3 ms·

By your definition, the most secure thing then is to not do anything. > what is this thread about? It really rubs me the wrong way that you are passing opinio

By your definition, the most secure thing then is to not do anything. > what is this thread about? It really rubs me the wrong way that you are passing opinion as fact, especially when it is an open source project that is meant to help people. Instead of shitting on other people's work by writing things like "I am happy to pass", perhaps go take a look to see how you could make the improvement that is so important to you?

remram 3y ago
> By your definition, the most secure thing then is to not do anything. Yes... > perhaps go take a look to see how you could make the improvement that is so important to you? No amount of contribution on my part can change your attitude towards security. If it is not a priority of the maintainer, the only move is to stay away. I'm not saying you are creating a collection of spam accounts, I don't even think it's likely that you are. But if someone wanted to do it, this is exactly the way they should go about it. The only move you could take to prove otherwise (not that you owe it to anyone) is to not request posting permission until you need it, with written explanation.
- rglullis 3y ago
  > If it is not a priority of the maintainer, the only move is to stay away. There is another move: submit a PRs with the change. I would gladly accept it. Now that this is online for 3 days, I can give you some numbers: 11 people rejected the request and 135 accepted it. If I went by your preferred route, I would have zero rejections and zero conversions, because I would still be struggling with a self-imposed technical requirement. My time and resources that can be dedicated to this are finite. It doesn't mean that I deny things could be improved, it doesn't mean I won't get to keep working to improve the existing product and it doesn't mean I won't address those concerns later. It just means that this is not meant to be some research project where I need to be satisfying some panel of theoretical experts who never care about the real practice. Right now, the majority of people are telling me "make it easier to find more communities on Lemmy and make it easier to convert more people even if that requires me trusting you", not "I don't trust you enough to let you send messages on my behalf."
  - remram 3y ago
    > There is another move: submit a PRs with the change. I would gladly accept it. That does NOT fix your SECURITY POSTURE. If security is not a priority, you will keep taking shortcuts. You might even have similar issues in your deployment. Sending patches over and over to a software under active development, to try to add something the maintainer doesn't care about, is just not a winning proposition. > 11 people rejected the request and 135 accepted it I myself didn't click "decline", I just closed the tab. How many people closed the tab when they reached the Reddit sign-in page? How could you possibly measure whether it's because they didn't agree to the scopes, whether they lost interest, or whether they forgot their Reddit password?
    - rglullis 3y ago
      > If security is not a priority, you will keep taking shortcuts. As with any other engineering discipline, it is about trade-offs. If you want to maximize "is it secure?" over "can it be used by people safely?", fine. But at the end of the day I managed to have this delivered and used by hundreds of people, who are now able to go on to tell others about it, and no actual security incident. > How many people closed the tab? How people got dropped by the funnel matters little to me compared to the fact that there is a funnel in the first place. This is not a research project and no one is paying me to optimize this funnel. This is me building a tool to have a migration path out of reddit. Prioritizing having it available to people and other instance owners beats delaying it for a week on the basis of "some people will walk away because they object to the access request." Those like you can wait for another week, or they can go fork the code if they want, or they can even ignore the whole project and join lemmy directly. But the product is not for "those like you", so why should I be focusing on addressing your concerns over implementing the things that have been actually requested by other people?

remram 3y ago

> By your definition, the most secure thing then is to not do anything. Yes... > perhaps go take a look to see how you could make the improvement that is so important to you? No amount of contribution on my part can change your attitude towards security. If it is not a priority of the maintainer, the only move is to stay away. I'm not saying you are creating a collection of spam accounts, I don't even think it's likely that you are. But if someone wanted to do it, this is exactly the way they should go about it. The only move you could take to prove otherwise (not that you owe it to anyone) is to not request posting permission until you need it, with written explanation.

rglullis 3y ago
> If it is not a priority of the maintainer, the only move is to stay away. There is another move: submit a PRs with the change. I would gladly accept it. Now that this is online for 3 days, I can give you some numbers: 11 people rejected the request and 135 accepted it. If I went by your preferred route, I would have zero rejections and zero conversions, because I would still be struggling with a self-imposed technical requirement. My time and resources that can be dedicated to this are finite. It doesn't mean that I deny things could be improved, it doesn't mean I won't get to keep working to improve the existing product and it doesn't mean I won't address those concerns later. It just means that this is not meant to be some research project where I need to be satisfying some panel of theoretical experts who never care about the real practice. Right now, the majority of people are telling me "make it easier to find more communities on Lemmy and make it easier to convert more people even if that requires me trusting you", not "I don't trust you enough to let you send messages on my behalf."
- remram 3y ago
  > There is another move: submit a PRs with the change. I would gladly accept it. That does NOT fix your SECURITY POSTURE. If security is not a priority, you will keep taking shortcuts. You might even have similar issues in your deployment. Sending patches over and over to a software under active development, to try to add something the maintainer doesn't care about, is just not a winning proposition. > 11 people rejected the request and 135 accepted it I myself didn't click "decline", I just closed the tab. How many people closed the tab when they reached the Reddit sign-in page? How could you possibly measure whether it's because they didn't agree to the scopes, whether they lost interest, or whether they forgot their Reddit password?
  - rglullis 3y ago
    > If security is not a priority, you will keep taking shortcuts. As with any other engineering discipline, it is about trade-offs. If you want to maximize "is it secure?" over "can it be used by people safely?", fine. But at the end of the day I managed to have this delivered and used by hundreds of people, who are now able to go on to tell others about it, and no actual security incident. > How many people closed the tab? How people got dropped by the funnel matters little to me compared to the fact that there is a funnel in the first place. This is not a research project and no one is paying me to optimize this funnel. This is me building a tool to have a migration path out of reddit. Prioritizing having it available to people and other instance owners beats delaying it for a week on the basis of "some people will walk away because they object to the access request." Those like you can wait for another week, or they can go fork the code if they want, or they can even ignore the whole project and join lemmy directly. But the product is not for "those like you", so why should I be focusing on addressing your concerns over implementing the things that have been actually requested by other people?