5 ms·

The commit bit isn't about security, it's about control. There is no way open source projects can never give out commit bits again due to xz. And xz doesn't hav

by depr 2y ago

The commit bit isn't about security, it's about control. There is no way open source projects can never give out commit bits again due to xz. And xz doesn't have an active team with multiple people in it so it doesn't really make sense to compare them. Not sure what you are talking about wrt the dates. Why did you ignore the Meson example? And here is another example: https://mastodon.delroth.net/@delroth/112310645064859357 https://mastodon.delroth.net/@delroth/112310645064859357 This is a guy who has implicit authority to veto anything. Sometimes he does so, and sometimes he just comments on something perhaps not necessarily intending to veto it but that is what happens anyway.

tpmoney 2y ago
Of course it's about control, it's in the name "source control". As an outside observer who only has the links provided available as information, I don't have insight into the actual motivations of the people in question, so without speculating beyond what's been presented how do I know the people who want and don't have control are the people that should have control? In light of what we know about how the XZ attack happened, I'm not inclined to look unfavorably on project owners being reluctant about expanding who has access to the projects source control, and certainly not when that reluctance is in the face of a coordinated pressure campaign complaining about a lack of speed. As for the dates, I am talking about this bullet point from the letter, quoted in full: > puck having to remind him multiple times to even read her PR message at > all and think about if he could be mistaken > https://github.com/NixOS/nix/pull/9911#issuecomment-1925207309 https://github.com/NixOS/nix/pull/9911#issuecomment-19252073... > (after eelco ignored the PR for quite a while, also!) Clicking that link takes us to a PR that was opened on 2024-02-02. The initial response from the Nix author comes 7 minutes later. Puck has multiple back and forths with other members Github, but her next interaction with the Nix author comes the next day on 2024-02-03. This is also the first time in the conversation where she "reminds him ... to even read her PR message". There's a second interaction later that same day during which she does similar, but it's worth noting this is pointing to a different message and appears to be less a "reminder to read" and more re-iterating what they feel is their argument against the Nix author's own arguments. Puck then continues to have back and forth with other commenters but as of today, there has been no further comments from the Nix author after 2024-02-03, and no further comments from Puck after 2024-02-08. This hardly to my mind qualifies either as "having to remind him multiple times to even read her PR message at all" or "after eelco ignored the PR for quite a while, also!" So as I said it's a fairly weak claim, and feels more like a "bastard eating crackers" reaction to the PR than an actual showing of poor behavior. As for the "Meson example", I didn't ignore it. As I stated in my comment, I had at that point read two of the referenced discussions in detail, and thus commented on them. I didn't comment in the "Meson example" for the simple reason that I hadn't read it. I have read it now, and equally find it confusing. 1) The claim in the letter is that the proposal has "passed RFC, for five years", yet the RFC itself only appears to have been opened 2022-08-24. It's been a while since grade school for me, and I'll admit COVID has warped all our sense of time, but I'm pretty sure 2022 is not 5 years ago. 2) The first completed working implementation of the change doesn't appear to have been done until 2023-01-18 (https://github.com/NixOS/rfcs/pull/132#issuecomment-1387466118 https://github.com/NixOS/rfcs/pull/132#issuecomment-13874661...). Again this is much less than 5 years old. 3) On 2023-03-20, the author of the PR for this change states: > the RFC