3 ms·

> They are not expecting the xkcd “Dependency” comic situation to be possible Rightfully so if you assume certain engineering standards. "Made by a nameless gu

> They are not expecting the xkcd “Dependency” comic situation to be possible Rightfully so if you assume certain engineering standards. "Made by a nameless guy in a shack in oregon" is something you never want your auditor to hear.

phkahler 4y ago
"Made by a nameless guy in a shack in oregon" is something you never want your auditor to hear. If you are a business buying software from a business, sure. But if you are anyone getting your OSS from the guy in Oregon, sure. The goal here seems to be shielding larger companies when they use 3rd party OSS. Exploitation at its finest. Besides, what about EULAs and other liability limiting license terms?
ChrisMarshallNY 4y ago
I think that having some kind of "supply chain accreditation" might be something to look at. However, this kind of thing can become a nightmare. I used to work for an ISO-9000 company.
- rs999gti 4y ago
  > some kind of "supply chain accreditation" As long as the for profits and governments that use OSS are paying for the process and regulations, otherwise you are putting undue burden on OSS developers.
  - w4ffl35 4y ago
    now that I am fine with, but i still think this is nutty overall. there's nothing wrong with anon contributions to software.
    - ChrisMarshallNY 4y ago
      It all depends on the final use of the software. I think that anyone that includes anyone else’s work, is responsible to do due diligence on the library/module/code they import. That applies to free or paid software/work. Some companies I have known, have refused to use any free work; even when donated (I tried donating, once). Instead, they insist on paying a small sum (in the US, a single dollar is customary), and having a legally-binding contract. Having the supplier sign a contract may suffice for “due diligence,” as it puts the supplier “on the hook” for the quality of their work. It could also absolve the supplier, and place the burden on the consumer. In any case, I don’t have any “right” to just fart out some junk, and expect it to become crucial infrastructure. If I want my work to be used at that level -whether paid, or not-, then it’s incumbent on me to test, document, and support that work. I have written systems that have become infrastructure; both as paid work, and for free. This is something I have some experience in.
      - w4ffl35 4y ago
        I mentioned this in an above comment - here is a repo that I use in two of my apps that I compile with pyinstaller and distribute: https://github.com/Capsize-Games/aihandler/blob/master/setup.py https://github.com/Capsize-Games/aihandler/blob/master/setup... There are hundreds if not thousands of developers who have contributed to those libraries and the dependencies of those libraries. Are you saying that you feel it is up to someone (myself or some service) to track down and verify the identity of each of these developers, and that I shouldn't use these libraries or distribute them until that happens?
        ChrisMarshallNY 4y ago
        Like I said, if I use someone else’s stuff in my work, it’s my responsibility to assure myself, and anyone upstream, of the veracity of that work. That’s the theory behind efforts like ISO-9000, but I find them pretty “top-heavy.” A good example might be Linux. There are thousands of contributors, but Linux is backed by one of the best (and harshest) developers on Earth. He puts his personal stamp on it, and has trained a bunch of others to be equally insistent on Quality. Git is the same (I believe that you may find some "relation" to Linux). In fact, Git has probably had a bigger impact on the world than Linux, and he put that out in ten days, as a side project. The deal is, that he is used to developing software to be used as infrastructure, and that takes some serious Discipline. That kind of Discipline is actually fairly rare, these days. If someone has it, you can rely on almost anything they do. The quality of the guarantor is an important component of almost any working relationship. Standards bodies try to avoid that, but I'm not confident it works. The one thing that I remember from working in ISO-9000 environments, was myriad ways to work around the requirements. They end up actually causing more problems than they solve. There's really no way to avoid the need for personal and institutional Integrity.
w4ffl35 4y ago
> Rightfully so who cares if some nameless guy in a shack contributed to your third-party libraries? anon people contribute to open source software all the time, its irrelevant, as is their living situation.
- numpad0 4y ago
  No one cares that your equipment is based on early works by young Isaac Newton. But; ... if you tell them that he is actually a living man in rural Nebraska, presently mixing dehydrated macaroni on one hand, holding his crude manuscript in the other hand, actively adding fixes to fundamental errors in it, and that multiple copies of that manuscript is used to control anything from lightbulbs to government communications to fission reactors, right now, that is not going to let them sleep better at nights. And they ARE starting to get uncomfortable with that.
- blueflow 4y ago
  People who will have to vendor that code.
  - w4ffl35 4y ago
    look at all these libraries that i package with my distributed software: https://github.com/Capsize-Games/aihandler/blob/master/setup.py https://github.com/Capsize-Games/aihandler/blob/master/setup... On top of that, there are dependencies for each of those libraries. i don't know the names of any of the people that wrote any of that code and I don't intend to dig into it.
    - blueflow 4y ago
      You don't vendor anything. You only name it as dependency. I'd fail my audits if i did that.
      - w4ffl35 4y ago
        > You don't vendor anything. You only name it as dependency i'm not? how are you using the term "software vendoring" specifically? I am packaging with pyinstaller and distributing as an app.

phkahler 4y ago

"Made by a nameless guy in a shack in oregon" is something you never want your auditor to hear. If you are a business buying software from a business, sure. But if you are anyone getting your OSS from the guy in Oregon, sure. The goal here seems to be shielding larger companies when they use 3rd party OSS. Exploitation at its finest. Besides, what about EULAs and other liability limiting license terms?

