29 ms·

On the Weaponisation of Open Source

• aritmo 5y ago
  Knee-jerk reaction and discrimination against the Russian people.
  • pageandrew 5y ago
    I agree its a kneejerk reaction. But to be fair, its not discrimination against the Russian people, its discrimination against a particular ideology that is predominantly held by the Russian people.
    • croes 5y ago
      Which ideology?
    • BaseballPhysics 5y ago
      > But to be fair, its not discrimination against the Russian people, its discrimination against a particular ideology that is predominantly held by the Russian people. To be even more fair, it's both. There are plenty of Russians that absolutely do not agree with what the Russian leadership is doing, but have no choice in the matter. Speaking as a Canadian, there was a time when we were similarly fighting an adversary and chose to indiscriminately treat all people from that nation as enemies. The result was the internment of Japanese Canadians, one of the most shameful periods in our nation's history. I cannot help but be very concerned that we're heading down a very familiar and dangerous path, here...
      • beebmam 5y ago
        Speaking as someone who was vehemently against the Iraq war and lived in the US, I welcomed discrimination against my own people. The United States was responsible for war crimes in that war, and for sure we deserved sanctions, boycotts, divestment, and bad international relations due to it. I was treated extremely rudely for being American when I went to France in late 2003, and I totally understood why. I hated my own country and my countrymen for it as well. I still do, in a sense. We owe the Iraqi people an enormous debt of reparations
        • joe_the_user 5y ago
          I was treated extremely rudely for being American when I went to France in late 2003, and I totally understood why. It seems too easy to say "uh discrimination is fine" when the only thing you have to fear is people being rude to you on vacation. If you face the loss of your livelihood, like the owner of a small Russian restaurant somewhat, I don't think you'd be as sanguine.
          • beebmam 5y ago
            I was spit on, had two of my hotel reservations cancelled, and was robbed
            • rossvor 5y ago
              And you applaud this? How is this a good thing?
            • cartesius13 5y ago
              One would think that after going through this you would become more empathetic and understanding of the ordinary citizens side. But no, somehow the takeaway was that discrimination against innocent people based where they're from is OK
        • HideousKojima 5y ago
          >I was treated extremely rudely for being American when I went to France in late 2003 That's just the French being the French, would have been the same in the 90's lol. And if you think that's bad, try going there as a French Canadian like my grandfather did. He got treated way waaaay better when he spoke English instead of the his "dirty" (what the Frenchies called it) Quebecois French.
          • BlueTemplar 5y ago
            The 90's is when the first Iraq war and then the deadly embargo happened...
          • 5y ago
    • nyolfen 5y ago
      did any of these actions select their targets by ideology?
    • pie_flavor 5y ago
      No, it's discrimination against anyone with a Russian IP address, as clearly described in the article.
  • sharken 5y ago
    The author obviously thinks that open source that discriminates cannot be open source. In principle this is true given the current Open Source license. But i would argue that the clause about discrimination is out of touch with reality. Usage rights to Open Source should not by default be granted to oppressive regimes and the author should absolutely be allowed to state that within the license. If the west wants to send a clear signal to Putin, then matters such as the wording of the Open Source license needs to be adjusted accordingly.
    • beny23 5y ago
      Hello, author here. I do think the open source licence is framed to be non-discriminatory and I think that’s not a bad thing. Discrimination lends itself to politicisation and in turn division. And I think an ecosystem where we have lots of division is not good. What would happen if two interdependent projects suddenly had conflicting political requirements?
      • beaconstudios 5y ago
        I think that holding onto the idea that software is apolitical is untenable. Social media companies and large corporations try to toe this line and have been widely rebuked for it (Google trying to get ICE contracts, for example). I think the idea that "everything is political" is taking it too far, but so is the idea that providing material support to any comers is apolitical. Bear in mind that I'm talking descriptively rather than prescriptively here. I have my own opinions but I can also observe that political neutrality as a concept is waning.
        • quinnjh 5y ago
          Ok so its political, what if this political take where we encourage openness and interconnectivity is superior to the political take where we are reactionary? What if it literally is a winning strategy? Im not saying it is necessarily- but i think to get past the division you have highlighted (apolitical universality vs political conservatism) there is perhaps a way to look at the various approaches and determine what approach would be technologically, logistically, and politically advantageous. Let us let go of the idea it is apolitical, what now?
  • deleted 5y ago
    [deleted]
• deleted 5y ago
  [deleted]
• emodendroket 5y ago
  We've pretty quickly decided to throw out decades of norms in favor of anti-Russia moves all the time. Not ideal.
  • pie_flavor 5y ago
    This is the culmination of about a decade of reinforcing the idea that political actions don't count as violating norms if the actions are against someone who violates other norms of yours.
    • whatshisface 5y ago
      Or maybe just the culmination of internet libertarians who stick to principles being out-populated by more average people who stick to each other (that is a nice way of phrasing the practice of putting popularity before ideals but it's also true to its real nature).
      • SamoyedFurFluff 5y ago
        Internet libertarians definitely also stick it to each other in dumb ways whenever they think their cause is right. Let’s not kid ourselves; an average person wouldn’t know how to wield open source for their personal political nonsense. It would precisely be a technocrat who thinks they’re enlightened.
        • whatshisface 5y ago
          >an average person wouldn’t know how to wield open source for their personal political nonsense I am close to an average person in this regard because I am a free-rider on other people's enlightened steering: all I do is install stuff and in exchange I get privacy and security.
      • LudwigNagasena 5y ago
        The culture of those “average people” stems from the beliefs of Calvinist fanatics that fled England because it wasn’t radical enough.
• keewee7 5y ago
  >an American NGO lost 30,000 files documenting Russian war crimes This is a bullshit claim made by a one hour old GitHub account with a random username. Probably a pro-Russian troll that wants to dissuade other open source maintainers from pushing anti-Russian protestware.
  • pizzathehut1 5y ago
    >Probably a pro-Russian troll I'm not sure a pro-Russian troll would claim that Russians committed 30,000 war crimes
• tsujp 5y ago
  This is what happens when -- above everything else -- not following EXACTLY the mainstream political view gets you cancelled. I think the Russian war in Ukraine is bad. However, I don't extend the Russian _governments_ actions to Russian citizens. All nuance is lost and unless you spout "Russia bad" or are flagrantly anti-Russia you are someone worthy of being cancelled by the Twitter mob et al. Acts against Russian citizens who are trapped by their government are immoral and unethical. Acts that introduce malware into open source software and discriminate against people are immoral and unethical. Right now, however, doing exactly these things is the "woke" and "politically correct" thing to do.
