6 ms·

There should still be a zero-tolerance policy for hidden undisclosed functionality in open source repos

by TobyTheDog123 5y ago

memish 5y ago
Further, there should be zero-tolerance policy for injecting The Current Thing.
- TobyTheDog123 5y ago
  To me it doesn't really matter what is injected, as long as it's undisclosed in places people would look (NPM/Readme/Docs/etc), it's unacceptable
  - megous 5y ago
    It's in the code. That's where people should look first and foremost in opensource dependencies. Otherwise how do you know you're not pulling in some horrible, bug ridden crap as a dependency? Most npm code has almost 0 documentation anyway.
    - TobyTheDog123 5y ago
      If you expect a developer to review every line of code of every version of every module all the way down the NPM dependency tree then we can forget about anyone ever completing a project. There are other solutions.
      - megous 5y ago
        You don't need to review every line. Just general code quality, and search for obvious obfuscations/or things like these.
        dsQTbR7Y5mRHnZv 5y ago
        Simply instantiating a React project with `create-react-app` generates a lock file with over 1300 transitive dependencies: $ npx create-react-app sample-app $ cd sample-app $ cat package-lock.json | jq '.packages | length' 1393 Expecting all developers (including those new to the field) to manually audit each and every one of these packages simply isn't feasible.
- tshaddox 5y ago
  I’m curious what this “The Current Thing” phrase is supposed to mean. I’ve seen it used a few times very recently, and as best I can tell it seems to mean something along the lines of “all opinions on a current event or political issue are equally valid and thus any strong position on the event or issue ought to be mocked.”
  - tbrownaw 5y ago
    "the current thing" is everywhere and it gets incredibly tedious to see the same opinions and ~~discussions~~ arguments infecting everything. This has nothing at all to do with the correctness of any of the positions, just their pervasiveness.
    - 0des 5y ago
      You pop up in a few convo threads that TobyTheDog is in. That's a coincidence isn't it
      - TobyTheDog123 5y ago
        It's.... almost like people want to have a discussion about this? I'm confused about what you're implying.
        0des 5y ago
        Did you mean to respond from your other account?
        TobyTheDog123 5y ago
        I guess I should've figured out that you've been arguing in bad faith this entire time. I'll give less benefit of the doubt with the next troll.
      - JohnHaugeland 5y ago
        "You pop up in a few convo threads that TobyTheDog is in." So do you. So do I. It's not a coincidence, and it's not the implied other explanation. It's because the structure of vote-sorted top-N list sites like HN, Reddit, and so on, focuses most people on the same short list of topics. We will all bump into each other again, whether or not we have any intention of doing so. We're all chatting on the first two pages of stories. We will all collide frequently with people holding similar hours.
totony 5y ago
>undisclosed it's open source
- TobyTheDog123 5y ago
  This is a really bad (bad faith?) interpretation of what I said. Just because something is in the source code doesn't mean it's acceptable - it's not disclosed anywhere the majority of people would look: A readme, a NPM description, documentation, etc.
  - totony 5y ago
    Undisclosed imply that it's secret/hidden. By definition, OSS software has no undisclosed functionality. You're looking for better documentation/a community contract.
    - TobyTheDog123 5y ago
      You can discuss semantics all you'd like, like I said above it doesn't make it acceptable. If I could I'd update my original comment to be more explicit, with either "unadvertised" or "undisclosed where the majority of people would look"
323 5y ago
Do you feel the same about easter eggs? Because when I argue that and give example of easter eggs which caused security vulnerabilities or broke shell scripts on certain dates people reply "oh, lighten up, you are just a party killer, allow some human touch"
- DaiPlusPlus 5y ago
  > Do you feel the same about easter eggs? Absolutely! Undocumented Easter Eggs cannot be tolerated in any software project today. Larry Osterman wrote about why Microsoft (and most other major software vendors) banned easter-eggs: https://docs.microsoft.com/en-US/archive/blogs/larryosterman/why-no-easter-eggs https://docs.microsoft.com/en-US/archive/blogs/larryosterman... The important point is (to quote): > If the manufacturer of the software that's on every desktop in your company can't stop their developers from sneaking undocumented features into the product (even features as relatively benign as an Easter Egg), how can you be sure that they've not snuck some other undocumented feature into the code. But if an easter-egg is is documented and implemented following normal software engineering practices then that's fine (of course paying customers won't be happy to learn that's where the team is putting their resources), and you can still keep things "secret" by hiding them in spoiler-tags or similar in your changelist - but there must never be any unaccounted-for functionality in a software project.
- TobyTheDog123 5y ago
  I'm a bit torn, tell you the truth. But there is absolutely a difference between an easter egg, something that usually takes real effort to discover and trigger, and something that runs as part of normal execution. In regards to the examples you give where it causes vulnerabilities or bugs, I think it can be a test if the software you're actually embedding the egg in needs to be improved. If an easter egg breaks something then that's probably indicative of a larger problem.
- JohnHaugeland 5y ago
  Please don't try to equate easter eggs with intentional damaging code. This shouldn't be a difficult discussion in this way.
maxloh 5y ago
How about just console.log-ing a few support messages for Ukraine?
- TobyTheDog123 5y ago
  It's all about where people draw the line. Personally, I don't think I'd count console.log as "hidden/undisclosed functionality", while I would claim opening a browser window is. But some people might, and if I was creating a FOSS library I would not include it. --- EDIT: On second thought, I might consider it functionality: People have application logs that are exposed to customers (so it would cause the company to appear to be taking a stance), or exported to other systems which only understand certain log messages, causing issues there.
Aeolun 5y ago
> hidden undisclosed functionality That describes basically all the code I install from open source repos, bar the very specific section of code I actually use.

