21 ms·

You are right. However this cost should really be imposed on the multi-billion-dollar business and not on the author of the hobby app.

PurpleRamen 3y ago
How should that work? Nobody knows who is using which part from which repo. And it's not just about big business. There are all kind of small communities and little apps, extensions, etc. with some small communities. Most of them don't even make money, but are juicy targets for some small fast money. Forcing everyone to raise their security and gain awareness about those things is a huge win for everyone, and only a little problem for the individual user. And it seems to be only a phase anyway, as most people & services are moving to more comfortable solutions over time.
- simoncion 3y ago
  > How should that work? By the users of the software I publish noticing the license that states that while I hope this software is useful to them, it is provided with `"NO WARRANTY, NOT EVEN FOR FITNESS OF PURPOSE" and planning accordingly. If you're an entity that wants to ensure that software you use from a source that you have approximately zero power over (and has explicitly provided NO warranty for that software) is and continues to be fit for purpose, you're going to have to inspect that software at a point in time, determine if it is fit for your purposes, and carefully inspect every future version of that software that you're considering using. There really are no shortcuts. Requiring one to drink a Confirmation Can to log in doesn't change the math here.
- massysett 3y ago
  Billion-dollar businesses can pay full-time professionals for support. They can hire staff or contract with a vendor. They can audit the free software they use or, like the good old days, pay for software whose vendors maintain it. Or they can use hobbyist-written software for free, which is just fine, but don’t expect the hobbyist to support it for free.
- parineum 3y ago
  > How should that work? Fork and change the readme to reflect that this version is hardened for big business.

PurpleRamen 3y ago

How should that work? Nobody knows who is using which part from which repo. And it's not just about big business. There are all kind of small communities and little apps, extensions, etc. with some small communities. Most of them don't even make money, but are juicy targets for some small fast money. Forcing everyone to raise their security and gain awareness about those things is a huge win for everyone, and only a little problem for the individual user. And it seems to be only a phase anyway, as most people & services are moving to more comfortable solutions over time.

simoncion 3y ago
> How should that work? By the users of the software I publish noticing the license that states that while I hope this software is useful to them, it is provided with `"NO WARRANTY, NOT EVEN FOR FITNESS OF PURPOSE" and planning accordingly. If you're an entity that wants to ensure that software you use from a source that you have approximately zero power over (and has explicitly provided NO warranty for that software) is and continues to be fit for purpose, you're going to have to inspect that software at a point in time, determine if it is fit for your purposes, and carefully inspect every future version of that software that you're considering using. There really are no shortcuts. Requiring one to drink a Confirmation Can to log in doesn't change the math here.
massysett 3y ago
Billion-dollar businesses can pay full-time professionals for support. They can hire staff or contract with a vendor. They can audit the free software they use or, like the good old days, pay for software whose vendors maintain it. Or they can use hobbyist-written software for free, which is just fine, but don’t expect the hobbyist to support it for free.
parineum 3y ago
> How should that work? Fork and change the readme to reflect that this version is hardened for big business.