• fhaltmayer 5y ago
  The terraform changes just seem so unprofessional and a prime example of virtue-signaling.
  • pavlov 5y ago
    I agree about it being unprofessional. But does "virtue signalling" now mean simply any form of protest? Were the Canadian truckers protesting in Ottawa virtue signalling? Are people posting "Let's Go Brandon" online also virtue signalling? If not, what's the difference between their form of protest and this Terraform stunt?
    • _jal 5y ago
      > If not, what's the difference Political valence. It is a term a certain flavor of culture warrior likes to employ in attempts to devalue public statements by their opponents.
      • ghostpepper 5y ago
        Like all politically-charged terms, the original meaning has been long lost as the context in which it was coined is forgotten. I think the term ‘virtue signalling’ was originally intended to point out a perceived hypocrisy - that it’s much easier to gain public support for an idea/cause/campaign if that campaign is perceived to be helping some disenfranchised group - even if the campaign also benefits the organizer, and even if the campaign is not necessarily wanted by some or even all of the allegedly-aggrieved group.
      • beaconstudios 5y ago
        It did start out that way (an attack by conservatives against progressives) but has since become ubiquitous. It just refers to immaterial forms of protest that don't accomplish anything except signaling support for a cause.
    • ksjnq 5y ago
    • 5y ago
• bjt2n3904 5y ago
  Certain things should be a-political. Like the international space station, football, and open source software. But a software development has yielded to demands that it adhere to causes. Redis isn't just a key value store, it's engaging in anti-racism by removing terms of whiteness, like "master" and "slave". And here we are. Uninstall nginx, unless you're a fascist that supports Putin! Did you hear? Russia is using leftpad.js! Quick, unpublish the repository in solidarity with... We have to reduce harm! No one is neutral! You're for us, or against us! Lending software to "social progress" leads to the insane place we are today. (And not to mention, it hasn't achieved much.) No, my software isn't a tool for your social goals, noble as they may be. And that doesn't make me a bad person.
  • rosndo 5y ago
    > Certain things should be a-political. Like the international space station, football, and open source software. Why? > And here we are. Uninstall nginx, unless you're a fascist that supports Putin! You know that nginx has been US owned for a while now, right?
  • deleted 5y ago
    [deleted]
  • SamoyedFurFluff 5y ago
    I think this is a straw man. It takes the relatively lukewarm “master/slave terminology should be moved away from” and somehow uses it as an example for “if you use ngix you support Putin”. Please consider actually looking at reality how it is, instead of how it might be if it was convenient to bash.
  • frozenlettuce 5y ago
    States will never allow a-political things to last for long, there's just too much money and power involved. Even the Olympics has been coopted - the event was created on the premise of reuniting warring nations around sport.
• smashah 5y ago
  I understand that all of this may seem annoying to those that like to bury their head in the sand but where's this energy and label of "weaponisation" when OSS is LITERALLY used to build weapons e.g openCV being used for mass surveillance & ardupilot/OSS drone projects being used to make tear gass deploying drones? Changing the license is weaponisation?? It's the bare minimum and least intrusive. And then you all complain when someone tries to implement a Hippocratic or Do Not Harm license. "WEAPONSIATION"?? Really? The lesson of all this is to keep an eye on your supply chain. Simple as. I think it's a sign of entitlement when you expect OSS devs to build you robust and reliable systems then leave the rest of themselves at the door.
  • quasarj 5y ago
    As the article explained, this is no longer an OSS project, so that part of your point is invalid. As for the first one, that's just whataboutism. Sure, we need to stand up to that too. But that changes nothing here.
    • cuillevel3 5y ago
      Who cares about Eric Stallman's OSI? They don't get to decide what free software is.
  • deleted 5y ago
    [deleted]
• mariusmg 5y ago
  Their code, their rules ?
  • LudwigNagasena 5y ago
    It may be an odd idea to comprehend for someone whose culture stems from and still closely relates to mainline Protestantism, but you can actually believe that someone has a right to do something yet disagree with the action.
    • lostmsu 5y ago
      You are free to fork their project.
    • dc-programmer 5y ago
      Yes because in vs. out group behavior started in the 1500s..
  • the_af 5y ago
    Yes, but said rules stop being FOSS compliant and so they lose the right to pretend they are FOSS.
    • kube-system 5y ago
      People absolutely have a right to disagree about what constitutes "FOSS". People have disagreed about it for 30+ years and they continue to this day.
      • the_af 5y ago
        Well, yes. But this goes (or did, before the author fixed it) against the most widespread and accepted definitions of FOSS (nobody from the OSI or FSF would accept this as a free licence, and those are the two major camps), so it cannot be considered a FOSS licence that most people would accept. It makes one wary, too. The weaponization of Open Source is very dangerous and sets a bad precedent. So Russia are the bad guys now, but who's next? Are you sure it's not going to be your country? Think about this: forget Russia, a good chunk of the world thinks the US is a bad faith actor on many occasions. Would it still be a free license one that forbid people from the US from using the software?
• fxtentacle 5y ago
  In my opinion, these changes are effectively supply-chain attacks in their execution. That would make them bad regardless of how correct their expressed positions are about the Ukraine war. The fact that there has not been a strong push back confirms my suspicion that by now, everyone has gotten used to Node and NPM being insecure and silently accepted it as a way of life. Similarly, those Terraform scripts are apparently esoteric enough to only be used by a tiny minority of software developers, or else we would have heard about it in a different way. Thank god nobody did similar shenanigans to open source projects that are actually in wide use :)
  • AeroNotix 5y ago
    What rights are you inaliably afforded from open source?
    • deleted 5y ago
      [deleted]
    • commandlinefan 5y ago
      Hmmmm… ok, what if somebody is handing out free food, but it’s poisoned. Is he still liable for harming you?
      • 7steps2much 5y ago
        Did they inform you that the food was poisoned? Does it come with a bright red wrapper saying "warning poison? If they just hand you food without a word then (at least in quite a few jurisdictions, but maybe not all) they are liable.
        • commandlinefan 5y ago
          Did the packages in question have a bright red warning that said “your files will be deleted if you’re in Russia?”
          • 5y ago
• quantum_state 5y ago
  This is a sad thing for FOSS … why should developers from Russia be penalized for no reason of their own?
  • scotty79 5y ago
    So they can get of their chairs and dethrone the dictator. It's kind of more important right now than writing software.
    • brandonmenc 5y ago
      I don't want to hear anyone in this country [the US] complain about the Electoral College or gerrymandering the next time we decide to pull another Iraq War but they're opposed to it. Just like, overthrow the government - it's so easy! And if you don't have the guts - well, don't be mad when someone deletes all your files, you collaborator!
