7 ms·

Probably Yandex will start watching their infrastructure very closely, and go through all known attack vectors that haven't been prioritized before to fix them

Probably Yandex will start watching their infrastructure very closely, and go through all known attack vectors that haven't been prioritized before to fix them ASAP. Won't be a boon for OSS, any author would be idiotic to read stolen source code and then decide to create a OSS library/project based on what they learn from it.

EMIRELADERO 4y ago
> Won't be a boon for OSS, any author would be idiotic to read stolen source code and then decide to create a OSS library/project based on what they learn from it. With the current geopolitical situation going on, is this really true? (From a western developer's perspective)
- nyolfen 4y ago
  the US and russia are both parties to the berne convention, the law still applies even if a bunch of misc russian people and orgs had their assets seized
  - EMIRELADERO 4y ago
    It's not about whether it applies, but whether there is any will to enforce it. Would the US government cooperate in the indictment and prosecution of a US citizen, on behalf of a de-facto enemy nation, for a company that has ties and is allegedly controlled by the government of said nation?
    - nyolfen 4y ago
      it's not criminal law, yandex can hire a lawyer in the US
      - mtnGoat 4y ago
        But could they find a judge/jury sympathetic to any Russian concerns?
        fsckboy 4y ago
        courts decide much more based on law than sympathies, seriously
        mtnGoat 4y ago
        Usually yes, but not always and I think we all know this.
        fsckboy 4y ago
        if you focus on the outliers, you're missing the picture
        FpUser 4y ago
        You saying that US judges lack the integrity to issue impartial judgement?
        mtnGoat 4y ago
        Yes, I’m partially implying that and the records speak for themselves.
        dotancohen 4y ago
        I would love to see the records that you are referring to. Not isolated incidents, rather something suggestive that one could confidently bring a sympathy-based argument in deference of law and expect a high probability of succeeding.
        mtnGoat 4y ago
        I wasn’t saying anything about sympathy. If you think US courts are fair, I’d suggest you do your own research.
    - elkos 4y ago
      yandex is currently based in the Netherlands
- rcfox 4y ago
  Even if Russia were at war with the world, it would still be unethical to loot its citizens' property.
  - EMIRELADERO 4y ago
    Intellectual property is a social construct that society decided was important enough. Often times there is no direct correlation between the "effort" and the "compensation" that IP enforcement enables.
    - LudwigNagasena 4y ago
      Property rights are a social construct regardless of whether the property in question is intellectual. So what?
      - vkou 4y ago
        You are correct. Any bit of property that you aren't personally in physical possession of is a social construct. Social consensus is the only reason that you can leave your car at the curb, and come back to it a week later, and still expect it to be yours. Social consensus is the only reason that you can own land that you don't personally use. Social consensus is the only thing that prevents people working at your widget factory from deciding on Tuesday that its actually their widget factory, and that they would be better off by cutting out the middleman. There are very rare, very extreme situations in which this kind of social consensus is very prominently broken.
  - bobkazamakis 4y ago
    It should be treated the same way they've treated royalties.
  - The_Colonel 4y ago
    Yandex is complicit in the war and willingly helping Russian government with censorship. Its existence is unethical.
xwdv 4y ago
> Won't be a boon for OSS, any author would be idiotic to read stolen source code and then decide to create a OSS library/project based on what they learn from it. This is naive. This generation seems very sensitive to the prospect of computer crime. The stolen source code will almost certainly be read, and if deemed novel enough will be turned into open source projects. It may be tough to figure out those projects are derivatives of stolen code, but most likely they will be passed around in black market repos. I looked through some of my telegram channels to see if anything has been posted yet. Lo and behold, the stolen files are in fact available… from a server in Ukraine.
- subw00f 4y ago
  >This generation seems very sensitive to the prospect of computer crime. You're right. I remember a time, maybe 20 years ago, when stuff like this would be generally appreciated by any community of hackers.
  - xwdv 4y ago
    I think the problem is people are entering a matured industry, all they know is the professional buttoned up culture we have today. People have no further curiosity beyond working and making money in tech. They do not have memories of a time when people tinkered around doing all kinds of crazy and possibly illegal stuff, just for fun, just to see if the could. Sad really.
    - medellin 4y ago
      The punishments are now somewhat known. I used to tinker with things that were questionable but after seeing what happened to swartz and others i stopped. It’s not worth it.
      - dotancohen 4y ago
        It is widely suspected that was the goal.
      - 4y ago
fencepost 4y ago
any author would be idiotic to read stolen source code and then decide to create a OSS library/project based on what they learn from it. Ah, but will it make its way into Copilot? That could be interesting.
- BonoboIO 4y ago
  Oh that code, Copilot generated it. I m innocent. The Copilot Defence
  - unsupp0rted 4y ago
    I must be writing very obvious glue code because I’ve only ever had copilot suggest very obvious glue code.
    - dotancohen 4y ago
      Very obvious glue code is 95% of what I write. It's the remaining 5% that justify my salary.
      - ThePowerOfFuet 4y ago
        Making mark on machine: $1 Knowing where to make mark: $9999
azangru 4y ago
> any author would be idiotic to read stolen source code and then decide to create a OSS library/project based on what they learn from it. What? Why? Isn't this what software developers do — they read a lot of code; they find ideas they like; they mix them together with their own ideas while building something. Isn't this how learning works in general?
- wizzwizz4 4y ago
  > What? Why? Isn't this what software developers do — they read a lot of code; they find ideas they like; they mix them together with their own ideas while building something. Not normally. https://en.wikipedia.org/wiki/Not_invented_here#In_computing https://en.wikipedia.org/wiki/Not_invented_here#In_computing More to the point: an organisation will usually use cleanroom techniques to clone something like this, if they choose to do so. Anyone who's been in contact with the original source code is "polluted": https://wiki.winehq.org/Developer_FAQ#Copyright_Issues https://wiki.winehq.org/Developer_FAQ#Copyright_Issues
  - fsflover 4y ago
    https://en.wikipedia.org/wiki/Clean_room_design https://en.wikipedia.org/wiki/Clean_room_design
  - EMIRELADERO 4y ago
    Worthy to note that the "clean-room" doctrine is not required and even discouraged legally, in favor of more direct source code reading and idea extraction (See Sega v. Accolade and Sony v. Connectix, in which the latter court commented on clean-room being inefficient and the kind of wasted effort that fair use was designed to prevent) The whole point of the idea/expression dichotomy is that copyright doesn't protect ideas. To that end, extracting the uncopyrightable elements out of copyrightable code is more than legal and court-endorsed. Wine's approach just makes me sad, lots of wasted effort on black-box testing where a disssembly of the real code would be legally in the clear and allow it to advance at much better speeds.
  - fidgewidge 4y ago

