4 ms·

Maybe one of the outcomes of this could be a culture change in FOSS towards systematically banning rude consumers in Github issues, or, just in general, a heigh

Maybe one of the outcomes of this could be a culture change in FOSS towards systematically banning rude consumers in Github issues, or, just in general, a heightened community awareness making us coming down on them way harder when we see it happen.

Aurornis 3y ago
The attackers will leverage any culture that helps them accomplish their goals. If being rude and pushy doesn’t work, the next round will be kind and helpful. Don’t read too much into the cultural techniques used, because the cultural techniques will mirror the culture at the time.
- coldpie 3y ago
  Even if the security outcome is the same, I would still count people being kind and helpful online instead of rude as an improvement.
  - saghm 3y ago
    As always, there's an xkcd for that https://xkcd.com/810/ https://xkcd.com/810/
    - cryptonector 3y ago
      That's amazing.
- tamimio 3y ago
  Spot on. The counter should be sound regardless of any social or cultural context, a process where being polite or rude, pushy or not is irrelevant.
- advaith08 3y ago
  Agree. I think a more core issue here is that only 1 person needed to be convinced in order to push malware into xz
apantel 3y ago
The Jia Tan character was never rude. If you make rudeness the thing that throws a red flag, then ‘nice’ fake accounts will bubble up to do the pressuring.
- sebstefan 3y ago
  Pressuring the maintainer is already rude in itself and being polite about it won't help them If they want things done quickly they can do it themselves
  - ant6n 3y ago
    > If they want things done quickly they can do it themselves I mean they kind of did. And that was the problem.
- genter 3y ago
  The assumption is that the group behind this attack had sock puppets that were rude to Lasse Collin, to wear him down, and then Jia Tan swept in as the savior.
- patmorgan23 3y ago
  Jia Tan wasn't rude, but the original maintainer Laser Collin probably wouldn't have been as burned out and willing to give responsibility to them if the community wasn't as rude and demanding of someone doing free work for them. I think we need to start paying more of these open source maintainers and have some staff/volunteers that can help them manage their git hub issue volume.
  - orthecreedence 3y ago
    The article covers that those rude accounts may have been sybils of the attacker to create pressure. It's effectively good cop/bad cop for open source.
- berniedurfee 3y ago
  There was definitely good cop/bad cop going on. That’s a really powerful psychological tool.
GoblinSlayer 3y ago
Just don't do anything crazy. There are legitimately crazy people asking for crazy things, not necessarily backdoors.
ok123456 3y ago
People have been bullied out of 'nice' communities. See the 'Actix' debacle in Rust.
- mzs 3y ago
  That was mostly redditors though. Reddit is not a nice community.
  - infamouscow 3y ago
    Redditors on r/rust are ostensible the same as saying Rust programmers.
  - account42 3y ago
    Most "nice" communities aren't all that nice if they consider you to be part of the out group.
- dralley 3y ago
  While I don't condone some of the treatment he received, that situation was extremely different. A user reported a safety issue, the maintainer said it was safe. Then it was proven that it was in fact unsafe, and the maintainer justified it with performance. Then a PR was filed which was safe and did not regress performance, and the maintainer rejected it with "this patch is boring" The behavior of both sides was deeply unacceptable. If someone identifies a legitimate issue and files a PR to fix it, don't insult them by calling the patch "boring" and don't reject it solely on that basis.
deleted 3y ago
[deleted]
publius_0xf3 3y ago
I want to caution against taking a good thing too far. There's a certain kind of talented person who is all too conscious of their abilities and is arrogant, irascible, and demanding as a result. Linus Torvalds, Steve Jobs, Casey Muratori come to mind. Much as we might want these characters to be kinder, their irascibility is inseparable from their more admirable qualities. Sometimes good things, even the best things, are made by difficult people, and we would lose a lot by making a community that alienates them.
- djmips 3y ago
  That's a tough one - It's hard to fully disagree but in my experience you can have all the benefits without the poison. Accepting the poison just because of the benefits is kind of just giving up. I don't feel like the your hypothesis that the two are irrevocably linked holds up under examination.
- RyanCavanaugh 3y ago
  There are plenty of hyper-competent technical people in the field who are also kind and patient. Being smart doesn't turn someone into a jerk.
- Tainnor 3y ago
  Linus Torvalds is apparently trying to do better (although I haven't followed up with the progress), but more importantly, while he might be (have been) unnecessarily rude and aggressive, he's not entitled (as far as I know). I don't think he would jump into an issue tracker of some project he doesn't maintain and demand that certain changes be made.
  - GreenWatermelon 3y ago
    After watching a recent talk with Linus Torvalds[0], it seems that he's become more soft spoken. [0] clip about the Nvidia "incident" https://youtu.be/wvQ0N56pW74 https://youtu.be/wvQ0N56pW74
Vicinity9635 3y ago
[dead]
Tainnor 3y ago
I don't want to excuse rudeness or a sense of entitlement. But I think we can still understand where it comes from. A lot of these people probably work on crappy codebases where "let's just add a random dependency without any vetting" was the norm, they might have to deal with production issues etc. There's probably a systemic issue behind it, that our industry relies too much on unpaid labour and is usually not willing to contribute back.[0] [0] Funnily enough, just a week or two ago, I fixed an issue in an OS project that we introduced at work. It was an easy frontend fix even for someone like me who doesn't do frontend and barely knows how to spell Vue. And more importantly, in the issue description somebody already wrote exactly what causes the bug and what would need to change - the only thing left was finding the place where to make the (one-line) change. Somehow that issue had been open for 2 years but nobody of the several people who complained (nor the maintainer) had bothered to fix it. After I made a PR, it was merged within a day.