      • scotty79 5y ago
        Yes. Exactly. US citizens are responsible for that corrupt systems that there are in place there. And all the war profiteering those systems allowed. Many average Americans directly benefited from US wars as military employees and contractors.
        • cartesius13 5y ago
          Average Americans most definitely benefited from US military shenanigans but that kinda besides the point here I think. The main point is that "just overthrow your government, bro" is not a thing people can go out and just do and these comments make it seem that they're negligent if they don't start doing it right now. "Just do it, bro. It's so easy"
          • diordiderot 5y ago
            The point of sanctions is to make doing nothing worse that doing something. If the USA was economically isolated as a result of it's invasion, I'd be willing to bet the iraq war would've finished much sooner
• dgan 5y ago
  Such precedents simply indicate immaturity of the developer behind it. I hate XXX (insert any English speaking politician from Western World), yet I am speaking in English. Shock! Tools are a-political. Could you believe that?
  • cartesius13 5y ago
    I'm currently studying and trying to learn the russian language and I think this argument is a bit of a straw man. I don't think people in general would suggest you're evil for learning a language. Obviously you would find such people on Twitter or Reddit but not in the real world I don't believe
    • dgan 5y ago
      just like sometimes we prefer to reason on limits rather than on concrete values, I believe some straw mans are "useful limits" to reason about some concepts
• scotty79 5y ago
  > My problem is that this weaponisation is killing off trust. Trust that all programmers started to place in open source maintainers maybe a decade ago out of sheer lazyness is absolutely insane. Pulling freshest code out of thousand libraries automatically into the medium security project that you are building is absolutely crazy. It's inviting thousand strangers to run code on your machine which contains your comercial creation and data. Without any protection whatsoever besides "trust" which is just another word for laziness and being hopeful. The faster we can ditch this trust, the faster we will develop actual protections, vetting processes, delaying updates, caching, forking, so we can isolate our work from the thousands of wonderfull people all of which are one bad day from wiping all your files.
  • musingsole 5y ago
    > Pulling freshest code out of thousand libraries automatically into the medium security project that you are building is absolutely crazy. But we have a test suite and a whole CI/CD pipeline to verify everything works! /s /Until you realize your tests only cover what they cover in the way they cover it. //Until you realize there is no test suite at all and it's all verified in production. ///It's not like you read the library's code until something was *really* broken or *super* slow anyhow.
  • ahelwer 5y ago
    Actually things are working quite well! These events remain remarkable news items. There are tremendous benefits to having an ecosystem built on trust and mutual assumption of good will. Transforming this into a scar tissue bureaucracy after some minor cuts is only one of several options. Another is to make choices like this so socially radioactive that only people with nothing to lose would ever make them. Trust is very valuable.
    • scotty79 5y ago
      Systems are not working well. They are just working carelessly till the catastrophy. leftpad.js wasn't even malicious action. Just one developer withdrawing his code from the community. Imagine what would happen if one dev of popular package just had a nervous breakdown and did rm -fr / on his next update. Or delete the contents of the repo it is a dependancy of and do a force push. We have zero systems in place that could catch it before work of thousands of people is destroyed.
• citizenpaul 5y ago
  I was thinking about this in a different context a while back. Basically companies (amazon for sure) utilize open source then make some closed off fork of it while giving nothing or peanuts back to the original open source development foundations. For example Amazon has indisputably made Billions if not Trillions from monetizing Mozilla products. Yet has only donated a few paltry million back to the foundation. While at the same time using the FOSS products to create their own walled garden.
• samwillis 5y ago
  This is exactly the problem with “uncurated” package managers like NPM and PyPi and where a curated package system like APT and RPM offer such a strong advantage. Far fewer people for you to have to put your trust into, but still a trust based system. They have gone so completely out of favour though. It’s understandable why people moved to the uncurated systems, it’s so much easier to publish and so the variety of what’s available is brilliant. But I don’t think the tooling is there yet with all the languages that use them. Really we should have the ability to control permissions at the library level, choosing specifically what they can do. Deno is doing some interesting things at the app level but has any language done anything with library level permissions? Maybe we will see a movement back to the curated package managers, there may even be an opportunity to provide a curated service layer over the uncurated package managers like PyPi and NPN, possibly a paid service?
  • zokier 5y ago
    > has any language done anything with library level permissions? Java Security Manager?
    • ungamedplayer 5y ago
      I think that's being deprecated.
  • zokier 5y ago
    > there may even be an opportunity to provide a curated service layer over the uncurated package managers like PyPi and NPN, possibly a paid service? Anaconda comes to mind, and I've heard that for Haskell there is Stackage
  • asiachick 5y ago
    I don't really think it has anything to do with curated. It has to do with popularity/accessibility. There are more JS programmers than just about anything (my belief) and they have an easy to use and contribute package manager. (unlike say C/C++). Curation, IMO, would crumble under the pressure. Also AFAICT, Rust's package manager is uncurated? So is Swift's but AFAIK Swift doesn't really have an "official" manager and so doesn't have the conditions for the same level of popularity/accessibility. Maybe that suggests no package manager is better? The C/C++ way? Because spreading malware is harder? Of course conversely, excepting exploit fixes is harder.
• frozenlettuce 5y ago
  The Pandora box has been opened. Prepare for the same kind of attacks addressing US IPs (cloud on us-west-2? bad luck)
• jeroenhd 5y ago
  I don't see what's wrong with Mongo cutting ties with Russia. There are practical problems receiving payment from Russian territories, and companies are allowed to choose which countries they do and don't do business with. In a similar fashion, developers may choose who can and cannot use their code. In fact, depending on how your government's sanctions are structured, you may even be obligated to not license code to developers in some countries. Using malware to overwrite random files against random Russian IPs is obviously stupid. I'm sure the dev will get to explain his case to a judge at some point. The Terraform thing, though, is different; it's not malicious, merely political. However, I think the assertion that software "should not be political" is silly. All software is political. Open source licenses stem from American ideals of freedom, for example, and are designed to work in the American legal system above all else. Then there are the implied cultural contexts; the list of software that only works in left-to-right configuration or even fail to just accept standard unicode input is laughably huge. The amount of times I've had to adjust software to work with alternative decimal separators... Independent developers can (and probably should) decide to mostly focus on the problem they themselves are trying to solve. If that doesn't work for someone else, they can either ask (and possibly be denied) alterations to extend the solution to their problem space, or suggest additions by extending the software themselves, but in essence, cultural and political assertions are everywhere throughout "open source". Protestware has been around for quite a while, but I think this is one of the first times we're seeing high profile developers take a stance. Whatever risk this is exposing was always there; we can try to hide the risks of open source, but in the end, that's just covering them up. I agree that protestware should not be considered open source, but any open source project can turn into protestware at any time, and it always could have. This is why groups like Debian and companies like Canonical are important: they use their organization to produce a unified view that you can rely on. Debian applies patches to align software with their views in several ways. The result is that software is often re-packaged and is deployed slower than upstream, but stuff like this doesn't get into your systems. The Python/Pip/Cargo/Go way of distributing dependencies directly, rather than using some kind of unified repository, exposes you to the risk of open source software becoming protestware, but it doesn't have to be that way. Developers scrutinize Debian and Ubuntu for packaging old software, but you can safely develop against their dependencies. This is the open source that can be trusted, to a usual extent. In my opinion, the trust developers place in random usernames on NPM is misplaced, and the extensive dependency graphs modern frameworks require make that problem so much worse. To those saying that it's bad that innocent Russians are getting hit by this: that's the point. It's also why sanctions are only applied in extreme circumstances. Foreigners can't tell other governments what to do, the best the rest of the world can do is hope or incentivize a country's citizens to make their government change their minds.
