4 ms·

I mean it's so inexplicably bad that it's hard to imagine it being an innocent mistake. You have to wonder if opening a ticket for such a feature then having s

I mean it's so inexplicably bad that it's hard to imagine it being an innocent mistake. You have to wonder if opening a ticket for such a feature then having someone (or yourself under another account) build it in such an egregious way is a possible vector for deliberately creating such exploits. If this feature was default enabled, then it's even more suspect. It's just such an esoteric thing. When you factor in this kind of thing with recent revelations about backdoored NPM packages, you have to wonder if OSS is even tenable. I don't want to go all the sky is falling here, But the default model of assuming that someone's paying attention doesn't seem to cut it. It works well in most cases, but it's that 2% or 5% that's a doozy.

janto 5y ago
OSS definitely has a reliability and credibility problem on its hands. Codes of Conduct that prioritize belonging over, say, competence and truthfulness is not helping. We need more people like the old Linus that are more concerned with the quality of the artifact than increasing the size of a community
- KarlKemp 5y ago
  I think we need fewer people that somehow manage to mangle logic to such a degree that they blame security vulnerabilities on the willingness of some project to state that it's generally preferred to treat each other with some respect. Linus' insults were always cringeworthy. Sometimes they may have been justified, at other times they were just needlessly hurtful and revealed some sort of weakness on his part. In any case, he always had the power to say no with just that single word. Log4J doesn't even have a code of conduct in its source tree, though I guess Apache probably has one. You'll get a free Log4j update if you find any instances of it having an impact on the project.
- xpe 5y ago
  > Codes of Conduct that prioritize belonging over, say, competence and truthfulness is not helping. Example, please?
- xpe 5y ago
  > Codes of Conduct that prioritize belonging over, say, competence and truthfulness is not helping. What is your reasoning for suggesting that (i) codes of conduct are in tension with (ii) competence and truthfulness?
- xpe 5y ago
  > We need more people like the old Linus that are more concerned with the quality of the artifact than increasing the size of a community There is a difference between (a) maintaining high code quality and review standards and (b) yelling at people and/or degrading them. With this in mind, think through the first-order and second-order effects that happen when toxic leadership behavior is allowed, tolerated, or encouraged in an open source project. Toxic leadership in an open source project, all other things equal, harms the project and the people. Of course, historically, there are cases where intelligent and committed people exhibit toxic behaviors -- but this is not a pattern of behavior for us to aspire to. Quite the opposite. I understand that many people (including software developers) struggle in interpersonal interactions. I don't demonize people when they are unaware or lack the tools to treat others with respect. But these behaviors have huge negative effects, so it reasonable and beneficial to have fair, humane codes of conduct to mitigate such negative patterns of behavior.
einpoklum 5y ago
Alexander Dumas once said: > Une chose qui m'humilie profondément est de voir que le génie humain a des limites, quand la bêtise humaine n'en a pas. So, never discount human stupidity :-(
- SZJX 5y ago
  Sounds quite sensationalized and the other way round tbh. Nobody 10000 years ago would have imagined how far we’ve come nowadays as a whole, while stupidity would be more likely limited by the circumstances and conditions of the time.
raxxorrax 5y ago
That is a pretty far out security assessment. You have the same exploits in commercial software, just security through obscurity helps because of far less usage.
- unclebucknasty 5y ago
  >That is a pretty far out security assessment Yeah, I kind of thought that too as I was typing it, but it's so egregiously bad that I couldn't get around that conclusion. >You have the same exploits in commercial software Sure, virtually all software is susceptible to exploit. But, if someone were sending unsanitized strings to a database, and without using query parameters, etc., then we would all agree that's inexcusable after all of these years of knowing better. IMO, this is in that category.

janto 5y ago

OSS definitely has a reliability and credibility problem on its hands. Codes of Conduct that prioritize belonging over, say, competence and truthfulness is not helping. We need more people like the old Linus that are more concerned with the quality of the artifact than increasing the size of a community

KarlKemp 5y ago
I think we need fewer people that somehow manage to mangle logic to such a degree that they blame security vulnerabilities on the willingness of some project to state that it's generally preferred to treat each other with some respect. Linus' insults were always cringeworthy. Sometimes they may have been justified, at other times they were just needlessly hurtful and revealed some sort of weakness on his part. In any case, he always had the power to say no with just that single word. Log4J doesn't even have a code of conduct in its source tree, though I guess Apache probably has one. You'll get a free Log4j update if you find any instances of it having an impact on the project.
xpe 5y ago
> Codes of Conduct that prioritize belonging over, say, competence and truthfulness is not helping. Example, please?
xpe 5y ago
> Codes of Conduct that prioritize belonging over, say, competence and truthfulness is not helping. What is your reasoning for suggesting that (i) codes of conduct are in tension with (ii) competence and truthfulness?
xpe 5y ago
> We need more people like the old Linus that are more concerned with the quality of the artifact than increasing the size of a community There is a difference between (a) maintaining high code quality and review standards and (b) yelling at people and/or degrading them. With this in mind, think through the first-order and second-order effects that happen when toxic leadership behavior is allowed, tolerated, or encouraged in an open source project. Toxic leadership in an open source project, all other things equal, harms the project and the people. Of course, historically, there are cases where intelligent and committed people exhibit toxic behaviors -- but this is not a pattern of behavior for us to aspire to. Quite the opposite. I understand that many people (including software developers) struggle in interpersonal interactions. I don't demonize people when they are unaware or lack the tools to treat others with respect. But these behaviors have huge negative effects, so it reasonable and beneficial to have fair, humane codes of conduct to mitigate such negative patterns of behavior.

einpoklum 5y ago

Alexander Dumas once said: > Une chose qui m'humilie profondément est de voir que le génie humain a des limites, quand la bêtise humaine n'en a pas. So, never discount human stupidity :-(

SZJX 5y ago
Sounds quite sensationalized and the other way round tbh. Nobody 10000 years ago would have imagined how far we’ve come nowadays as a whole, while stupidity would be more likely limited by the circumstances and conditions of the time.

raxxorrax 5y ago

That is a pretty far out security assessment. You have the same exploits in commercial software, just security through obscurity helps because of far less usage.

unclebucknasty 5y ago
>That is a pretty far out security assessment Yeah, I kind of thought that too as I was typing it, but it's so egregiously bad that I couldn't get around that conclusion. >You have the same exploits in commercial software Sure, virtually all software is susceptible to exploit. But, if someone were sending unsanitized strings to a database, and without using query parameters, etc., then we would all agree that's inexcusable after all of these years of knowing better. IMO, this is in that category.