There should still be a zero-tolerance policy for hidden undisclosed functionality in open source repos

memish 5y ago

Further, there should be zero-tolerance policy for injecting The Current Thing.

TobyTheDog123 5y ago
To me it doesn't really matter what is injected, as long as it's undisclosed in places people would look (NPM/Readme/Docs/etc), it's unacceptable
- megous 5y ago
  It's in the code. That's where people should look first and foremost in opensource dependencies. Otherwise how do you know you're not pulling in some horrible, bug ridden crap as a dependency? Most npm code has almost 0 documentation anyway.
  - TobyTheDog123 5y ago
    If you expect a developer to review every line of code of every version of every module all the way down the NPM dependency tree then we can forget about anyone ever completing a project. There are other solutions.
    - megous 5y ago
      You don't need to review every line. Just general code quality, and search for obvious obfuscations/or things like these.
      - dsQTbR7Y5mRHnZv 5y ago
        Simply instantiating a React project with `create-react-app` generates a lock file with over 1300 transitive dependencies: $ npx create-react-app sample-app $ cd sample-app $ cat package-lock.json | jq '.packages | length' 1393 Expecting all developers (including those new to the field) to manually audit each and every one of these packages simply isn't feasible.
tshaddox 5y ago
I’m curious what this “The Current Thing” phrase is supposed to mean. I’ve seen it used a few times very recently, and as best I can tell it seems to mean something along the lines of “all opinions on a current event or political issue are equally valid and thus any strong position on the event or issue ought to be mocked.”
- tbrownaw 5y ago
  "the current thing" is everywhere and it gets incredibly tedious to see the same opinions and ~~discussions~~ arguments infecting everything. This has nothing at all to do with the correctness of any of the positions, just their pervasiveness.
  - 0des 5y ago
    You pop up in a few convo threads that TobyTheDog is in. That's a coincidence isn't it
    - TobyTheDog123 5y ago
      It's.... almost like people want to have a discussion about this? I'm confused about what you're implying.
      - 0des 5y ago
        Did you mean to respond from your other account?
        TobyTheDog123 5y ago
        I guess I should've figured out that you've been arguing in bad faith this entire time. I'll give less benefit of the doubt with the next troll.
    - JohnHaugeland 5y ago
      "You pop up in a few convo threads that TobyTheDog is in." So do you. So do I. It's not a coincidence, and it's not the implied other explanation. It's because the structure of vote-sorted top-N list sites like HN, Reddit, and so on, focuses most people on the same short list of topics. We will all bump into each other again, whether or not we have any intention of doing so. We're all chatting on the first two pages of stories. We will all collide frequently with people holding similar hours.

totony 5y ago

>undisclosed it's open source

TobyTheDog123 5y ago
This is a really bad (bad faith?) interpretation of what I said. Just because something is in the source code doesn't mean it's acceptable - it's not disclosed anywhere the majority of people would look: A readme, a NPM description, documentation, etc.
- totony 5y ago
  Undisclosed imply that it's secret/hidden. By definition, OSS software has no undisclosed functionality. You're looking for better documentation/a community contract.
  - TobyTheDog123 5y ago
    You can discuss semantics all you'd like, like I said above it doesn't make it acceptable. If I could I'd update my original comment to be more explicit, with either "unadvertised" or "undisclosed where the majority of people would look"

323 5y ago

Do you feel the same about easter eggs? Because when I argue that and give example of easter eggs which caused security vulnerabilities or broke shell scripts on certain dates people reply "oh, lighten up, you are just a party killer, allow some human touch"

DaiPlusPlus 5y ago
> Do you feel the same about easter eggs? Absolutely! Undocumented Easter Eggs cannot be tolerated in any software project today. Larry Osterman wrote about why Microsoft (and most other major software vendors) banned easter-eggs: https://docs.microsoft.com/en-US/archive/blogs/larryosterman/why-no-easter-eggs https://docs.microsoft.com/en-US/archive/blogs/larryosterman... The important point is (to quote): > If the manufacturer of the software that's on every desktop in your company can't stop their developers from sneaking undocumented features into the product (even features as relatively benign as an Easter Egg), how can you be sure that they've not snuck some other undocumented feature into the code. But if an easter-egg is is documented and implemented following normal software engineering practices then that's fine (of course paying customers won't be happy to learn that's where the team is putting their resources), and you can still keep things "secret" by hiding them in spoiler-tags or similar in your changelist - but there must never be any unaccounted-for functionality in a software project.
TobyTheDog123 5y ago
I'm a bit torn, tell you the truth. But there is absolutely a difference between an easter egg, something that usually takes real effort to discover and trigger, and something that runs as part of normal execution. In regards to the examples you give where it causes vulnerabilities or bugs, I think it can be a test if the software you're actually embedding the egg in needs to be improved. If an easter egg breaks something then that's probably indicative of a larger problem.
JohnHaugeland 5y ago
Please don't try to equate easter eggs with intentional damaging code. This shouldn't be a difficult discussion in this way.

maxloh 5y ago

How about just console.log-ing a few support messages for Ukraine?

TobyTheDog123 5y ago
It's all about where people draw the line. Personally, I don't think I'd count console.log as "hidden/undisclosed functionality", while I would claim opening a browser window is. But some people might, and if I was creating a FOSS library I would not include it. --- EDIT: On second thought, I might consider it functionality: People have application logs that are exposed to customers (so it would cause the company to appear to be taking a stance), or exported to other systems which only understand certain log messages, causing issues there.

Aeolun 5y ago

> hidden undisclosed functionality That describes basically all the code I install from open source repos, bar the very specific section of code I actually use.