• blablabla123 5y ago
  Open Source was always political, ultimately this is where some moonshot projects like GNU got their momentum from. IMHO the red line is where it gets destructive or actually discriminates individuals. In the past PGP couldn't be exported to certain countries so sanctions apply also for OSS. Speaking of the immense popularity of web3 and decentralized of course not all measures will be realizations of government directives. That said I don't think OSI (opensource.org) represents the whole OSS movement. Also the title is a bit click-baity. The protestware example is clearly weaponization of OSS but the other examples are not.
• Jon_Lowtek 5y ago
  > I don’t really want to have to read through each of my dependencies and transitive dependencies licences to determine whether I am agreeing to <the things included> I slighly edited the last part of that sentence to highlight a problem with this kind of thinking. I do understand that the author may prefer all their software dependencies using some well known license like "Apache 2.0" instead of dozens of variations of "Apache 2.0~modified"
• redsummer 5y ago
• toss1 5y ago
  >>political discourse has turned to be very divisive and tribal. You are either with us, or against us. This is because much of politics is currently driven by a global set of fascist/authoritarian govts and sponsored 'movements' pushing to destroy democracy. This is, IMO, back to the pre-cold war days, but stripped of all the "--isms" and ideologies. It is now either self-determination for the people via democracy, or live under rulers like Putin, stripped of any cloking ideology. This is being strongly pushed/sponsored globally by Putin's govt; the Chinese are going about it differently with the 'Belt & Road' initiative and other exploitative agreements. The grand experiment has been tried. It was thought that free trade exchanges and greater information flow from free nations would cause freedom, self-determination, & democracy to the former Communist nations. It did not. In trying to prove the thesis, the test proved the opposite, and enriched the authoritarian states. Russia's ongoing assault on Ukraine since 24-Feb-2022, and the ongoing blatant war crimes including specific instructions to ignore civilian care[0], cluster munitions on civilian targets[1], or bombing a theater/shelter with "Children" written on the pavement outside [2], and it's support by ~70% of the deluded RUS population, show what can be expected from yielding to or appeasing authoritarianism. It now really IS you are with us, or against us. You are either in favor of democratic self-rule for all people, or you are against it. This is war, and we are fighting against those who are happy to be war criminals. It is important to take every measure, and "weaponizing" open source is among the least of the things that can be done to help. [0] https://twitter.com/cnsnews/status/1504494016137555968?cxt=HHwWgMCj6cTVhOEpAAAA https://twitter.com/cnsnews/status/1504494016137555968?cxt=H... [1] https://www.bellingcat.com/news/rest-of-world/2022/03/11/these-are-the-cluster-munitions-documented-by-ukrainian-civilians/ https://www.bellingcat.com/news/rest-of-world/2022/03/11/the... [2] https://www.npr.org/2022/03/17/1087164709/ukraine-mariupol-theater-bombing https://www.npr.org/2022/03/17/1087164709/ukraine-mariupol-t...
  • walrusfromspace 5y ago
    >You are either in favor of democratic self-rule for all people, or you are against it. So can I assume that you were protesting against Spain's suppression of the Catalan independence referendum in 2017? https://en.wikipedia.org/wiki/Catalan_independence_movement#2017_Referendum,_Declaration_of_Independence_and_new_regional_elections https://en.wikipedia.org/wiki/Catalan_independence_movement#...
• Dove 5y ago
  We have parallel problems in science and in software. My faith in science was never in the moral character of scientists and their organizations - individuals and organizations are always vulnerable to corruption. My faith was in the principle of replication. If anyone can repeat an experiment, we can all see for ourselves what is true, and a community dedicated to that (and individuals with a healthy fear of the process) is reliable. Only, we don't replicate experiments. We got so busy and excited building on what had gone before that we've built some huge houses of cards on questionable foundations, because who wants to spend time and money doing replication? Distracted by the free riches, we neglected what had always been the source of our strength, and here we are - arguing over who funded studies and fuming over the replication crisis. Where are the critics who say, "I can't trust that paper - it's impossible to replicate!" Where are our Poppers who insist on falsifiability? An entire community that frowned on complexity and opaqueness and walled gardens of data, a community that trusted things insofar as they had been replicated and re-examined from many angles and proven sound, would force us towards a level of simplicity, honesty, and reliability that science should have. Instead, a general agreement to pursue individual and institutional glory at the expense of upholding foundational principles has rotted the foundation of the endeavor. Put simply, I trust science because you can replicate it. But for whatever reason, (and I can't propose a specific solution, but), to the degree our community is not devoted to replication, it loses its trustworthiness. Software has a parallel problem. I don't trust open source software because I trust the character of developers or institutions. I trust it because it can be examined and fixed. Because of reproducible builds. Because anyone can examine it, anyone can build it, no trust of individuals or organizations is needed. A community that insists on such features and abhors offerings that offend these principles will steer us towards a level of simplicity, comprehensibility, reproducibility that open source software should have. But we are all so excited to build things on top of other things that we spend much more time multiplying dependencies and layering on complexity than worrying about foundational principles. We are now seeing the rotting foundations. There are people who complain about whether code can be examined, or factors that make it difficult. It is becoming increasingly important to listen to them! A community that celebrated open source software, not only for what it can functionally do, but for how open it is, is what is needed to maintain those foundations. A community that has trust issues with unexaminable long dependency chains, that is sensitive to the difference between software that has been around the block and examined for a long time, and software that some guy just put out last night. Put simply, I trust open source because you can examine it. But for whatever reason, (and I can't propose a specific solution, but), to the degree our community is not devoted to examination, it loses trustworthiness. Reserve your trust for communities that take seriously the principles that trust is built on.