has made it past most of the early stages and the current goal is to achieve parity with the current buildsystem before replacing it. (https://github.com/NixOS/rfcs/pull/132#issuecomment-1476843320 https://github.com/NixOS/rfcs/pull/132#issuecomment-14768433...) Again, this doesn't seem to fit at all with the claim that the proposal has "passed RFC, for five years" 4) On 2023-11-01, the Nix author themselves asks for updates on the RFC implementation, an action which doesn't seem congruent with someone who is willy nilly single handedly blocking things and being a disruption to the process. And the author of the PR states: >the main block is actually a lack of free time for the main devs! (https://github.com/NixOS/rfcs/pull/132#issuecomment-1789077089 https://github.com/NixOS/rfcs/pull/132#issuecomment-17890770...) This doesn't seem to point to evidence that the Nix author is single handedly holding up this process. 5) On 2024-03-21 the PR author notes: > currently working on adding support to build nix-perl, waiting for assistance (https://github.com/NixOS/rfcs/pull/132#issuecomment-2013535688 https://github.com/NixOS/rfcs/pull/132#issuecomment-20135356...) Not to sound like a broken record, but if the issue isn't finished as of a few weeks ago, it can hardly be considered to be held up by the Nix author for 5 years. I agree that one of the links in the open letter is to a comment on a PR from 2019, which is indeed 5 year ago, and does indeed contain the Nix author commenting that they are skeptical of the change because "he doesn't know meson but knows his own build system". But given that there's an entire wealth of history on the topic since then, including progress on the feature that appears completely unobstructed by the Nix author and an open PR that is a mere 3 weeks old for a current implementation, I find myself again unconvinced of this rampant bad behavior on the part of the Nix author. And I reiterate again that these complaints are very weak and don't do much to support the open letter at best, and act as contrary evidence at worst. Again there might be other context to be had that is missing, but if one is going to write a massive "open letter" complaining about bad behavior, I expect the links in that letter to point to actual bad behavior, and or provide the relevant context necessary to show how what appears to be normal dissent is a passive aggressive continuation of obstruction. I have to assume the links one provides in an open letter is their strongest evidence, and if this is all the authors have... I am unconvinced.
- ranger_danger 2y ago
  [flagged]
  - bitwize 2y ago
    Yes, and? Is there something I'm missing or is this just arrant bigotry?
    - shrimp_emoji 2y ago
      Dawg, it's a "plural system". If pointing out blatant mental illness is "bigotry" and nothing else to you, you're brainwashed.
      - pxc 2y ago
        Pointing out mental illness in place of actually evaluating and criticizing an argument or behavior on its own terms is prejudicial, ad hominem, etc. Sometimes, it might even be bigoted. mentally ill ≠ incapable of reason mentally ill ≠ unworthy of consideration mentally ill ≠ wrong Regardless of all that, singling out one person associated with a document you don't like and pointing at their microblogging bio is a lazy, crappy way to argue. And it's likely to direct harassment at that person.
        shrimp_emoji 2y ago
        All of this is true. But we love laziness; it saves energy when there's too much information to process. :p That's a bad heuristic in theory but often excellent in practice. If someone is stirring up woke drama to get smart people canceled out of a tech project, I won't listen (because it already screams "misaligned priorities and energy" -- my brain concluded this in its experience over the last 15 years of online culture war). If I learn they're a "plural system", I'll even bother declaring how it's not worth listening in the comments here. I would bet a lot of money that my time and attention is steered well following this lazy heuristic every single time.

