3 ms·

I don't understand his attitude towards "anonymous maintainers". Right now ALL contributions to curl are pseudonymous, including his own. There is just no such

by Lockal 2y ago

I don't understand his attitude towards "anonymous maintainers". Right now ALL contributions to curl are pseudonymous, including his own. There is just no such organization as "Curl". Want to see non-anonymous contributors - go to Google/Intel/etc, they ask for IDs when they hire employees. > A (to me) surprisingly large amount of contributions are done by people who do not state a full real name Again, strange attitude, given that he personally had legal issues with US in the past, the reasons for which were never disclosed[1]. Typical good developers are not Rambo. When law enforcers come to them and force them at gunpoint to make them commit/add a new maintainer, they should not expect active resistance. Minor reminder: curl is not just some http library, they maintain their own CA list[2]. They don't need any intricate hidden lines for backdoor, CA list is a backdoor on its own. [1] https://daniel.haxx.se/us-visa.html https://daniel.haxx.se/us-visa.html [2] https://curl.se/docs/caextract.html https://curl.se/docs/caextract.html

deleted 2y ago
[deleted]
cormorant 2y ago
> Right now ALL contributions to curl are pseudonymous, including his own. How so? He has a rather extensive autobiography page[1] with his full name (Daniel Stenberg), plus over a dozen photos of himself[2] (and videos), and his git commits are under his full name and email address (hidden on github.com web interface just like on all repos, however). Perhaps you mistook his handle of "badger" for a pseudonym? > he personally had legal issues with US in the past, the reasons for which were never disclosed You thought his blog posts about it[3] were insufficiently descriptive? Or you blame him somehow for the fact that the US government never explained itself? [1] https://daniel.haxx.se/about.html https://daniel.haxx.se/about.html [2] https://daniel.haxx.se/photos.html https://daniel.haxx.se/photos.html [3] https://daniel.haxx.se/blog/2018/07/28/administrative-purgatory/ https://daniel.haxx.se/blog/2018/07/28/administrative-purgat...
- Lockal 2y ago
  Of course I know name "Daniel Stenberg". But at any moment there is no guarantee that next release published under his account was actually done by person named "Daniel Stenberg". Single person outside of organization is a huge weak point. Let me explain by comparing curl with XZ (and it was not me who started this comparison). XZ was initially released in 2009 by Lasse Collin. But how would you know that "Lasse Collin" actually exists? Is it a single person or a group? Maybe some papers? (unlikely, for papers see Igor Pavlov's dissertation in LZMA[1]). Do we know his country? No, all that we know that Lasse was in some "hotel with limited internet connection" at the time of the incident (hello to Russian and Chinese prisons). Who would benefit from having an autobiography page, which nowadays can be made up in 5 seconds in ChatGPT? > Or you blame him somehow for the fact that the US government never explained itself? Not for that. In his "Administrative Purgatory" post he makes some assumptions on reasons of visa denial. But the whole picture he showed there is that he is just a dutiful developer of a popular opensource library. Also he owns a domain. And that was enough for the US to equate him with criminals. Then why didn't he take a lesson from this that in order to remain free (this applies to traveling as well), it's acceptable to separate hobbies for information security, cryptocurrency, export-restricted technologies like HPC, AI and quantum computing and other legally complex stuff under a separate profile? Pseudonymity in open-source (as in any other charity) is long overdue to be accepted as the norm. Let's stop building security theater on autobiographies from other people's personal pages. [1] https://primo.nlr.ru/primo-explore/fulldisplay?vid=07NLR_VU1&docid=07NLR_LMS000362707 https://primo.nlr.ru/primo-explore/fulldisplay?vid=07NLR_VU1...
  - cormorant 2y ago
    > Who would benefit from having an autobiography page, which nowadays can be made up in 5 seconds in ChatGPT? So now you're saying that the fact that (scare-quotes) Daniel Stenberg has a public autobiography page and photos and gives video-recorded in public makes you less convinced he's a real human individual? OK, sure, you can never be sure that your neighbor or coworker or Linus Torvalds is not a CIA or FSB agent. But you are basing this on nothing.
- deleted 2y ago
  [deleted]

by Lockal 2y ago

deleted 2y ago

[deleted]

cormorant 2y ago

> Right now ALL contributions to curl are pseudonymous, including his own. How so? He has a rather extensive autobiography page[1] with his full name (Daniel Stenberg), plus over a dozen photos of himself[2] (and videos), and his git commits are under his full name and email address (hidden on github.com web interface just like on all repos, however). Perhaps you mistook his handle of "badger" for a pseudonym? > he personally had legal issues with US in the past, the reasons for which were never disclosed You thought his blog posts about it[3] were insufficiently descriptive? Or you blame him somehow for the fact that the US government never explained itself? [1] https://daniel.haxx.se/about.html https://daniel.haxx.se/about.html [2] https://daniel.haxx.se/photos.html https://daniel.haxx.se/photos.html [3] https://daniel.haxx.se/blog/2018/07/28/administrative-purgatory/ https://daniel.haxx.se/blog/2018/07/28/administrative-purgat...

Lockal 2y ago
Of course I know name "Daniel Stenberg". But at any moment there is no guarantee that next release published under his account was actually done by person named "Daniel Stenberg". Single person outside of organization is a huge weak point. Let me explain by comparing curl with XZ (and it was not me who started this comparison). XZ was initially released in 2009 by Lasse Collin. But how would you know that "Lasse Collin" actually exists? Is it a single person or a group? Maybe some papers? (unlikely, for papers see Igor Pavlov's dissertation in LZMA[1]). Do we know his country? No, all that we know that Lasse was in some "hotel with limited internet connection" at the time of the incident (hello to Russian and Chinese prisons). Who would benefit from having an autobiography page, which nowadays can be made up in 5 seconds in ChatGPT? > Or you blame him somehow for the fact that the US government never explained itself? Not for that. In his "Administrative Purgatory" post he makes some assumptions on reasons of visa denial. But the whole picture he showed there is that he is just a dutiful developer of a popular opensource library. Also he owns a domain. And that was enough for the US to equate him with criminals. Then why didn't he take a lesson from this that in order to remain free (this applies to traveling as well), it's acceptable to separate hobbies for information security, cryptocurrency, export-restricted technologies like HPC, AI and quantum computing and other legally complex stuff under a separate profile? Pseudonymity in open-source (as in any other charity) is long overdue to be accepted as the norm. Let's stop building security theater on autobiographies from other people's personal pages. [1] https://primo.nlr.ru/primo-explore/fulldisplay?vid=07NLR_VU1&docid=07NLR_LMS000362707 https://primo.nlr.ru/primo-explore/fulldisplay?vid=07NLR_VU1...
- cormorant 2y ago
  > Who would benefit from having an autobiography page, which nowadays can be made up in 5 seconds in ChatGPT? So now you're saying that the fact that (scare-quotes) Daniel Stenberg has a public autobiography page and photos and gives video-recorded in public makes you less convinced he's a real human individual? OK, sure, you can never be sure that your neighbor or coworker or Linus Torvalds is not a CIA or FSB agent. But you are basing this on nothing.
deleted 2y ago
[deleted]