• WesolyKubeczek 5y ago
  I'd say that the code that is malware/not malware depending on IP address of the server is a bad kind of weaponization. Not because I pity poor Russians or some such. I'm a Ukrainian national myself. Putin is a dickhead that should be put down with extreme prejudice; much of both the state and ordinary folk in Russia should be accountable, too. Here, I said it. The problem with those NPM packages, or better said, the approach they are taking is that it is a double-edged sword. IP blocks can be sold and bought. Today they belong to someone in Russia you don't mind targeting, tomorrow it's someone else entirely. Today you put in a trigger to turn your code into malware, tomorrow someone finds a way to flip that trigger at will. Bad things ensue. Not providing services to Russians is another thing and that could work. Limiting downloads by the country is okay in my books. After all, you block IPs that try to DDoS you, so banning IPs of an aggressor country that is fond of murdering civilians is fair game too. Radio silence their contributions. Don't respond to their support requests. Close the issues they open as if they never existed. Of course they can find alternative ways to download stuff, fork, implement the necessary changes themselves, but it's jumping through the hoops. Let them jump extra and then some. Stop providing documentation in Russian, kick some people off the team/mailing list. Make the OSS you're responsible for be, for all intents and purposes, unmaintained piece of software if the user is from an aggressor country. These are ways of sabotage I can stand behind. But putting in actual malware is rather where I draw the line.
• pmontra 5y ago
  My first thought yesterday was that I really cannot trust NPM anymore because if someone sneaks in an anti Russian piece of code somebody else could sneak in code against any other country, or look at the content of files to get an idea of the kind of person running the code and decide what to do. People voting for the other party, thinking something different, etc. And why not Python, or Java, Ruby, anything. Maybe we'll all end up running Tails. Edit: if something like that happens, how long before certifications require that no unvetted code is used in projects or no open source at all?
• cat_plus_plus 5y ago
  Wars cause people to do really drastic things that would be out of the question in peacetime. Programmers are people and some of them have relatives who have been blown to smithereens by Russian strikes. These are the peanuts, saboteurs have been known to destroy physical things with high collateral damage. While crimes like deleting files should be prosecuted, the best way to end such things is to end the war.
• krnlpnc 5y ago
  Afaik mongodb licensed to be free as in beer, and is not actually FLOSS. Doesn’t seem like the argument holds for open source as a whole, especially looking at gpl and apache2 licensed projects.
• tracker1 5y ago
  1. Pin your dependency versions. 2. Develop inside a containerized environment... it's pretty easy with things like VS Code's remote extensions. 3. Consider looking at Deno as an option over Node for new projects.
• teawrecks 5y ago
  These attacks, regardless of how ethical, are shortsighted. Imagine a situation in the future where Russians revolt and take their govt for the people, a Democratic govt is successfully established, peace is realized, etc. This future Russia is still fucked because they can't trust any code. The internet will be littered with virus landmines that target them based on their ancestors affiliations. You've literally created the toxic racist/nationalist internet you thought you were protesting.
  • orbital-decay 5y ago
    This point should be discussed more (and sadly isn't). Who is going to enforce the de-escalation in case of outraged mobs and individuals, and the automated artifacts of war they left behind? The likely answer is nobody, and it will just breed more violence. It's the reason behind banning certain munitions in warfare, by the way. It's not just the individuals either. Broadly speaking, the whole war happened because there are very little de-escalation mechanisms in modern politics, leading to runaway processes of hatred and violence. And being able to back down requires williness, understanding, and most importantly mutual guarantees. There are simply no such mechanisms in place, modern politics can typically only go "forward" (whatever the perceived forward direction is) which is self-destructive. Things should be as reversible as possible.
• phendrenad2 5y ago
  Yeah, no. This is the weaponization of the cloud. Open-source and closed-source are irrelevant here. I get that it's trendy to think of open-source as the community, the hosting platform, and then, as a distant third, almost an afterthought, the code itself, but that's wrong. Open-source is the code, and the code transcends any given hosting platform or community blacklist.
• 0xbadcafebee 5y ago
  Software is not more important than human life. I would rather have proprietary than Open Source if it's a choice between respecting human life or not. When America goes to war with a backwater country that can't defend itself, nobody can do anything. We have the nukes, we have the money, we have the aid, we have all the cards. Even when we literally make up shit to have an excuse to go to war (for Russia it's "Nazis", for the US it was "Aluminium tubes"), nobody can stop it. Well, I want the right to say: "No, USA, you cannot use my software if you wage an unjust and unprovoked war." Is it unfair to block a whole bunch of innocent people from using that software? Yes, I'm sure the families of the people your government are killing are quite upset that you can't use some software. However, if you want to use the software again, force your government to stop its war. Or use different software. It's not like anyone's holding a gun to your head.
  • historia_novae 5y ago
    While I agree with parts of your post, not providing software is a very different story than fucking up people computers for a xenophobic and virtue signalling reason (the developer peacenotwar was not concerned by the ongoing war). What this developer did is in the like of the computer attacks allegedly coming from China/Russia/North Korean that the US whine about all the time.
    • juanani 5y ago
• rakeman 5y ago
  Even if you agree with what he did, I don't think you can justify how it was done. I think it's fair to infect someone you dislike with malware if you're capable if that's the upfront intention. But the history of the particular piece of software in question was not malicious. It's like going to the doctor for your 6th booster shot, the first 5 were fine but this time he decides he doesn't like your accent and gives you the arsenic shot instead. Really his intention was clear with this, hiding malware behind a piece of legitimate software he was maintaining and had built a good reputation on. Ransomware is the new big thing so comparing it to that I feel that the motorcyclist's actions were actually worse. At least with actual malicious actors you know upfront what their intentions are. Putting aside the politics this is an overall negative for OSS.
