overly wide access given to their org (by the dev) wouldn't make a single bleep about it and just keep scraping data and code quietly until the door is shut in front of their face. So I don't think your idea about how this should work is good. If somebody wants to just shovel other organization's code into their silo then they are not incentivized to attack the current state of affairs; on the contrary, they are benefiting from them, why would they say anything at all? > The author would probably have himself professionally disbarred if he knew what Disqus was doing with his blog. I agree that we should be conscious of security in all things and apply universal standards but your comment comes off as a whataboutism and a discussion stopper. We can and should address the security issues one by one. That a lot of things are broken does not mean we should throw our hands in the air and give up, no?

jart 6y ago
I think what we need is more along the lines of this blog post: https://opensource.googleblog.com/2017/03/operation-rosehub.html https://opensource.googleblog.com/2017/03/operation-rosehub.... Modern tools grant each individual the ability to fix the world's code at scale. All we have to do is get our hands dirty creating the change we want to see in the world. Doing that effectively it helps to not assign blame since we all make mistakes and ultimately the goal is to improve.
- pdimitar 6y ago
  This is a commendable initiative. From the article: > With the help of GitHub’s GUI, any individual can make such changes to anyone’s codebase in under a minute. Sigh, so yet again the load falls on the normal working programmers' free time. And yet again the effort is vastly underestimated. Sure it took 5-10 minutes (I doubt it took one, as article claims) this time but what about the next 50 times? The article even supports this: > As more work was completed, it was apparent that the problem was bigger than we had initially realized. I am glad several Googlers decided to help. I wish it happened more often with them and other corporations. The normal working programmers are overworked enough already.
  - jart 6y ago
    You have a very negative way of looking at things. Spartacus was born a few miles from you and he was just an ordinary guy. Would he have needed to be a rebel had he been born today, in a time when the system gives each individual the tools they need to make the world a better place? I say why not use them.
    - pdimitar 6y ago
      Because there's a limited amount of hours per day, and even more limited joules of energy. So I'll always disagree that such initiatives must be in one's free time. Guess I am only looking at this as a job now. I do want to work on certain things but nobody is willing to pay for them, AFAIK at least.