3 ms·

I think the context somehow gets lost in this discussion. You indeed need a chain of trust in general, and can't inspect all the software alone even if it's FLO

I think the context somehow gets lost in this discussion. You indeed need a chain of trust in general, and can't inspect all the software alone even if it's FLOSS, but I'm talking about odd specialized programs shipped by hardware manufacturers (like the one TFA talks about) and similar one-off ones that come from an untrusted source: there's no trust there, no reliance on others inspecting it, but if you have the source code, it's often reasonable to read. Also occasionally desirable to fix or otherwise modify, to integrate into your overall system (that's what I tend to do pretty much each time when interacting with such sotfware+hardware, sometimes reverse engineering and reimplementing it, so maybe my view is a bit skewed). So FLOSS is good, closed source and proprietary is less trustworthy and less usable.

ChrisLomont 5y ago
>I'm talking about odd specialized programs shipped by hardware manufacturers (like the one TFA talks about In that case, open source rarely has even one possible replacement, so there's no comparison. >but if you have the source code, it's often reasonable to read As someone working in code daily, I disagree. I find lots of open source projects once you get out of the few big ones to be a massive mess of code. And most programs of much use are simply too big to do any sort of audit. I have lots of friends in open source - I doubt a single one has ever read over the source for an entire program to inspect. Have you honestly read over an entire open source program to check it? Or is this a myth that gets repeated but no one does it.... As to modification, I've reverse engineered many, many programs to add hooks and interoperability. It's not that terribly difficult once you've done a few and get to know how to do it. So sure, nice clean code is good. But open source software I find to be crappy for all but the few big uses. GIMP vs photoshop? No real good OS CAD, or finance, or comparing Octave to Mathematica? Buggy video editor of the week to DaVinci Resolve? Tax software? Inkscape vs AI? So as a result of lacking quality in OS, I prefer closed source solutions since paying for them gets me vastly better quality for a lot of things I want software for. And in the rare case I want to hack something, I still can and do. Open source is honestly a you-get-what-you-paid-for solution for most stuff.
- defanor 5y ago
  Sounds like we had quite a different experience, and picturing different things too. > In that case, open source rarely has even one possible replacement, so there's no comparison. There's usually just one program shipped by a vendor in these cases, and most of the time it's indeed closed-source -- that's what I started with. Big and widely used FLOSS projects are far from these programs shipped by small hardware manufacturers, I wasn't talking about those. Just as the established and polished commercial projects are far from those: you're getting some buggy and unsupported programs from unknown hardware vendors, possibly even with malware as in TFA, not Photoshop. > Have you honestly read over an entire open source program to check it? I have, pretty sure that many others read those too, but haven't read entire sources of large projects like GIMP; plenty of programs and libraries are just a few KLOC (or even just hundreds of LOC) long, easy to skim. > As to modification, I've reverse engineered many, many programs to add hooks and interoperability. It's not that terribly difficult once you've done a few and get to know how to do it. I have rather hard time imagining these being any major modifications and considered easy with arbitrary compiled binaries, while suspecting merely reading sources being something mythical. But once again, you're probably picturing a hairy mess of a huge project's source code, and I picture integration tasks like turning a buggy Windows GUI program into a working multi-threaded Linux daemon -- where having source code makes it easier (and I'm certainly reading at least decompiled code when that's an option), as well as making it practical/easier to see what the program is doing.
  - ChrisLomont 5y ago
    Something as small as a few kloc I can reverse back to compilable source in a day, so things that trivially small are not difficult to edit to your hearts content. Heck, I suspect Ghidra nowadays makes that a single click task. And if it's that small, it's also trivial to write. I doubt too many companies fret over stuff that small.

ChrisLomont 5y ago

>I'm talking about odd specialized programs shipped by hardware manufacturers (like the one TFA talks about In that case, open source rarely has even one possible replacement, so there's no comparison. >but if you have the source code, it's often reasonable to read As someone working in code daily, I disagree. I find lots of open source projects once you get out of the few big ones to be a massive mess of code. And most programs of much use are simply too big to do any sort of audit. I have lots of friends in open source - I doubt a single one has ever read over the source for an entire program to inspect. Have you honestly read over an entire open source program to check it? Or is this a myth that gets repeated but no one does it.... As to modification, I've reverse engineered many, many programs to add hooks and interoperability. It's not that terribly difficult once you've done a few and get to know how to do it. So sure, nice clean code is good. But open source software I find to be crappy for all but the few big uses. GIMP vs photoshop? No real good OS CAD, or finance, or comparing Octave to Mathematica? Buggy video editor of the week to DaVinci Resolve? Tax software? Inkscape vs AI? So as a result of lacking quality in OS, I prefer closed source solutions since paying for them gets me vastly better quality for a lot of things I want software for. And in the rare case I want to hack something, I still can and do. Open source is honestly a you-get-what-you-paid-for solution for most stuff.

defanor 5y ago
Sounds like we had quite a different experience, and picturing different things too. > In that case, open source rarely has even one possible replacement, so there's no comparison. There's usually just one program shipped by a vendor in these cases, and most of the time it's indeed closed-source -- that's what I started with. Big and widely used FLOSS projects are far from these programs shipped by small hardware manufacturers, I wasn't talking about those. Just as the established and polished commercial projects are far from those: you're getting some buggy and unsupported programs from unknown hardware vendors, possibly even with malware as in TFA, not Photoshop. > Have you honestly read over an entire open source program to check it? I have, pretty sure that many others read those too, but haven't read entire sources of large projects like GIMP; plenty of programs and libraries are just a few KLOC (or even just hundreds of LOC) long, easy to skim. > As to modification, I've reverse engineered many, many programs to add hooks and interoperability. It's not that terribly difficult once you've done a few and get to know how to do it. I have rather hard time imagining these being any major modifications and considered easy with arbitrary compiled binaries, while suspecting merely reading sources being something mythical. But once again, you're probably picturing a hairy mess of a huge project's source code, and I picture integration tasks like turning a buggy Windows GUI program into a working multi-threaded Linux daemon -- where having source code makes it easier (and I'm certainly reading at least decompiled code when that's an option), as well as making it practical/easier to see what the program is doing.
- ChrisLomont 5y ago
  Something as small as a few kloc I can reverse back to compilable source in a day, so things that trivially small are not difficult to edit to your hearts content. Heck, I suspect Ghidra nowadays makes that a single click task. And if it's that small, it's also trivial to write. I doubt too many companies fret over stuff that small.