• regpertom 5y ago
  Ottomh, George Takei and Neil DGT have both lectured me on what a stain on American history the internment of Japanese Americans during ww2 is. Part of that included harassment of Japanese appearing businesses and people. The stain still remains to this day so I don’t say was. I think they were using it for antiTrump stuff but I took it as a general lesson. And then bamm the whole world is in total war with Russia and your either with us or against us. Freedom fries were a deranged pro Iraq war conservative thing, no enlightened person would allow themselves to fall to such petty hate ho ho ho. People would laugh as a relic of the past stories about how my grand mother didn’t listen to German composers or buy Japanese goods and as she got older, buried anything precious to her in the backyard. James Webb telescope say for example had/has lots of international assistance, who would want to throw those decades away to spit on Russia? Regardless of justification, if you‘re pouring shots too big too often the bar will have to install automatic shot pourers and everyone suffers. Maybe it’s a relic of the past also but isn’t there an idealised heart at the core to open source? Hope for a better world built on trust and responsibility? We know there’s no one to sue but trust us and use libreoffice it’ll be fine. Another anecdote: mercenaries in South Africa and Sudan on different sides drank at the same bars at night. I heard a story of a pilot on one side and a ships AA gunner on another sharing their stories with each other for many nights before they realised they’d spent days trying to kill each other. They didn’t go home afterwards either it just was what it was. Australia tells as legend how the Anzacs and Turks could play cricket over a ceasefire. After all there’s no reason we can’t be civil bites pretentious fruit My Ukrainian, russian-language teacher has changed his online names to basically John Smith. Seems he feels a danger in being mistaken for russian. These are things I’m contemplating and are not meant to overrule whatever you might be contemplating or advocating dear reader. I want to say obiter dictum. I follow the sentiment of the article.
• pabs3 5y ago
  There is a great essay related to this by Software Freedom Conservancy: https://sfconservancy.org/blog/2022/mar/17/copyleft-ethical-source-putin-ukraine/ https://sfconservancy.org/blog/2022/mar/17/copyleft-ethical-...
• pabs3 5y ago
  I wonder how the license changes are going to get enforced in Russia, it seems unlikely to happen there.
• synergy20 5y ago
  Nothing is perfect, and the world is not black and white, it's not ideal, but it is what it is. A criminal will lose part of his/her rights, some of his freedom, and even his life in a perfect democratic liberal human rights first country. This is how the system works. If the war is deemed by most as a criminal act, losing some open source is just a very tiny part of what the offender deserves. Why is this even a surprise? Software is no exception here.
• smsm42 5y ago
  Mongo SaaS is a commercial service, as such having little to do with open source. And of course it's not the first and even not the second time commercial vendors refuse to provide service, including for political reasons. People getting banned all the time on social networks for political reason, and AWS famously killed Parler service for the same. So it's not something new, it's just continuation of the same trend. And undoubtedly we will see more of it - if the government can close your bank account for disagreeing with it, they'd certainly be able to close your Google or AWS account. For private companies, it's even easier. And node library... well, malicious code in node libraries is also not new, though in this particular case the question whether it's malicious or righteous action may be subjective. That's a supply chain attack, and nodejs community certainly will have to figure out whether they want to stop it and if so, how. Until this happens, the node developers should be super careful with their dependencies I guess.
• vbezhenar 5y ago
  Build systems should adapt. Run all dependency install scripts at least in docker. Run build in docker. Run executable in docker and connect to it via debug sockets. Run language server in docker and so on. Preferably not even docker, but separate VM.
• winternett 5y ago
  The steps of scanning code for dependencies is instrumental in preventing issues like this. Simplifying use of things like external libraries is also a good move, vigilance has always been vital to security. Implementing zero trust and taking proper steps in build, test, and deployment to secure vital data (like government agencies do) helps to better insure and protect data. That's one of the main reasons why PHP and Python are so prevalent, code is usually/basically in text files that can be vetted, tested, and edited a lot more easily than in compiled source... Not saying any open source lang is better than any other in stating that though mind you.
  • 8n4vidtmkvmk 5y ago
    doubt that's why they're prevalent. no one is reading all the libs they're installing
    • winternett 5y ago
      Are you even aware of what tools like Fortify do? Or a government ATO process? :\
• nirui 5y ago
  From the article: > I don’t think this can be classed as open source anymore: > The definition of an Open Source License is quite clear: > 5. No Discrimination Against Persons or Groups The license must not discriminate against any person or group of persons. > I don’t really want to have to read through each of my dependencies and transitive dependencies licences to determine whether I am agreeing to discriminatory terms by using a library. I think the author of the article has misunderstood the definition, thus reached the wrong conclusion. The non-discrimination rule applies only to accessibility and nothing else. Simply put, you provide the same code/product to everybody, including Santa Claus and Mr Putin under the same set of condition and permissions. Adding/removing malicious code does not change the fact that the code is by definition open sourced. All and all, this is not a license problem. Now, talk about node-ipc, which just got attacked by mobs (see https://github.com/RIAEvangelist/node-ipc/issues?q=is%3Aissue+is%3Aclosed https://github.com/RIAEvangelist/node-ipc/issues?q=is%3Aissu...). If an open source project is a scam, then it's a scamware. If an open source project is malicious, then it's a malware. Personally, as a normal human being, it is hard to keep a peace of mind after watching how the Russians fired multiple heavy rounds to kill the elderly couple who just traveling peacefully in a car down the road near a hospital. It is even harder to keep a peace of mind after watching a video recorded by a son showing how the Russians shoot and killed his father who sits in the driver's seat right beside him. I fully understand and respect the anger. However, I do agree that people need to be more mature on this even during this difficult time. Turn your project into a malware only hurts your own reputation and people who trusted you. Once the trust is gone, it might never recover. There are many ways to actually hurt those who contributed the invasion. Be constructive and accurate, or at very least don't be destructive.
• aasasd 5y ago
  Also: when ‘colors’ and ‘faker’ packages printed stuff in the output in an endless loop, NPM and Github banned the author and took over the packages. When ‘node-ipc’ overwrote all files on disk, NPM just waited while the author himself published an amendment and posted that the package ‘only created a text file, no biggie’.
  • Aeolun 5y ago
    Because the first time was about money, and the second time was about ethics?
    • aasasd 5y ago
      If you really think that in security of open-source people should tolerate a malware attack because the author says ‘oh, I'm fighting those Russians’, then I sure hope I'll never have to use any of your software.
    • SpicyLemonZest 5y ago
      I’m very sympathetic to the attacker here, but I can’t imagine an argument for why there’s an ethical obligation to delete random Russian users’ files, much less why that duty should outweigh the NPM project’s general duty of good stewardship.
      • Aeolun 5y ago
        I’m not suggesting it’s right. Just speculating on what makes it different.
