3 ms·

Looking at the replies here, I am not even sure how to react, it seems this community overall is going into a sad direction that just blames instead of trying t

Looking at the replies here, I am not even sure how to react, it seems this community overall is going into a sad direction that just blames instead of trying to think of solutions. Most of them are just entitled and aggressive for absolutely no reason. It's perfectly fine to want to switch, or try something else, but to think other projects couldn't have issues is just naive to say it gently.

lpapez 2y ago
I think that goes for society as a whole. We should all be more emphatic and considerate. Especially around things like this - it's not the end of the world. Software is difficult and shit happens all of the time, give the maintainers a break...
- nozzlegear 2y ago
  > We should all be more emphatic and considerate. I'm sure it was just autocorrect being a nuisance, but you probably mean empathic.
kevingadd 2y ago
The developer of iTerm2 has a thankless job to be sure, but the reality is that when you build this kind of software you have a certain responsibility to be thoughtful and cautious and not indirectly cause harm to others. Security vulnerabilities like this can cause actual harm, so it's understandable that people see someone fail to live up to the responsibility and they get mad. There aren't easy solutions to having responsibility. All you can do is live up to it, which sometimes means you need to apply rigor and processes that make hacking less fun, or that you need to make compromises you don't like. "to think other projects couldn't have issues is just naive" is the wrong way to look at it. You should evaluate the processes that lead to the binary (or source tarball) that you're running on your machine. Is every commit/PR being reviewed by someone other than the author? By multiple someones, ideally? Do they run automated test suites before shipping?
- rswail 2y ago
  I can tell you that the commercial software that you use is unlikely to be living up to the unachievable standards that are being demanded in this thread. In this case, the person is a solo developer, so who exactly should be reviewing the PRs? I trust this developer because they have a long history of delivering quality software, with quick turnaround on bugs in general, and even faster on security related bugs like this one. His "responsibility" is to maintain the trust that he will develop to the best of his ability and will react quickly to issues. The so-called "rigor and processes" in current SW engineering are nonsense and busy work. Not once in my 40 years of SW development has a code review revealed a major bug that wasn't some sort of developer brain fart. Maybe the actual security issue here is that a) /tmp is world read/writeable on many Unix/Linux VMs/machines, and b) you should lock down your SSH connections so that they don't have access to it. Stop blaming the other person's software and look at your own security "rigor and processes".
  - kevingadd 2y ago
    What part of my post said the solution is commercial software? If I understand the security vulnerability correctly here, what happened is a well-meaning and skilled engineer accidentally checked in debugging code and shipped it in multiple releases. This shouldn't happen if people are reviewing your PRs and if you're being cautious about what you ship. If nobody else is reviewing the iTerm2 code that means the developer isn't getting the support he needs from the community, which is a shame. The general tone of your comment is confusing though since it seems you're suggesting the solution to iTerm2 shipping a major security vulnerability is to just assume every piece of software is broken, instead of come up with ways to develop and ship more secure software. Are you really comfortable with every part of the software stack you use - firmware, OS kernel, libc, userspace - meeting this non-standard and being full of holes? Do you want to spend hours every day chasing down the latest vulnerability report? If your experience with code review is that it never catches anything, either you're the greatest programmer in human history who never makes mistakes, or the people doing your code reviews aren't trying. I participate in open source code reviews on a daily basis against multiple repositories and we catch bugs/oversights in each others' work all the time.
mardifoufs 2y ago
I agree that this isn't really something I'd switch over on its own, but what entitlement are you talking about? How is discussing not using an app or switching to something else... entitlement? I reread the whole thread and I couldn't find anything that felt like entitlement tbh...
- freehorse 2y ago
  I think it is fair to realise that the risks that come with using a third party terminal emulator do not outweight the pros of having some of its features for your usecase. But a lot of comments here are outright aggressive for no real reason.
- trymas 2y ago
  Firstly, iterm2 is open source software (free as in beer and as in speech) and comes with no warranties. Secondly, solo developer of iterm has excellent reputation from my point of view. History of his work on this project is something to strive for any developer and seems that always acts in (very) good faith while releasing software and replying to issues in threads. https://news.ycombinator.com/item?id=42582206 https://news.ycombinator.com/item?id=42582206 - entitled for what features should exist or not in open source software. Also that feature was opt-in as far as I am aware. (EDIT: this user is also new and commented only on this post, with karma in the negative) https://news.ycombinator.com/item?id=42581350 https://news.ycombinator.com/item?id=42581350 - entitled to how solo FOSS developer should act and write a critical update release response, with hints that said developer may not act in good faith. https://news.ycombinator.com/item?id=42579595 https://news.ycombinator.com/item?id=42579595 - again entitled to what (or how many) features FOSS application should or shouldn’t have. Ironically also complains with entitled attitude that another FOSS software doesn’t have enough feature development. There’s more, but obviously it’s subjective to reader’s interpretation. There were couple comments with attitude - that the developer shouldn’t be allowed to touch software ever again, but either I have missed them or they have deleted their comments.
  - soraminazuki 2y ago
    > There were couple comments with attitude - that the developer shouldn’t be allowed to touch software ever again, but either I have missed them or they have deleted their comments. It was too offensive and got flagged. Worse, the commenter doubled down instead of taking it back, I'm afraid. https://news.ycombinator.com/item?id=42581359 https://news.ycombinator.com/item?id=42581359
soheil 2y ago
Nailed it - entitled captures it accurately. I've been on HN since 2011 and it has never been this hostile, unhelpful and flat out arrogant.
deleted 2y ago
[deleted]

