5 ms·

incidental, have you donated to putty?

by cblconfederate 5y ago

Chris2048 5y ago
Are you implying putty devs didn't serve over httpS b/c they couldn't afford to?
- ori_b 5y ago
  Because they were busy with their paid job.
  - mjw1007 5y ago
    Perhaps more likely: because they were the sort of people that disliked the certificate authority cartel, and preferred to rely on a GPG signature until letsencrypt came along.
  - Chris2048 5y ago
    Then why aren't they too busy to develop putty also? I don't like the idea of security matters being payed extras. Would you make free cupcakes for people, but refuse to wash you hands while doing so unless someone paid you to? "Hey, I'm too busy with paid work to make my cupcakes hygienic; you want clean cupcakes, make your own!"
    - ori_b 5y ago
      If someone made free cupcakes and didn't wash their hands, I wouldn't eat them. I wouldn't get angry that they spent their free time making cupcakes that I didn't really want. And the wonderful thing about open source is that you can take the existing code, fork it, and do things the way you think they should be done. No salary? No obligations.
      - Chris2048 5y ago
        > I wouldn't eat them How would you know unless you asked. When someone offers you something for free, do you interrogate them over their process? They aren't paid to answer your questions either. The end result is no one should accept anything that is free. Well done, Microsoft just won. > the wonderful thing about open source is.. Are you writing your own OS, prog-lang and compiler from scratch too? If "you can take the existing code, fork it" is the only way to get secure code, then the real implication is having secure code requires you to "take the existing code, fork it"; This sounds less like the wonderful thing, and more like the terrible thing. > No salary? No obligations. Then why can't people give legal/medical advices without licence? Why can't I see a dying man in the street and choose not to call 999? Why can't I refuse jury duty, or the draft etc etc?
        ori_b 5y ago
        You sound incredibly entitled. "Give me free things done to my specs, or Microsoft won. No, of course you don't deserve a salary for that." > Are you writing your own OS, prog-lang and compiler from scratch too? Yes -- I'm an OpenBSD and 9front committer, and I have built my own language and compiler. My website -- https://orib.dev https://orib.dev -- runs code I can commit to all the way down to the hardware. But that's neither here nor there. I do that because it's fun. You also don't get to demand work from me without paying.
        Chris2048 5y ago
        > You sound.. Is sounds entitled b/c you paraphrased it uncharitably. I didn't ask for "any spec" - there's a big (Hippocratic) difference between dictating what form something comes in, and asking that it do no harm. A poison cupcake, much like a poorly secured software, could wipe out any benefit it brings. Also, I'm not demanding anything: feel free not to produce anything; But if you do, make it reasonably secure, or clearly/explicitly communicate that is it insecure; in the same way websites are (supposed) to seek permissions for cookies rather than assume them. The context of "or Microsoft won" is that MS pushed the idea that FOSS could not be trusted without legal liability - this essentially makes that case. I provided a few example of where people are expected to do things without being paid, do you also refuse to do those things?
hsbauauvhabzb 5y ago
No, but i haven’t used it pretty much at all since I moved to linux in 2016. Edit: but I’ve submitted various security vulnerabilities to oss products, real actual issues too, not Nessus output.

incidental, have you donated to putty?

Chris2048 5y ago

Are you implying putty devs didn't serve over httpS b/c they couldn't afford to?

ori_b 5y ago
Because they were busy with their paid job.
- mjw1007 5y ago
  Perhaps more likely: because they were the sort of people that disliked the certificate authority cartel, and preferred to rely on a GPG signature until letsencrypt came along.
- Chris2048 5y ago
  Then why aren't they too busy to develop putty also? I don't like the idea of security matters being payed extras. Would you make free cupcakes for people, but refuse to wash you hands while doing so unless someone paid you to? "Hey, I'm too busy with paid work to make my cupcakes hygienic; you want clean cupcakes, make your own!"
  - ori_b 5y ago
    If someone made free cupcakes and didn't wash their hands, I wouldn't eat them. I wouldn't get angry that they spent their free time making cupcakes that I didn't really want. And the wonderful thing about open source is that you can take the existing code, fork it, and do things the way you think they should be done. No salary? No obligations.
    - Chris2048 5y ago
      > I wouldn't eat them How would you know unless you asked. When someone offers you something for free, do you interrogate them over their process? They aren't paid to answer your questions either. The end result is no one should accept anything that is free. Well done, Microsoft just won. > the wonderful thing about open source is.. Are you writing your own OS, prog-lang and compiler from scratch too? If "you can take the existing code, fork it" is the only way to get secure code, then the real implication is having secure code requires you to "take the existing code, fork it"; This sounds less like the wonderful thing, and more like the terrible thing. > No salary? No obligations. Then why can't people give legal/medical advices without licence? Why can't I see a dying man in the street and choose not to call 999? Why can't I refuse jury duty, or the draft etc etc?
      - ori_b 5y ago
        You sound incredibly entitled. "Give me free things done to my specs, or Microsoft won. No, of course you don't deserve a salary for that." > Are you writing your own OS, prog-lang and compiler from scratch too? Yes -- I'm an OpenBSD and 9front committer, and I have built my own language and compiler. My website -- https://orib.dev https://orib.dev -- runs code I can commit to all the way down to the hardware. But that's neither here nor there. I do that because it's fun. You also don't get to demand work from me without paying.
        Chris2048 5y ago
        > You sound.. Is sounds entitled b/c you paraphrased it uncharitably. I didn't ask for "any spec" - there's a big (Hippocratic) difference between dictating what form something comes in, and asking that it do no harm. A poison cupcake, much like a poorly secured software, could wipe out any benefit it brings. Also, I'm not demanding anything: feel free not to produce anything; But if you do, make it reasonably secure, or clearly/explicitly communicate that is it insecure; in the same way websites are (supposed) to seek permissions for cookies rather than assume them. The context of "or Microsoft won" is that MS pushed the idea that FOSS could not be trusted without legal liability - this essentially makes that case. I provided a few example of where people are expected to do things without being paid, do you also refuse to do those things?

hsbauauvhabzb 5y ago

No, but i haven’t used it pretty much at all since I moved to linux in 2016. Edit: but I’ve submitted various security vulnerabilities to oss products, real actual issues too, not Nessus output.