EMIRELADERO 4y ago

> Won't be a boon for OSS, any author would be idiotic to read stolen source code and then decide to create a OSS library/project based on what they learn from it. With the current geopolitical situation going on, is this really true? (From a western developer's perspective)

nyolfen 4y ago
the US and russia are both parties to the berne convention, the law still applies even if a bunch of misc russian people and orgs had their assets seized
- EMIRELADERO 4y ago
  It's not about whether it applies, but whether there is any will to enforce it. Would the US government cooperate in the indictment and prosecution of a US citizen, on behalf of a de-facto enemy nation, for a company that has ties and is allegedly controlled by the government of said nation?
  - nyolfen 4y ago
    it's not criminal law, yandex can hire a lawyer in the US
    - mtnGoat 4y ago
      But could they find a judge/jury sympathetic to any Russian concerns?
      - fsckboy 4y ago
        courts decide much more based on law than sympathies, seriously
        mtnGoat 4y ago
        Usually yes, but not always and I think we all know this.
        fsckboy 4y ago
        if you focus on the outliers, you're missing the picture
      - FpUser 4y ago
        You saying that US judges lack the integrity to issue impartial judgement?
        mtnGoat 4y ago
        Yes, I’m partially implying that and the records speak for themselves.
        dotancohen 4y ago
        I would love to see the records that you are referring to. Not isolated incidents, rather something suggestive that one could confidently bring a sympathy-based argument in deference of law and expect a high probability of succeeding.
        mtnGoat 4y ago
        I wasn’t saying anything about sympathy. If you think US courts are fair, I’d suggest you do your own research.
  - elkos 4y ago
    yandex is currently based in the Netherlands
rcfox 4y ago
Even if Russia were at war with the world, it would still be unethical to loot its citizens' property.
- EMIRELADERO 4y ago
  Intellectual property is a social construct that society decided was important enough. Often times there is no direct correlation between the "effort" and the "compensation" that IP enforcement enables.
  - LudwigNagasena 4y ago
    Property rights are a social construct regardless of whether the property in question is intellectual. So what?
    - vkou 4y ago
      You are correct. Any bit of property that you aren't personally in physical possession of is a social construct. Social consensus is the only reason that you can leave your car at the curb, and come back to it a week later, and still expect it to be yours. Social consensus is the only reason that you can own land that you don't personally use. Social consensus is the only thing that prevents people working at your widget factory from deciding on Tuesday that its actually their widget factory, and that they would be better off by cutting out the middleman. There are very rare, very extreme situations in which this kind of social consensus is very prominently broken.
- bobkazamakis 4y ago
  It should be treated the same way they've treated royalties.
- The_Colonel 4y ago
  Yandex is complicit in the war and willingly helping Russian government with censorship. Its existence is unethical.

