3 ms·

A recent comment indicates that this outcome was more like a mistake and less line the skulduggery that the title indicates. Public shaming might be a good too

A recent comment indicates that this outcome was more like a mistake and less line the skulduggery that the title indicates. Public shaming might be a good tool for this kind of thing in general but maybe in this case it was premature.

__MatrixMan__ 2y ago
Also let's please be careful about creating situations that pressure a maintainer to merge a PR before they're fully comfortable with it. That's how ssh got backdoored via xz (no reason to believe that that's what's happening here). If somebody wants to embrace YOLO with their $$ project and be a bit more cautious with their OSS project, that's ok.
- ironmagma 2y ago
  Didn’t xz get backdoored through extreme cunning and an exhausted solo maintainer?
  - __MatrixMan__ 2y ago
    Yes but the exhaustion was not 100% organic. There was a bit of social engineering towards wearing the maintainer down even further. I'm just pointing it out because I think it's going to be a tricky balance to strike. How can we, as a community of people who care about free and/or open source software tell the difference between: - a good faith effort to inform the wider community of a maintainer who is behaving badly - a bad-faith contributor pressuring an overworked maintainer to include a malicious commit I think you're the former, but I'm rather worried about the latter. And I'm interested in strategies for telling the two apart.
    - ironmagma 2y ago
      I’m actually neither. I’m a big fan of forks. If something isn’t working out well, it should be very easy to create a fork and switch to the fork (i.e. forks should be lightweight just like branches). We can’t rely on everyone to follow our schedules, so if there’s a desire we should take the lead on getting it done instead of dragging each other down. As such, I didn’t post this to shame anyone, mostly to provide an onus for switching to a fork. (Or I should say, another onus, since there are already a few reasons to not contribute to Gitea, mostly coming down to size of the project and inertia preventing refactors or redesigns.)
      - __MatrixMan__ 2y ago
        That's a very reasonable position to have, sorry for jumping to conclusions :)
- TiredOfLife 2y ago
  xz was not maintained by for profit corporation.
techknowlogick 2y ago
Hi, yes. That was me. I'm dealing with some health things and wasn't able to do much until recently, and I am working on continuing that conversation.

__MatrixMan__ 2y ago

Also let's please be careful about creating situations that pressure a maintainer to merge a PR before they're fully comfortable with it. That's how ssh got backdoored via xz (no reason to believe that that's what's happening here). If somebody wants to embrace YOLO with their $$ project and be a bit more cautious with their OSS project, that's ok.

ironmagma 2y ago
Didn’t xz get backdoored through extreme cunning and an exhausted solo maintainer?
- __MatrixMan__ 2y ago
  Yes but the exhaustion was not 100% organic. There was a bit of social engineering towards wearing the maintainer down even further. I'm just pointing it out because I think it's going to be a tricky balance to strike. How can we, as a community of people who care about free and/or open source software tell the difference between: - a good faith effort to inform the wider community of a maintainer who is behaving badly - a bad-faith contributor pressuring an overworked maintainer to include a malicious commit I think you're the former, but I'm rather worried about the latter. And I'm interested in strategies for telling the two apart.
  - ironmagma 2y ago
    I’m actually neither. I’m a big fan of forks. If something isn’t working out well, it should be very easy to create a fork and switch to the fork (i.e. forks should be lightweight just like branches). We can’t rely on everyone to follow our schedules, so if there’s a desire we should take the lead on getting it done instead of dragging each other down. As such, I didn’t post this to shame anyone, mostly to provide an onus for switching to a fork. (Or I should say, another onus, since there are already a few reasons to not contribute to Gitea, mostly coming down to size of the project and inertia preventing refactors or redesigns.)
    - __MatrixMan__ 2y ago
      That's a very reasonable position to have, sorry for jumping to conclusions :)
TiredOfLife 2y ago
xz was not maintained by for profit corporation.

techknowlogick 2y ago

Hi, yes. That was me. I'm dealing with some health things and wasn't able to do much until recently, and I am working on continuing that conversation.