2 ms·

Your choice of language in your comments (in this thread, not in general) isn’t bolstering your argument. Why not be curious rather than just dismissive? This

by xpe 2y ago

Your choice of language in your comments (in this thread, not in general) isn’t bolstering your argument. Why not be curious rather than just dismissive? This seems to be people just talking past each other at this point. There have been a lot of changes in the last ~five years that point in the direction of supply chain security being at greater risk. Evidence comes in many forms. The relevance of evidence depends on what part of the problem you are looking at. Also, it is rational to talk about the probability by which different evidence is likely to be surfaced! I think it is possible you are sensitive to people making such claims for self-interested purposes. Fair? But I don’t think it’s fair to assume that of commenters here.

arp242 2y ago
> Your choice of language in your comments (in this thread, not in general) isn’t bolstering your argument. Yeah, you're probably not wrong. I've had this argument a few times now, and it's the same dismissive "we don't know what we don't know" every time. Well, you can say that for everything and given the complexities of the xz attack that seems a bit unlikely to me, which is then again countered with "but we don't know!!11" "Every contributor is dangerous" is spectacularly toxic type of attitude. I've already seen random people be made a target and even had their employers contacted over this before they even had a chance to explain(!!) To say nothing of "there are many ways to compromise existing maintainers. Compromising people is the core competency of intelligence, happens all the time" – so great, now I'm also potentially dangerous after spending untold hours and money over the last 20 years because I could be compromised. Great. This was never a nuanced conversation about risk management to start with. This is not the type of community I've worked for all this time. "Let's use some common-sense tech so this isn't that easy". Sure, let's talk about that. "Let's treat every volunteer involved as potentially hostile and compromised after we've seen a single incident"? Yeah, nah.
- xpe 2y ago
  Thanks for your thoughtful reply. > "Every contributor is dangerous" is spectacularly toxic type of attitude. I view this from the lens of "How well can people reason about probabilities?" and research has shown, more or less, "not very well". In the short term, therefore, it is wise to tailor communications so as to avoid predictable irrational reactions. In the medium term, we need to _show_ people how to think about these questions rationally, meaning probabilistically. For what it is worth, I prefer to avoid using the phrase "common sense", as it invites so many failure modes of thinking. My current attitude is, more or less, "let's put aside generalizations and start talking about probabilities and threat models". This will give us a model that makes _probabilistic predictions_. Models, done well, serve as concrete artifacts we can critique and improve _together_. I hope to see some responses to my other comment at https://news.ycombinator.com/item?id=40271146 https://news.ycombinator.com/item?id=40271146 but I admit it takes more effort to share a model. It is well outside the usual interaction pattern here on HN to make a comment with a testable prediction, much less a model for them! Happily, there are online fora that support such norms and expectations, such as LessWrong. But I haven't given up hope on HN, as it seems like many people have the mindset. I think the social interaction pattern here squanders a lot of that individual intelligence, unfortunately... but that pattern can change in a bottom-up fashion as people (more or less) demand, at the very least, clearer explanations.
  - arp242 2y ago
    In the end you can never fully trust anyone, including yourself. This has always been true for anything: people get drunk, have psychotic episodes or have other mental health issues, things like that. It happens. Remember that Malaysian pilot flying the passenger plane in the ocean? Every pilot in the world will agree that we need to think about risk management to prevent that sort of thing. I think a lot of them will have issues if we start saying things like "every pilot is dangerous" and (in a follow-up) "long-term good faith pilots are maybe even more dangerous than new maintainers". Then you've gone from "risk management" to just throwing shade.
    - xpe 2y ago
      I don't disagree. But my follow-up response is "don't leave it there; factor that into the probability tree". What should professionals in cybersecurity do? (Not my field, so I could be off-target here) My recommendation: communicate a risk model [1], encourage people to update it for their situation, and demand that people act on it [2]. Not too different from what the field of cybersecurity recommends now. (Or am I wrong?) [1] based on a set of attack trees (right?) [2] based on the logic that if you get pwned, you become a zombie to attack me
- xpe 2y ago
  > This was never a nuanced conversation about risk management to start with. This is not the type of community I've worked for all this time. I'm not quite following the second sentence. What kind of community have you worked for? Do you mean "worked for" as in e.g. "the spirit of your comments on HN"? Or something else?
  - ang_cire 2y ago
    I think they are using community to refer to F/OSS projects as a monolithic entity, rather than a million separate and often competing and disagreeing fiefdoms that have always had issues with toxic assholes worming their way into too much power.
    - arp242 2y ago
      Communities are rarely monolithic; but do tend to have some vague set of shared ideas and values (even if there's ton of internal disagreement). But yes, that's what I meant, roughly.