xwdv 4y ago

> Won't be a boon for OSS, any author would be idiotic to read stolen source code and then decide to create a OSS library/project based on what they learn from it. This is naive. This generation seems very sensitive to the prospect of computer crime. The stolen source code will almost certainly be read, and if deemed novel enough will be turned into open source projects. It may be tough to figure out those projects are derivatives of stolen code, but most likely they will be passed around in black market repos. I looked through some of my telegram channels to see if anything has been posted yet. Lo and behold, the stolen files are in fact available… from a server in Ukraine.

subw00f 4y ago
>This generation seems very sensitive to the prospect of computer crime. You're right. I remember a time, maybe 20 years ago, when stuff like this would be generally appreciated by any community of hackers.
- xwdv 4y ago
  I think the problem is people are entering a matured industry, all they know is the professional buttoned up culture we have today. People have no further curiosity beyond working and making money in tech. They do not have memories of a time when people tinkered around doing all kinds of crazy and possibly illegal stuff, just for fun, just to see if the could. Sad really.
  - medellin 4y ago
    The punishments are now somewhat known. I used to tinker with things that were questionable but after seeing what happened to swartz and others i stopped. It’s not worth it.
    - dotancohen 4y ago
      It is widely suspected that was the goal.
    - 4y ago

fencepost 4y ago

any author would be idiotic to read stolen source code and then decide to create a OSS library/project based on what they learn from it. Ah, but will it make its way into Copilot? That could be interesting.

BonoboIO 4y ago
Oh that code, Copilot generated it. I m innocent. The Copilot Defence
- unsupp0rted 4y ago
  I must be writing very obvious glue code because I’ve only ever had copilot suggest very obvious glue code.
  - dotancohen 4y ago
    Very obvious glue code is 95% of what I write. It's the remaining 5% that justify my salary.
    - ThePowerOfFuet 4y ago
      Making mark on machine: $1 Knowing where to make mark: $9999

azangru 4y ago

> any author would be idiotic to read stolen source code and then decide to create a OSS library/project based on what they learn from it. What? Why? Isn't this what software developers do — they read a lot of code; they find ideas they like; they mix them together with their own ideas while building something. Isn't this how learning works in general?

wizzwizz4 4y ago
> What? Why? Isn't this what software developers do — they read a lot of code; they find ideas they like; they mix them together with their own ideas while building something. Not normally. https://en.wikipedia.org/wiki/Not_invented_here#In_computing https://en.wikipedia.org/wiki/Not_invented_here#In_computing More to the point: an organisation will usually use cleanroom techniques to clone something like this, if they choose to do so. Anyone who's been in contact with the original source code is "polluted": https://wiki.winehq.org/Developer_FAQ#Copyright_Issues https://wiki.winehq.org/Developer_FAQ#Copyright_Issues
- fsflover 4y ago
  https://en.wikipedia.org/wiki/Clean_room_design https://en.wikipedia.org/wiki/Clean_room_design
- EMIRELADERO 4y ago
  Worthy to note that the "clean-room" doctrine is not required and even discouraged legally, in favor of more direct source code reading and idea extraction (See Sega v. Accolade and Sony v. Connectix, in which the latter court commented on clean-room being inefficient and the kind of wasted effort that fair use was designed to prevent) The whole point of the idea/expression dichotomy is that copyright doesn't protect ideas. To that end, extracting the uncopyrightable elements out of copyrightable code is more than legal and court-endorsed. Wine's approach just makes me sad, lots of wasted effort on black-box testing where a disssembly of the real code would be legally in the clear and allow it to advance at much better speeds.
- fidgewidge 4y ago