ChrisMarshallNY 4y ago

I think that having some kind of "supply chain accreditation" might be something to look at. However, this kind of thing can become a nightmare. I used to work for an ISO-9000 company.

rs999gti 4y ago
> some kind of "supply chain accreditation" As long as the for profits and governments that use OSS are paying for the process and regulations, otherwise you are putting undue burden on OSS developers.
- w4ffl35 4y ago
  now that I am fine with, but i still think this is nutty overall. there's nothing wrong with anon contributions to software.
  - ChrisMarshallNY 4y ago
    It all depends on the final use of the software. I think that anyone that includes anyone else’s work, is responsible to do due diligence on the library/module/code they import. That applies to free or paid software/work. Some companies I have known, have refused to use any free work; even when donated (I tried donating, once). Instead, they insist on paying a small sum (in the US, a single dollar is customary), and having a legally-binding contract. Having the supplier sign a contract may suffice for “due diligence,” as it puts the supplier “on the hook” for the quality of their work. It could also absolve the supplier, and place the burden on the consumer. In any case, I don’t have any “right” to just fart out some junk, and expect it to become crucial infrastructure. If I want my work to be used at that level -whether paid, or not-, then it’s incumbent on me to test, document, and support that work. I have written systems that have become infrastructure; both as paid work, and for free. This is something I have some experience in.
    - w4ffl35 4y ago
      I mentioned this in an above comment - here is a repo that I use in two of my apps that I compile with pyinstaller and distribute: https://github.com/Capsize-Games/aihandler/blob/master/setup.py https://github.com/Capsize-Games/aihandler/blob/master/setup... There are hundreds if not thousands of developers who have contributed to those libraries and the dependencies of those libraries. Are you saying that you feel it is up to someone (myself or some service) to track down and verify the identity of each of these developers, and that I shouldn't use these libraries or distribute them until that happens?
      - ChrisMarshallNY 4y ago
        Like I said, if I use someone else’s stuff in my work, it’s my responsibility to assure myself, and anyone upstream, of the veracity of that work. That’s the theory behind efforts like ISO-9000, but I find them pretty “top-heavy.” A good example might be Linux. There are thousands of contributors, but Linux is backed by one of the best (and harshest) developers on Earth. He puts his personal stamp on it, and has trained a bunch of others to be equally insistent on Quality. Git is the same (I believe that you may find some "relation" to Linux). In fact, Git has probably had a bigger impact on the world than Linux, and he put that out in ten days, as a side project. The deal is, that he is used to developing software to be used as infrastructure, and that takes some serious Discipline. That kind of Discipline is actually fairly rare, these days. If someone has it, you can rely on almost anything they do. The quality of the guarantor is an important component of almost any working relationship. Standards bodies try to avoid that, but I'm not confident it works. The one thing that I remember from working in ISO-9000 environments, was myriad ways to work around the requirements. They end up actually causing more problems than they solve. There's really no way to avoid the need for personal and institutional Integrity.

w4ffl35 4y ago

> Rightfully so who cares if some nameless guy in a shack contributed to your third-party libraries? anon people contribute to open source software all the time, its irrelevant, as is their living situation.

numpad0 4y ago
No one cares that your equipment is based on early works by young Isaac Newton. But; ... if you tell them that he is actually a living man in rural Nebraska, presently mixing dehydrated macaroni on one hand, holding his crude manuscript in the other hand, actively adding fixes to fundamental errors in it, and that multiple copies of that manuscript is used to control anything from lightbulbs to government communications to fission reactors, right now, that is not going to let them sleep better at nights. And they ARE starting to get uncomfortable with that.
blueflow 4y ago
People who will have to vendor that code.
- w4ffl35 4y ago
  look at all these libraries that i package with my distributed software: https://github.com/Capsize-Games/aihandler/blob/master/setup.py https://github.com/Capsize-Games/aihandler/blob/master/setup... On top of that, there are dependencies for each of those libraries. i don't know the names of any of the people that wrote any of that code and I don't intend to dig into it.
  - blueflow 4y ago
    You don't vendor anything. You only name it as dependency. I'd fail my audits if i did that.
    - w4ffl35 4y ago
      > You don't vendor anything. You only name it as dependency i'm not? how are you using the term "software vendoring" specifically? I am packaging with pyinstaller and distributing as an app.