3 ms·

Thank you for writing this; far too much entitlement, far too much blame shifting in the parent comment. Ultimately problems with your code, including deps it

Thank you for writing this; far too much entitlement, far too much blame shifting in the parent comment. Ultimately problems with your code, including deps it pulls in, are your problem, no one else's. Code appropriately.

rektide 4y ago
Thank you. Ultimately I would agree that some more security is good, that we do we need capabilities & strategies for trust, need to make more options available. But I also think top-down, authoritarian measures are pitiful, reactionary, & an entitled response. This co-option & bending- of what has gotten us so far, & only infrequently been problematic- into something industrial & controlling, is unwarranted & vulgar. It's very important to realize that "success" cannot be the objective. There will always be fundamental questions of trust that are outstanding. Once we begin pretending that this is a "problem to be solved" and not an ongoing shifting changing scene we think too short-term, too limitedly. This is a long long iteration with no finality with no triumphant final cracking the code to get us security. Letting Microsoft and/or China[1] approve all PRs & everyone living happily ever sounds nice, but incompatible with the ethos & logos of open-source, of letting people be people & mutually encouraging each other. I'd also emphasize- strongly- that the real defenses are collectivized ones. Maybe we can build a social network of vouchers, people who look at releases & record a confidence or sureness they feel about the changes. Aggregate the results when we update packages. Open source has been a collective effort, and I think a lot of the security gains we want are from increased collectivization. This- notably- again bucks the idea of absolute security, of fundamental answers, and instead encourages & pushes in a good direction. [1] https://www.scmp.com/tech/big-tech/article/3178323/gitee-chinas-answer-github-review-all-code-temporarily-closing-open https://www.scmp.com/tech/big-tech/article/3178323/gitee-chi... https://news.ycombinator.com/item?id=31458770 https://news.ycombinator.com/item?id=31458770
- tempodox 4y ago
  I believe the conquer-all thinking of big corporations is fundamentally incompatible with open-source culture, if there is such a thing. Top-down, authoritarian measures are too much in their DNA, and that includes the CYA angle. I suspect this might end with the usual “Embrace, Extend, Extinguish” — not because someone consciously follows an evil plan, but because of that fundamental incompatibility. It will increasingly be “our way or the highway” and people who disagree will have to make camp somewhere else, if they can. But can they really when NPM practically holds a monopoly position in its space?

rektide 4y ago

Thank you. Ultimately I would agree that some more security is good, that we do we need capabilities & strategies for trust, need to make more options available. But I also think top-down, authoritarian measures are pitiful, reactionary, & an entitled response. This co-option & bending- of what has gotten us so far, & only infrequently been problematic- into something industrial & controlling, is unwarranted & vulgar. It's very important to realize that "success" cannot be the objective. There will always be fundamental questions of trust that are outstanding. Once we begin pretending that this is a "problem to be solved" and not an ongoing shifting changing scene we think too short-term, too limitedly. This is a long long iteration with no finality with no triumphant final cracking the code to get us security. Letting Microsoft and/or China[1] approve all PRs & everyone living happily ever sounds nice, but incompatible with the ethos & logos of open-source, of letting people be people & mutually encouraging each other. I'd also emphasize- strongly- that the real defenses are collectivized ones. Maybe we can build a social network of vouchers, people who look at releases & record a confidence or sureness they feel about the changes. Aggregate the results when we update packages. Open source has been a collective effort, and I think a lot of the security gains we want are from increased collectivization. This- notably- again bucks the idea of absolute security, of fundamental answers, and instead encourages & pushes in a good direction. [1] https://www.scmp.com/tech/big-tech/article/3178323/gitee-chinas-answer-github-review-all-code-temporarily-closing-open https://www.scmp.com/tech/big-tech/article/3178323/gitee-chi... https://news.ycombinator.com/item?id=31458770 https://news.ycombinator.com/item?id=31458770

tempodox 4y ago
I believe the conquer-all thinking of big corporations is fundamentally incompatible with open-source culture, if there is such a thing. Top-down, authoritarian measures are too much in their DNA, and that includes the CYA angle. I suspect this might end with the usual “Embrace, Extend, Extinguish” — not because someone consciously follows an evil plan, but because of that fundamental incompatibility. It will increasingly be “our way or the highway” and people who disagree will have to make camp somewhere else, if they can. But can they really when NPM practically holds a monopoly position in its space?