by xpe 2y ago

arp242 2y ago

> Your choice of language in your comments (in this thread, not in general) isn’t bolstering your argument. Yeah, you're probably not wrong. I've had this argument a few times now, and it's the same dismissive "we don't know what we don't know" every time. Well, you can say that for everything and given the complexities of the xz attack that seems a bit unlikely to me, which is then again countered with "but we don't know!!11" "Every contributor is dangerous" is spectacularly toxic type of attitude. I've already seen random people be made a target and even had their employers contacted over this before they even had a chance to explain(!!) To say nothing of "there are many ways to compromise existing maintainers. Compromising people is the core competency of intelligence, happens all the time" – so great, now I'm also potentially dangerous after spending untold hours and money over the last 20 years because I could be compromised. Great. This was never a nuanced conversation about risk management to start with. This is not the type of community I've worked for all this time. "Let's use some common-sense tech so this isn't that easy". Sure, let's talk about that. "Let's treat every volunteer involved as potentially hostile and compromised after we've seen a single incident"? Yeah, nah.

xpe 2y ago
Thanks for your thoughtful reply. > "Every contributor is dangerous" is spectacularly toxic type of attitude. I view this from the lens of "How well can people reason about probabilities?" and research has shown, more or less, "not very well". In the short term, therefore, it is wise to tailor communications so as to avoid predictable irrational reactions. In the medium term, we need to _show_ people how to think about these questions rationally, meaning probabilistically. For what it is worth, I prefer to avoid using the phrase "common sense", as it invites so many failure modes of thinking. My current attitude is, more or less, "let's put aside generalizations and start talking about probabilities and threat models". This will give us a model that makes _probabilistic predictions_. Models, done well, serve as concrete artifacts we can critique and improve _together_. I hope to see some responses to my other comment at https://news.ycombinator.com/item?id=40271146 https://news.ycombinator.com/item?id=40271146 but I admit it takes more effort to share a model. It is well outside the usual interaction pattern here on HN to make a comment with a testable prediction, much less a model for them! Happily, there are online fora that support such norms and expectations, such as LessWrong. But I haven't given up hope on HN, as it seems like many people have the mindset. I think the social interaction pattern here squanders a lot of that individual intelligence, unfortunately... but that pattern can change in a bottom-up fashion as people (more or less) demand, at the very least, clearer explanations.
- arp242 2y ago
  In the end you can never fully trust anyone, including yourself. This has always been true for anything: people get drunk, have psychotic episodes or have other mental health issues, things like that. It happens. Remember that Malaysian pilot flying the passenger plane in the ocean? Every pilot in the world will agree that we need to think about risk management to prevent that sort of thing. I think a lot of them will have issues if we start saying things like "every pilot is dangerous" and (in a follow-up) "long-term good faith pilots are maybe even more dangerous than new maintainers". Then you've gone from "risk management" to just throwing shade.
  - xpe 2y ago
    I don't disagree. But my follow-up response is "don't leave it there; factor that into the probability tree". What should professionals in cybersecurity do? (Not my field, so I could be off-target here) My recommendation: communicate a risk model [1], encourage people to update it for their situation, and demand that people act on it [2]. Not too different from what the field of cybersecurity recommends now. (Or am I wrong?) [1] based on a set of attack trees (right?) [2] based on the logic that if you get pwned, you become a zombie to attack me
xpe 2y ago
> This was never a nuanced conversation about risk management to start with. This is not the type of community I've worked for all this time. I'm not quite following the second sentence. What kind of community have you worked for? Do you mean "worked for" as in e.g. "the spirit of your comments on HN"? Or something else?
- ang_cire 2y ago
  I think they are using community to refer to F/OSS projects as a monolithic entity, rather than a million separate and often competing and disagreeing fiefdoms that have always had issues with toxic assholes worming their way into too much power.
  - arp242 2y ago
    Communities are rarely monolithic; but do tend to have some vague set of shared ideas and values (even if there's ton of internal disagreement). But yes, that's what I meant, roughly.