2 ms·

An apology should actually contain admission of wrongdoing and an attempt at making amends, as well as an honest undertaking to not repeat that wrongdoing. UoM

by kwdc 5y ago

An apology should actually contain admission of wrongdoing and an attempt at making amends, as well as an honest undertaking to not repeat that wrongdoing. UoM got caught doing wrong. Their "why" doesn't help because their actions are rightly seen by their targets as malicious. This is like breaking into a store, trying to steal something, getting caught and them saying "well done! We were just testing!" Yet this was without any agreement that such testing was prior sanctioned: their actions must be seen as malicious. They set out to deliberately do something where they could be caught. They did get caught. They didn't have permission to test. They need to actually apologize and make amends. Otherwise they might get the idea that trying again is acceptable. The next time they do this things will be even worse. So what was the damage or harm? Loss of trust is one big ticket item. They wasted other's time and effort. Some important feature or functionality was delayed and is likely still being delayed. Or documentation not written. Even something as simple as "enthusiasm to volunteer" might be damaged. These aren't trivial aspects to be ignored.

jnxx 5y ago
They still seem to believe that what they did, increases the security of Linux. And comments still suggest the fix to make Linux less "open" to contributions. It does not seem to me that they have thought much about what they are saying. For example, in a project like Linux, there is new code, but they majority of contributions, especially small fixes (as compared to new drivers and rewrites of subsystems), are very likely bug fixes. And many bugs can intruduce security issues, too, even if that might not be obvious. Therefore, it is not clear at all that making Linux more "closed" (which seems to be the solution which the UMN people and their friends suggest) would make it any more secure. More scrutiny by top maintainers means more time is needed; needing more time means automatically less fixes can be applied, since the maintainer's time is the bottleneck; applying less fixes means more open bugs, and having more open bugs can at least easily mean to have more security issues. There are plenty of closed source projects with a security which is clearly worse than Linux. And not only that, but core Internet security infrastructure like DNS or OpenSSL is open source. The issue is rather that companies cannot be arsed to support that infrastructure they depend on. It would be interesting if the UMN people could come up with research or a hack which motivates them to change. (OTOH, one mayor windows worm per decade such as locky, wannacry, petya, tiny banker, cryptolocker, flame, and so on may be sufficient for the latter in the long run.)

by kwdc 5y ago

jnxx 5y ago

They still seem to believe that what they did, increases the security of Linux. And comments still suggest the fix to make Linux less "open" to contributions. It does not seem to me that they have thought much about what they are saying. For example, in a project like Linux, there is new code, but they majority of contributions, especially small fixes (as compared to new drivers and rewrites of subsystems), are very likely bug fixes. And many bugs can intruduce security issues, too, even if that might not be obvious. Therefore, it is not clear at all that making Linux more "closed" (which seems to be the solution which the UMN people and their friends suggest) would make it any more secure. More scrutiny by top maintainers means more time is needed; needing more time means automatically less fixes can be applied, since the maintainer's time is the bottleneck; applying less fixes means more open bugs, and having more open bugs can at least easily mean to have more security issues. There are plenty of closed source projects with a security which is clearly worse than Linux. And not only that, but core Internet security infrastructure like DNS or OpenSSL is open source. The issue is rather that companies cannot be arsed to support that infrastructure they depend on. It would be interesting if the UMN people could come up with research or a hack which motivates them to change. (OTOH, one mayor windows worm per decade such as locky, wannacry, petya, tiny banker, cryptolocker, flame, and so on may be sufficient for the latter in the long run.)