Aurornis 3y ago

The attackers will leverage any culture that helps them accomplish their goals. If being rude and pushy doesn’t work, the next round will be kind and helpful. Don’t read too much into the cultural techniques used, because the cultural techniques will mirror the culture at the time.

coldpie 3y ago
Even if the security outcome is the same, I would still count people being kind and helpful online instead of rude as an improvement.
- saghm 3y ago
  As always, there's an xkcd for that https://xkcd.com/810/ https://xkcd.com/810/
  - cryptonector 3y ago
    That's amazing.
tamimio 3y ago
Spot on. The counter should be sound regardless of any social or cultural context, a process where being polite or rude, pushy or not is irrelevant.
advaith08 3y ago
Agree. I think a more core issue here is that only 1 person needed to be convinced in order to push malware into xz

apantel 3y ago

The Jia Tan character was never rude. If you make rudeness the thing that throws a red flag, then ‘nice’ fake accounts will bubble up to do the pressuring.

sebstefan 3y ago
Pressuring the maintainer is already rude in itself and being polite about it won't help them If they want things done quickly they can do it themselves
- ant6n 3y ago
  > If they want things done quickly they can do it themselves I mean they kind of did. And that was the problem.
genter 3y ago
The assumption is that the group behind this attack had sock puppets that were rude to Lasse Collin, to wear him down, and then Jia Tan swept in as the savior.
patmorgan23 3y ago
Jia Tan wasn't rude, but the original maintainer Laser Collin probably wouldn't have been as burned out and willing to give responsibility to them if the community wasn't as rude and demanding of someone doing free work for them. I think we need to start paying more of these open source maintainers and have some staff/volunteers that can help them manage their git hub issue volume.
- orthecreedence 3y ago
  The article covers that those rude accounts may have been sybils of the attacker to create pressure. It's effectively good cop/bad cop for open source.
berniedurfee 3y ago
There was definitely good cop/bad cop going on. That’s a really powerful psychological tool.

GoblinSlayer 3y ago

Just don't do anything crazy. There are legitimately crazy people asking for crazy things, not necessarily backdoors.

ok123456 3y ago

People have been bullied out of 'nice' communities. See the 'Actix' debacle in Rust.

mzs 3y ago
That was mostly redditors though. Reddit is not a nice community.
- infamouscow 3y ago
  Redditors on r/rust are ostensible the same as saying Rust programmers.
- account42 3y ago
  Most "nice" communities aren't all that nice if they consider you to be part of the out group.
dralley 3y ago
While I don't condone some of the treatment he received, that situation was extremely different. A user reported a safety issue, the maintainer said it was safe. Then it was proven that it was in fact unsafe, and the maintainer justified it with performance. Then a PR was filed which was safe and did not regress performance, and the maintainer rejected it with "this patch is boring" The behavior of both sides was deeply unacceptable. If someone identifies a legitimate issue and files a PR to fix it, don't insult them by calling the patch "boring" and don't reject it solely on that basis.

deleted 3y ago

[deleted]

publius_0xf3 3y ago

I want to caution against taking a good thing too far. There's a certain kind of talented person who is all too conscious of their abilities and is arrogant, irascible, and demanding as a result. Linus Torvalds, Steve Jobs, Casey Muratori come to mind. Much as we might want these characters to be kinder, their irascibility is inseparable from their more admirable qualities. Sometimes good things, even the best things, are made by difficult people, and we would lose a lot by making a community that alienates them.

djmips 3y ago
That's a tough one - It's hard to fully disagree but in my experience you can have all the benefits without the poison. Accepting the poison just because of the benefits is kind of just giving up. I don't feel like the your hypothesis that the two are irrevocably linked holds up under examination.
RyanCavanaugh 3y ago
There are plenty of hyper-competent technical people in the field who are also kind and patient. Being smart doesn't turn someone into a jerk.
Tainnor 3y ago
Linus Torvalds is apparently trying to do better (although I haven't followed up with the progress), but more importantly, while he might be (have been) unnecessarily rude and aggressive, he's not entitled (as far as I know). I don't think he would jump into an issue tracker of some project he doesn't maintain and demand that certain changes be made.
- GreenWatermelon 3y ago
  After watching a recent talk with Linus Torvalds[0], it seems that he's become more soft spoken. [0] clip about the Nvidia "incident" https://youtu.be/wvQ0N56pW74 https://youtu.be/wvQ0N56pW74

Vicinity9635 3y ago

[dead]

Tainnor 3y ago

I don't want to excuse rudeness or a sense of entitlement. But I think we can still understand where it comes from. A lot of these people probably work on crappy codebases where "let's just add a random dependency without any vetting" was the norm, they might have to deal with production issues etc. There's probably a systemic issue behind it, that our industry relies too much on unpaid labour and is usually not willing to contribute back.[0] [0] Funnily enough, just a week or two ago, I fixed an issue in an OS project that we introduced at work. It was an easy frontend fix even for someone like me who doesn't do frontend and barely knows how to spell Vue. And more importantly, in the issue description somebody already wrote exactly what causes the bug and what would need to change - the only thing left was finding the place where to make the (one-line) change. Somehow that issue had been open for 2 years but nobody of the several people who complained (nor the maintainer) had bothered to fix it. After I made a PR, it was merged within a day.