3 ms·

> I'm still flabbergasted that the original maintainers are rushing around trying to patch these problems. Unless their specific personal/professional projects

> I'm still flabbergasted that the original maintainers are rushing around trying to patch these problems. Unless their specific personal/professional projects are at risk they have no responsibility to hurry and fix a thing. Sorry, but what's the hard part to understand? Open source maintainers end up in this position because they are nice, helpful people who like using computers to solve problems for others. People who spend years on a project and then see a bigger problem arise don't suddenly turn that off. With the bigger problem, they'll want to work harder, not just hoist a middle finger and go binge Netflix without a care in the world. But I totally agree with you on the CTOs, etc. I don't expect random programmers who like working on logging to also be good at solving complicated sociotechological problems around paying for global infrastructure. But it boggles my mind that none of these richly rewarded, supposedly brilliant experts at organizing engineers has gotten out in front of this. If not out of community spirit or social responsibility, then out of pure self interest.

bshipp 5y ago
> none of these richly rewarded, supposedly brilliant experts at organizing engineers has gotten out in front of this Indeed. Each of them has had to spend the last few days madly trying to fix this problem to avoid exposing exposing their infrastructure. Each has been, in some way, replicating the wheel to do so. I'm curious how many will actually submit their findings to the original OSS so others can learn from their experience? There's always resources to put a fire but rarely enough to install a sprinkler system.
- wpietri 5y ago
  For sure. And this was a richly predictable fire. Not this specific problem, of course. But there have been enough fires like this in the past that it makes no sense for companies to act like it won't happen again and again.
ratww 5y ago
> they'll want to work harder, not just hoist a middle finger. There is a perfectly healthy, acceptable, middle ground between those two extremes, however.
- wpietri 5y ago
  Oh? One that's comfortable and easily available to the kind of person who has spent years on an open-source project? One that won't increase the crap they're getting from project users and random strangers? Do tell.
  - ratww 5y ago
    Yes. It's quite simple. There's absolutely no need from maintainers to "rush" to do anything, just do it in a comfortable timeline. And no, this is not equivalent to giving people the finger. Only dishonest people would say so.
    - wpietri 5y ago
      Ah, the magic "just". I don't think you've really grasped the kind of people who spend years maintaining open-source projects. This is like asking sysadmins to ignore alarms and downtime. The kinds of people who can be comfortable ignoring downtime rarely become sysadmins and don't last if they do. Feel free to prove me wrong by pointing to the major open-source project you've led for years and how good you have been at ignoring problems with it.
      - ratww 5y ago
        No, the magic word is "healthy". I said "healthy, acceptable, middle ground". This means learning to say "no" or at least "later, when I have the time". I have maintained open-source projects myself for about 15 years, and it is completely different from sysadmin alarms. I can do it on my time, and even if with vulnerabilities I do it on the time I have previously allotted for doing it, since my family and my job comes first. And no, I won't dox myself. There, I "just" said "no" to you. That's a healthy way of establishing boundaries. By the way, feel free to prove that I'm wrong in saying that by pointing to any law that says I have to do otherwise. And no, just because people have unhealthy behaviours doesn't make it a rule or a law.
        5y ago

bshipp 5y ago

> none of these richly rewarded, supposedly brilliant experts at organizing engineers has gotten out in front of this Indeed. Each of them has had to spend the last few days madly trying to fix this problem to avoid exposing exposing their infrastructure. Each has been, in some way, replicating the wheel to do so. I'm curious how many will actually submit their findings to the original OSS so others can learn from their experience? There's always resources to put a fire but rarely enough to install a sprinkler system.

wpietri 5y ago
For sure. And this was a richly predictable fire. Not this specific problem, of course. But there have been enough fires like this in the past that it makes no sense for companies to act like it won't happen again and again.

ratww 5y ago

> they'll want to work harder, not just hoist a middle finger. There is a perfectly healthy, acceptable, middle ground between those two extremes, however.

wpietri 5y ago
Oh? One that's comfortable and easily available to the kind of person who has spent years on an open-source project? One that won't increase the crap they're getting from project users and random strangers? Do tell.
- ratww 5y ago
  Yes. It's quite simple. There's absolutely no need from maintainers to "rush" to do anything, just do it in a comfortable timeline. And no, this is not equivalent to giving people the finger. Only dishonest people would say so.
  - wpietri 5y ago
    Ah, the magic "just". I don't think you've really grasped the kind of people who spend years maintaining open-source projects. This is like asking sysadmins to ignore alarms and downtime. The kinds of people who can be comfortable ignoring downtime rarely become sysadmins and don't last if they do. Feel free to prove me wrong by pointing to the major open-source project you've led for years and how good you have been at ignoring problems with it.
    - ratww 5y ago
      No, the magic word is "healthy". I said "healthy, acceptable, middle ground". This means learning to say "no" or at least "later, when I have the time". I have maintained open-source projects myself for about 15 years, and it is completely different from sysadmin alarms. I can do it on my time, and even if with vulnerabilities I do it on the time I have previously allotted for doing it, since my family and my job comes first. And no, I won't dox myself. There, I "just" said "no" to you. That's a healthy way of establishing boundaries. By the way, feel free to prove that I'm wrong in saying that by pointing to any law that says I have to do otherwise. And no, just because people have unhealthy behaviours doesn't make it a rule or a law.
      - 5y ago