      • kistaro 5y ago
        Because there is an obligation to stop the war by any means available. Since Putin will not stop voluntarily, he must be rendered unable to continue. Every possible tool to drain the resources and undermine the tenuous stability of Russia is necessary and appropriate. War sucks for civilians. It sucks less for the civilians who get some files deleted than for the civilians who get their houses shelled by Russian and Belarusian artillery. Does the NPM project have a general duty of good stewardship? Of course. Does the NPM project have a duty to interfere with a developer who chooses to increase the misery and pressure applied to a nation that has been committed to a path of an unjust war of aggression, which is deliberately bombing civilians? Fuck no.
• einpoklum 5y ago
  > Note, I do not think that this means that we should all rush to building our own data centres, writing our own databases and running all our own services. The author is conflating three very different things: * Running software on your own machines * Setting up a full-scale data center * Writing your own "infrastructural" software ... helping him make an argument in favor of "the simplification and optimisation of using Software as a Service". That's disingenuous. ---------------------------- > My problem is that this weaponisation is killing off trust. Certainly there is little trust left after such weaponization. Sometimes, though, there's enough of a reason to mistrust _before_ this happens. After all, it's the same people/organizations which would later engage in such weaponization. There are sometimes/often preliminary signs that something like that could one day happen.
• 0dayz 5y ago
  I think the mongodb example is the most "right" in that it's only the service of mongodb that gets cut off. With that said it's a similar "issue" I remember a few years back when there were "anti-fascist"/ "" social activists"" advocate for excluding certain groups where the same issue came up, the idea may be noble but in practice causes unintented consequences.
• tux2bsd 5y ago
  This comment does not related to the matters in Europe that the article is about, this comment points out something missed by other comments. Open Source software was weaponised via the virtue signalling "Code of Conduct", in particular when language categorises people into groups ("everyone" would suffice). Exclusion was always the goal of the "Code of Conduct" trojan horse.
  • IAmEveryone 5y ago
    That comment is awkwardly phrased. That comment is off-topic. That commentator is advised to get out more.
    • tux2bsd 5y ago
      Well done on contributing nothing. My comment relates to the weaponisation of open source software, oddly enough that's the topic.
  • ryan-c 5y ago
    Which people, in particular, do you feel are excluded by codes of conduct? The goal of these things is indeed to exclude people, but what you are missing is that the people it they seek to exclude is those whose behavior in the community excludes others - the goal is fewer people excluded overall. How, exactly, is this a bad thing? Surly you must have been exposed to "The Paradox of Tolerance" by now?
    • blub 5y ago
      It’s a bad thing because the enforcement is arbitrary and not transparent. It’s also bad because once a set of evil personas was established it became trivial to expand each of those personas to cover more and more benign attitudes and opinions to the point that labels like “racist” have lost all meaning. Maybe if only people which caused objectively measurable harm were excluded this could be called a positive thing. As it is, it’s a power game of censoring and bullying those that don’t bow before whatever the fashionable media/activist/political opinion is on that particular day.
• pastacacioepepe 5y ago
  Do we think Russians manage no open source? How many fundamental open source libraries have Russian maintainers? How long before they decide to commit a disk wiping malware and release it without a breaking change? What if they decide to do it on a larger, coordinated scale? I would be very careful before attacking an entire population with cruel malware. They dont deserve it, and punishing so many innocent people at once can have serious consequences. Personally I hope that the creator of peacenotwar, RIAEvangelist, (same creator of node-ipc) will lose his position in open source and hopefully any current and future gig in the industry. His action was so reckless, vile and stupid that I don't ever want to run a single code statement written from him on my hardware. What a coward. I also hope he is made to pay all the damage he caused, in the future. Hopefully very soon.
• rep_movsd 5y ago
  This is the equivalent of beating up the neighbours kids because the neighbours are doing bad shit
• ZeroGravitas 5y ago
  Possibly while looking into running multi-cloud etc. to mitigate these risks you could also ask "is my country likely to face global sanctions? Why?" and combined with other business owners in the location you can do something to avoid that eventuality.
• oytis 5y ago
  It would be much more honest for the democratic world to dare an open military conflict with Russia now. But also people understandably fear the nuclear war. So people are weaponising whatever they can, and there is nothing wrong with it. The situation is pretty extraordinary, and the sooner we can get back to a system where dictators waging wars against democracies end up in Hague the sooner can we start sticking to our peace time norms again.
• ZeroGravitas 5y ago
  With respect to open source code used for 'evil' this had been covered in reasonable depth previously since it's fairly easy to imagine open source being used for things the original author(s) do not approve of, and the issues that would cause if they could revoke the licence after the fact. As far as I'm aware the final conclusion after decades of discussion was that open source licences were not the place to do this for various pragmatic reasons, though including messages, manifestos and other such communication seems fairly common. Potentially we need a mechanism that says explicitly "all code in this ecosystem is open source unless you give informed consent to opt-in to other licence types" and flags as early as possible when that's not the case (e.g. updating the dependency of your dependency ... etc.) and allow people to explicitly override the exceptions they care about, and otherwise halt the update.
• Nextgrid 5y ago
  This incident makes me feel good in my decision to start using Qubes OS (https://www.qubes-os.org https://www.qubes-os.org) as a day-to-day development OS. Had I been hit by this, it would've considerably limited the blast radius.
• epolanski 5y ago
  I am strongly against this all hysteria. The least thing we need is the world and society to be more divisive. We are at insane levels of hysteria, people calling McDonalds to stop selling in Russia because they have ukrainian kids blood on them. Does it also have 200k iraqi blood killed by us?
  • dash2 5y ago
    I don't think it's hysterical. The point is that by encouraging companies to pull out of Russia, firstly, ordinary Russians become aware that something is wrong and that the rest of the world strongly deprecates the invasion of Ukraine, and secondly, elite Russians become aware that the cost of invading Ukraine is serious damage to their economy. Actions have consequences. You might reasonably disagree and argue that either or both of those things won't work. But it's not nuts.
    • epolanski 5y ago
      I really think it is, I also find it racist. Why doesn't this hysteria involves Israel and Palestinians? Myanmar killed 50k Rohingyas throwing them into fire few years ago. Why is it okay for US to avoid this hysteria when it invades and kills hundreds of thousands in middle east? This is hysteria.
      • dash2 5y ago
        You don't seem to have responded to my arguments!
  • stefantalpalaru 5y ago
  • sergeykish 5y ago
    RF can't defeat Ukraine military so it bombs civilians specifically to cause terror, kills woman and children. Meanwhile RF populations consumes propaganda that they area fighting "nazis", whose who know real situation are oppressed, beaten, tortured. Russians who understand what's going on generally supports sanctions and business exodus.
