4 ms·

While I may share the general sentiment, there’s a freaking lot of “Russian software” out there which you may be knowingly or unknowingly use. There is JetBrai

While I may share the general sentiment, there’s a freaking lot of “Russian software” out there which you may be knowingly or unknowingly use. There is JetBrains, for example. But there is also core-js which is a little polyfill library being used by like way more than half of high profile websites. Also written by a Russian national. If you excise all contributions by Russian nationals to PostgreSQL or the Linux kernel, they will be left in a not very runnable state, I’m afraid. On the other hand, it’s not like you are giving them money directly, unless you do; I also can see that in, say, both Linux and PostgreSQL there is also enough people from the “geopolitical opposition” so that even if the Russian contributors are asked by some stern people from the Apparat to sneak something backdoory in, it will be sniffed rather quickly and prevented from going much further. So tl;dr is that there is no simple response.

jcat123 3y ago
Jetbrains is Czech and most Czech people would get offended by your characterization of them as Russian.
- WesolyKubeczek 3y ago
  Sales, yes. Development, has been in Saint Petersburg not so long ago.
- WesolyKubeczek 3y ago
  There’s quite enough companies and real estate in Czechia owned by Russians, despite even said Russians hastily changing their citizenship in 2022. It’s sometimes beneficial to pose as an EU-based business if a purely Russian business was either sanctioned or considered too risky/dirty/shady to deal with. So while Czechs don’t like to be equated with Russians, not all of them would quite sing „běž domů, Ivane” or share the feeling.
ciceryadam 3y ago
Regarding Jebrains - both owners have renounced their Russian citizenship and are now citizens of Cyprus: https://www.forbes.com/profile/valentin-kipyatkov/ https://www.forbes.com/profile/valentin-kipyatkov/ Plus the HQ is in Prague, Czech Republic: https://www.economist.com/europe/2021/05/27/russia-puts-the-czech-republic-on-an-official-enemies-list https://www.economist.com/europe/2021/05/27/russia-puts-the-...
- darkhorn 3y ago
  Interesting. They have founded the company in Czech Republic but choose to become citizens of Cyprus.
  - WesolyKubeczek 3y ago
    Likely because Cyprus can make you a citizen, figuratively speaking, overnight, for enough money. Czechia wants you to spend some years in there and integrate first.
arp242 3y ago
I think being open source is important here; I don't care if you're German or Russian or Finnish or Chinese or what your governments policies are, as long as we can inspect what's going on. "Trust but verify".
- WesolyKubeczek 3y ago
  You can still sneak nefarious stuff if you have a lot of reputation score so that most people who actually put their eyeballs on the stuff tend to trust you blindly, especially if the development on the project is so active that you don't have the bandwidth to inspect all the changes. There is also the mighty bystander effect at play: surely, someone else is going to look at it. Someone else will have time to test it. He's our hero, the Someone-Else-Man! Mind you, it only takes to catch you once, and your mountain of reputation will poof out of existence in an eyeblink. This is the price. Mind you, asking to downplay a vulnerability "because it's in an experimental module not built by default" would make me suspicious on the simple grounds that even if a module is experimental, you ship it alongside your stable code, and for sure someone builds it and is using it. Depending on who those users might be, there could be also parties interested in them not patching the vulnerability for as long as possible. This sounds paranoid for sure, but your being paranoid doesn't mean there's nobody out to get you!
  - arp242 3y ago
    I never said it's perfect, but at least I have an opportunity to inspect things.
    - WesolyKubeczek 3y ago
      Yes, this is exactly the counter-argument I always make whenever someone says "but there are never the eyeballs to inspect open source, see Heartbleed, so why bother, it's not better", blablabla. But at least I have the option, dammit! Contrary to the proprietary software where your problem will be diligently filed into a ticket, given a number, and be left to rot. Which doesn't change the fact that people are lazy and do turn the blind eye... :-( and sometimes the Someone-Else-Man won't come and save the day. But that's just life.

jcat123 3y ago

Jetbrains is Czech and most Czech people would get offended by your characterization of them as Russian.

WesolyKubeczek 3y ago
Sales, yes. Development, has been in Saint Petersburg not so long ago.
WesolyKubeczek 3y ago
There’s quite enough companies and real estate in Czechia owned by Russians, despite even said Russians hastily changing their citizenship in 2022. It’s sometimes beneficial to pose as an EU-based business if a purely Russian business was either sanctioned or considered too risky/dirty/shady to deal with. So while Czechs don’t like to be equated with Russians, not all of them would quite sing „běž domů, Ivane” or share the feeling.

ciceryadam 3y ago

Regarding Jebrains - both owners have renounced their Russian citizenship and are now citizens of Cyprus: https://www.forbes.com/profile/valentin-kipyatkov/ https://www.forbes.com/profile/valentin-kipyatkov/ Plus the HQ is in Prague, Czech Republic: https://www.economist.com/europe/2021/05/27/russia-puts-the-czech-republic-on-an-official-enemies-list https://www.economist.com/europe/2021/05/27/russia-puts-the-...

darkhorn 3y ago
Interesting. They have founded the company in Czech Republic but choose to become citizens of Cyprus.
- WesolyKubeczek 3y ago
  Likely because Cyprus can make you a citizen, figuratively speaking, overnight, for enough money. Czechia wants you to spend some years in there and integrate first.

arp242 3y ago

I think being open source is important here; I don't care if you're German or Russian or Finnish or Chinese or what your governments policies are, as long as we can inspect what's going on. "Trust but verify".

WesolyKubeczek 3y ago
You can still sneak nefarious stuff if you have a lot of reputation score so that most people who actually put their eyeballs on the stuff tend to trust you blindly, especially if the development on the project is so active that you don't have the bandwidth to inspect all the changes. There is also the mighty bystander effect at play: surely, someone else is going to look at it. Someone else will have time to test it. He's our hero, the Someone-Else-Man! Mind you, it only takes to catch you once, and your mountain of reputation will poof out of existence in an eyeblink. This is the price. Mind you, asking to downplay a vulnerability "because it's in an experimental module not built by default" would make me suspicious on the simple grounds that even if a module is experimental, you ship it alongside your stable code, and for sure someone builds it and is using it. Depending on who those users might be, there could be also parties interested in them not patching the vulnerability for as long as possible. This sounds paranoid for sure, but your being paranoid doesn't mean there's nobody out to get you!
- arp242 3y ago
  I never said it's perfect, but at least I have an opportunity to inspect things.
  - WesolyKubeczek 3y ago
    Yes, this is exactly the counter-argument I always make whenever someone says "but there are never the eyeballs to inspect open source, see Heartbleed, so why bother, it's not better", blablabla. But at least I have the option, dammit! Contrary to the proprietary software where your problem will be diligently filed into a ticket, given a number, and be left to rot. Which doesn't change the fact that people are lazy and do turn the blind eye... :-( and sometimes the Someone-Else-Man won't come and save the day. But that's just life.