by depr 2y ago

tpmoney 2y ago

Of course it's about control, it's in the name "source control". As an outside observer who only has the links provided available as information, I don't have insight into the actual motivations of the people in question, so without speculating beyond what's been presented how do I know the people who want and don't have control are the people that should have control? In light of what we know about how the XZ attack happened, I'm not inclined to look unfavorably on project owners being reluctant about expanding who has access to the projects source control, and certainly not when that reluctance is in the face of a coordinated pressure campaign complaining about a lack of speed. As for the dates, I am talking about this bullet point from the letter, quoted in full: > puck having to remind him multiple times to even read her PR message at > all and think about if he could be mistaken > https://github.com/NixOS/nix/pull/9911#issuecomment-1925207309 https://github.com/NixOS/nix/pull/9911#issuecomment-19252073... > (after eelco ignored the PR for quite a while, also!) Clicking that link takes us to a PR that was opened on 2024-02-02. The initial response from the Nix author comes 7 minutes later. Puck has multiple back and forths with other members Github, but her next interaction with the Nix author comes the next day on 2024-02-03. This is also the first time in the conversation where she "reminds him ... to even read her PR message". There's a second interaction later that same day during which she does similar, but it's worth noting this is pointing to a different message and appears to be less a "reminder to read" and more re-iterating what they feel is their argument against the Nix author's own arguments. Puck then continues to have back and forth with other commenters but as of today, there has been no further comments from the Nix author after 2024-02-03, and no further comments from Puck after 2024-02-08. This hardly to my mind qualifies either as "having to remind him multiple times to even read her PR message at all" or "after eelco ignored the PR for quite a while, also!" So as I said it's a fairly weak claim, and feels more like a "bastard eating crackers" reaction to the PR than an actual showing of poor behavior. As for the "Meson example", I didn't ignore it. As I stated in my comment, I had at that point read two of the referenced discussions in detail, and thus commented on them. I didn't comment in the "Meson example" for the simple reason that I hadn't read it. I have read it now, and equally find it confusing. 1) The claim in the letter is that the proposal has "passed RFC, for five years", yet the RFC itself only appears to have been opened 2022-08-24. It's been a while since grade school for me, and I'll admit COVID has warped all our sense of time, but I'm pretty sure 2022 is not 5 years ago. 2) The first completed working implementation of the change doesn't appear to have been done until 2023-01-18 (https://github.com/NixOS/rfcs/pull/132#issuecomment-1387466118 https://github.com/NixOS/rfcs/pull/132#issuecomment-13874661...). Again this is much less than 5 years old. 3) On 2023-03-20, the author of the PR for this change states: > the RFC has made it past most of the early stages and the current goal is to achieve parity with the current buildsystem before replacing it. (https://github.com/NixOS/rfcs/pull/132#issuecomment-1476843320 https://github.com/NixOS/rfcs/pull/132#issuecomment-14768433...) Again, this doesn't seem to fit at all with the claim that the proposal has "passed RFC, for five years" 4) On 2023-11-01, the Nix author themselves asks for updates on the RFC implementation, an action which doesn't seem congruent with someone who is willy nilly single handedly blocking things and being a disruption to the process. And the author of the PR states: >the main block is actually a lack of free time for the main devs! (https://github.com/NixOS/rfcs/pull/132#issuecomment-1789077089 https://github.com/NixOS/rfcs/pull/132#issuecomment-17890770...) This doesn't seem to point to evidence that the Nix author is single handedly holding up this process. 5) On 2024-03-21 the PR author notes: > currently working on adding support to build nix-perl, waiting for assistance (https://github.com/NixOS/rfcs/pull/132#issuecomment-2013535688 https://github.com/NixOS/rfcs/pull/132#issuecomment-20135356...) Not to sound like a broken record, but if the issue isn't finished as of a few weeks ago, it can hardly be considered to be held up by the Nix author for 5 years. I agree that one of the links in the open letter is to a comment on a PR from 2019, which is indeed 5 year ago, and does indeed contain the Nix author commenting that they are skeptical of the change because "he doesn't know meson but knows his own build system". But given that there's an entire wealth of history on the topic since then, including progress on the feature that appears completely unobstructed by the Nix author and an open PR that is a mere 3 weeks old for a current implementation, I find myself again unconvinced of this rampant bad behavior on the part of the Nix author. And I reiterate again that these complaints are very weak and don't do much to support the open letter at best, and act as contrary evidence at worst. Again there might be other context to be had that is missing, but if one is going to write a massive "open letter" complaining about bad behavior, I expect the links in that letter to point to actual bad behavior, and or provide the relevant context necessary to show how what appears to be normal dissent is a passive aggressive continuation of obstruction. I have to assume the links one provides in an open letter is their strongest evidence, and if this is all the authors have... I am unconvinced.

ranger_danger 2y ago
[flagged]
- bitwize 2y ago
  Yes, and? Is there something I'm missing or is this just arrant bigotry?
  - shrimp_emoji 2y ago
    Dawg, it's a "plural system". If pointing out blatant mental illness is "bigotry" and nothing else to you, you're brainwashed.
    - pxc 2y ago
      Pointing out mental illness in place of actually evaluating and criticizing an argument or behavior on its own terms is prejudicial, ad hominem, etc. Sometimes, it might even be bigoted. mentally ill ≠ incapable of reason mentally ill ≠ unworthy of consideration mentally ill ≠ wrong Regardless of all that, singling out one person associated with a document you don't like and pointing at their microblogging bio is a lazy, crappy way to argue. And it's likely to direct harassment at that person.
      - shrimp_emoji 2y ago
        All of this is true. But we love laziness; it saves energy when there's too much information to process. :p That's a bad heuristic in theory but often excellent in practice. If someone is stirring up woke drama to get smart people canceled out of a tech project, I won't listen (because it already screams "misaligned priorities and energy" -- my brain concluded this in its experience over the last 15 years of online culture war). If I learn they're a "plural system", I'll even bother declaring how it's not worth listening in the comments here. I would bet a lot of money that my time and attention is steered well following this lazy heuristic every single time.