• Viliam1234 5y ago
  This is a completely immature behavior. If you did something like this, please remind me to never use your software again, because today you protest Russia, and tomorrow maybe you decide that you actually hate capitalism, who knows. Probably not, but I'd rather not take the risk. If you want to send a political message, there are less harmful ways to do so. Like, print a message at program start, or write it into logs. You could even provide all kinds of forbidden information, such as numbers of Russian soldiers who died in the war. Better than "Putin sucks", right? If you want an equivalent of sanctions, just make your software stop working, and explain why. But if you insist on playing soldiers and doing damage, how about you contact your local secret service and tell them "you know, I have this program that is also used in Russia, if you have any ideas how to weaponize it, I am open to suggestions". Maybe they would give you some code that targets a specific IP address, and extracts a Russian state secret, or whatever. That could potentially accomplish much more, with much less colateral damage. You had one shot; you wasted it. Also, consider the long-term consequences of such things becoming the new normal. Do you want to live in a world where an internet-connected washing machine will destroy your laundry because you voted / didn't vote for Trump? Because this is the world you are helping to build.
• ungamedplayer 5y ago
  The author can't read the license, which is odd considering it is quoted directly The license must not discriminate against any person or group of persons. The license itself does not discriminate, even if the licensed content does. This is an important freedom.
• lbotos 5y ago
  Does anyone know the game that is being shown in the image? @beny23, I checked your code (OSS FTW!) but the image name doesn't reveal anything: https://github.com/beny23/beny23.github.io/blob/master/posts/on_weaponisation_of_open_source/index.html#L33 https://github.com/beny23/beny23.github.io/blob/master/posts... https://beny23.github.io/images/on_weaponisation_of_open_source_title.jpg https://beny23.github.io/images/on_weaponisation_of_open_sou...
  • dorkwood 5y ago
    According to Google's reverse image search it's a game called Heroes of War and Money. https://www.lordswm.com/help.php?section=1#help_text https://www.lordswm.com/help.php?section=1#help_text
  • beny23 5y ago
    I’m afraid I don’t know either - it came up on a google image search for the terms “software war” and was marked Creative Commons…
• _ache_ 5y ago
  Weaponisation ? I guess you are victimizes yourself. It is fair for free software developers to express themselves in the software they build. If you don't want them to, or if you want a specific idea to be promoted, just pay for that.
• cosmiccatnap 5y ago
• leke 5y ago
  Interesting how the internet has given people more power to act, and the freedom people have has also made it possible.
• knorker 5y ago
  Literally the first freedom from gnu.org, too. > The freedom to run the program as you wish, for any purpose (freedom 0). This is like believing in freedom of speech, but only for speech you agree with.
• kgilpin 5y ago
  This seems like another example of people taking open source for granted. Software takes time and effort to create, and in return for that effort the author receives ownership and copyright. The author of an open source project can do whatever they want with it - limited only by other legal limitations (such as, it’s illegal to intentionally destroy other people’s properly). In a legal contract, some value (consideration) must be contributed by both sides. What do most people contribute to the open source projects that they use? When the answer is “nothing”, then why do they expect the right to judge the decisions of the author? Sure this is rant-ish. But I’m saying that people sure feel privileged to raise a hue and cry when open source authors make decisions that they don’t agree with. Don’t like it? Fork it - or buy a license that has the terms you want.
  • SpicyLemonZest 5y ago
    Like any human endeavor, open source contains an implicit expectation that everyone is going to behave reasonably. You can disagree with the author’s arguments that this behavior is unreasonable, but it kinda misses the point to say that open source authors can do whatever they want and nobody has a right to judge them. When I’m a guest in someone’s house, they have every right to do what they want, but if they decide one day to bellow a war cry and start smashing their plates I’m probably not gonna visit again.
    • kgilpin 5y ago
      That’s right except in this case, Russia is the house and the open source author is you. They are taking their ball and going home.
      • SpicyLemonZest 5y ago
        Well, again, the author is arguing (correctly in my view) that this is understandable but incompatible with the baseline expectations of the community. It’s a basic principle of open source that you won’t go out of your way to stop people from using your code, and a project which tries to prevent all Russian citizens from using it is straightforwardly not “open source” by the OSI definition.
• ineedasername 5y ago
  Putting aside the issue of "is it still open source?", deleting files is problematic from another perspective as well: private citizens launching a cyberwar attack against a foreign power. It seems to me that the only legal way to do this is with the approval of your government. I have seen at least a few argue that devs should be/are allowed to act in accordance with their own values. I agree, with same caveat I would apply in any circumstance: so long as those actions are in accordance with the law. To do otherwise in a geopolitical conflict like this is foolhardy in the extreme. The Western world is struggling very hard right now to find the right balance of actions that supports the Ukraine while punishing Russia, at the same time balancing that against the risks if escalating the conflict far beyond it's current confines. I would be very confident in a guess that even large corporations making perfectly legal business decisions to shut operations in Russia are doing so with some coordination & communication with their governments. It is certainly not at all up to private citizens to take extralegal actions that may escalate this conflict in any way.
  • vogre 5y ago
    > justification to launch their own cyberwarfare initiatives in retaliation Or Russia can decide that this attack is threatening its' existence and launch nukes. People who do these things are completely irresponsible.
    • ineedasername 5y ago
      And the open source aspects of this are barely a footnote. The issue isn't weaponization of open source, it's weaponization of software, i.e., cyberwarfare. Debating whether or not software that engages in this still meets one specific definition of "open source" is a question that closely resembles the "Maserati Problem" in its immediate relevance when compared to the other implications of these actions. It seems very weird to observe a malware attack in this situation proceed to make the malware's status as open source software a primary issue in discussing the attack. If someone feels the need to include it in the conversation then the appropriate ordering of the message should be more like: "unilateral escalation of the conflict by private individuals is a bad idea. Really you shouldn't be making decisions about how to handle a conflict that directly or indirectly involves half the world and multiple nuclear powers. Stick to activities that are legal when showing or giving support to the Ukrainians. And oh, yeah, I guess your code may not technically be open source anymore if you do this sort of thing."
• cambadafonchan 5y ago
  I think incidents such as this will wake organizations up to the reality that open source is not inherently more secure or cost effective than proprietary software. For the past 10 years the prevailing wisdom has been that one should not "re-invent the wheel", but we're starting to see the dangers of not owning the full stack. As a professional software developer working for a major company, I'm much more inclined to implement something myself rather than pull in a bunch transitive dependencies, that introduce unknown and hard to manage risks. 10 years ago I would have laughed at someone who suggested such a thing. The argument has always been that closed source can't be inspected and as such is more risky, but I think in the current landscape as open source developers get more ideological, commercial incentives are a better way to protect against supply chain risks than open source code.