2 ms·

Agreed. What I'm thinking of specifically is the leftpad attack vector, where a trusted actor suddenly went malicious and broke the software many people were ly

Agreed. What I'm thinking of specifically is the leftpad attack vector, where a trusted actor suddenly went malicious and broke the software many people were lying upon who didn't realize they were relying upon it (and weren't really in a position to be aware of the issues the author had encountered). If that happens too much, corporations re-evaluate rush and costs and start developing things in isolation and in-house. But I expect leftpad will be a rare event.

di4na 4y ago
I would note that the trusted actor did not went malicious. He did exactly what he was entitled to. If we follow the rules, the people that went malicious are all the trusted users and package repository that broke his intent. He was totally in the limits of his rights and the social contract of the licencing for FOSS. The fact we present these maintainers as "going malicious" is exactly what i am ranting against in this post.
- shadowgovt 4y ago
  If those are the rules, then the risk is too high for corporations to trust strangers, they shall have to stop using FOSS, the ecosystem collapses (because nobody can build on an untrustable system), and the FOSS experiment fails (in the sense we're back in the bad old days of closed software and while people can develop with FOSS, no same user would trust it for use). If my company has to be responsible for every line of code, we may as well own them. I'd argue that he very much did break the social contract. Not the letter of the actual contract, but it's generally assumed FOSS developers aren't in it to screw consumers of their offerings actively. That's the social contract that's the lifeblood of the movement, and if it breaks in the general case, the movement dies. (There's a lot of things people can do that they're perfectly entitled to that would destroy ecosystems because they shatter expectations. Linus could sneak a very clever backdoor into Linux [hypothetically, perhaps not without collusion with multiple actors and a lot of prep work], and he wouldn't break the license but he would severely injure the project's reputation).
  - bombolo 4y ago
    > If my company has to be responsible for every line of code, we may as well own them. Good luck with that… your company has the skills to reimplement node? > but it's generally assumed FOSS developers aren't in it to screw consumers of their offerings actively It's generally assumed they are in it to get screwed actively… but often that isn't the case. > Linus could sneak a very clever backdoor into Linux You are aware of a difference between writing a malware and deleting a project you own right?
    - shadowgovt 4y ago
      > You are aware of a difference between writing a malware and deleting a project you own right? You are quite correct; the npm ecosystem may be a special cade since it has been built on a huge amount of trust-assumption, and the real issue there was that trust model, not FOSS in general. Still, in that ecosystem, unpublishing a module unilaterally that so many systems relied upon was, at besst, negligent (morally not legally), showing a disregard for the concerns of those outside the fight with npm operators. In that context, the unpublish was more malicious than an adherence to the old "user beware" rule. Indeed, it would be hard for Linus to unpublish Linux, given the distributed nature of its hosting; unpublishing leftpad looks more like taking advantage of a mis-design in npm's package model to screw over thousands of third-parties.
      - sharpneli 4y ago
        The negligent part is relying on npm. If you want reliability then pay for it. Corporations crying about morality is just a smokescreen for them to avoid paying.
        shadowgovt 4y ago
        Most users of npm aren't corporations. They are individual developers or small operations taking advantage of a very clever ecosystem for distributed package management. The leftpad stunt hurt everyone in that ecosystem. It was dropping a stink bomb at a party because the host had offended him, but everyone in the room got to suffer the consequences.

di4na 4y ago

I would note that the trusted actor did not went malicious. He did exactly what he was entitled to. If we follow the rules, the people that went malicious are all the trusted users and package repository that broke his intent. He was totally in the limits of his rights and the social contract of the licencing for FOSS. The fact we present these maintainers as "going malicious" is exactly what i am ranting against in this post.

shadowgovt 4y ago
If those are the rules, then the risk is too high for corporations to trust strangers, they shall have to stop using FOSS, the ecosystem collapses (because nobody can build on an untrustable system), and the FOSS experiment fails (in the sense we're back in the bad old days of closed software and while people can develop with FOSS, no same user would trust it for use). If my company has to be responsible for every line of code, we may as well own them. I'd argue that he very much did break the social contract. Not the letter of the actual contract, but it's generally assumed FOSS developers aren't in it to screw consumers of their offerings actively. That's the social contract that's the lifeblood of the movement, and if it breaks in the general case, the movement dies. (There's a lot of things people can do that they're perfectly entitled to that would destroy ecosystems because they shatter expectations. Linus could sneak a very clever backdoor into Linux [hypothetically, perhaps not without collusion with multiple actors and a lot of prep work], and he wouldn't break the license but he would severely injure the project's reputation).
- bombolo 4y ago
  > If my company has to be responsible for every line of code, we may as well own them. Good luck with that… your company has the skills to reimplement node? > but it's generally assumed FOSS developers aren't in it to screw consumers of their offerings actively It's generally assumed they are in it to get screwed actively… but often that isn't the case. > Linus could sneak a very clever backdoor into Linux You are aware of a difference between writing a malware and deleting a project you own right?
  - shadowgovt 4y ago
    > You are aware of a difference between writing a malware and deleting a project you own right? You are quite correct; the npm ecosystem may be a special cade since it has been built on a huge amount of trust-assumption, and the real issue there was that trust model, not FOSS in general. Still, in that ecosystem, unpublishing a module unilaterally that so many systems relied upon was, at besst, negligent (morally not legally), showing a disregard for the concerns of those outside the fight with npm operators. In that context, the unpublish was more malicious than an adherence to the old "user beware" rule. Indeed, it would be hard for Linus to unpublish Linux, given the distributed nature of its hosting; unpublishing leftpad looks more like taking advantage of a mis-design in npm's package model to screw over thousands of third-parties.
    - sharpneli 4y ago
      The negligent part is relying on npm. If you want reliability then pay for it. Corporations crying about morality is just a smokescreen for them to avoid paying.
      - shadowgovt 4y ago
        Most users of npm aren't corporations. They are individual developers or small operations taking advantage of a very clever ecosystem for distributed package management. The leftpad stunt hurt everyone in that ecosystem. It was dropping a stink bomb at a party because the host had offended him, but everyone in the room got to suffer the consequences.