lpapez 2y ago

I think that goes for society as a whole. We should all be more emphatic and considerate. Especially around things like this - it's not the end of the world. Software is difficult and shit happens all of the time, give the maintainers a break...

nozzlegear 2y ago
> We should all be more emphatic and considerate. I'm sure it was just autocorrect being a nuisance, but you probably mean empathic.

kevingadd 2y ago

The developer of iTerm2 has a thankless job to be sure, but the reality is that when you build this kind of software you have a certain responsibility to be thoughtful and cautious and not indirectly cause harm to others. Security vulnerabilities like this can cause actual harm, so it's understandable that people see someone fail to live up to the responsibility and they get mad. There aren't easy solutions to having responsibility. All you can do is live up to it, which sometimes means you need to apply rigor and processes that make hacking less fun, or that you need to make compromises you don't like. "to think other projects couldn't have issues is just naive" is the wrong way to look at it. You should evaluate the processes that lead to the binary (or source tarball) that you're running on your machine. Is every commit/PR being reviewed by someone other than the author? By multiple someones, ideally? Do they run automated test suites before shipping?

rswail 2y ago
I can tell you that the commercial software that you use is unlikely to be living up to the unachievable standards that are being demanded in this thread. In this case, the person is a solo developer, so who exactly should be reviewing the PRs? I trust this developer because they have a long history of delivering quality software, with quick turnaround on bugs in general, and even faster on security related bugs like this one. His "responsibility" is to maintain the trust that he will develop to the best of his ability and will react quickly to issues. The so-called "rigor and processes" in current SW engineering are nonsense and busy work. Not once in my 40 years of SW development has a code review revealed a major bug that wasn't some sort of developer brain fart. Maybe the actual security issue here is that a) /tmp is world read/writeable on many Unix/Linux VMs/machines, and b) you should lock down your SSH connections so that they don't have access to it. Stop blaming the other person's software and look at your own security "rigor and processes".
- kevingadd 2y ago
  What part of my post said the solution is commercial software? If I understand the security vulnerability correctly here, what happened is a well-meaning and skilled engineer accidentally checked in debugging code and shipped it in multiple releases. This shouldn't happen if people are reviewing your PRs and if you're being cautious about what you ship. If nobody else is reviewing the iTerm2 code that means the developer isn't getting the support he needs from the community, which is a shame. The general tone of your comment is confusing though since it seems you're suggesting the solution to iTerm2 shipping a major security vulnerability is to just assume every piece of software is broken, instead of come up with ways to develop and ship more secure software. Are you really comfortable with every part of the software stack you use - firmware, OS kernel, libc, userspace - meeting this non-standard and being full of holes? Do you want to spend hours every day chasing down the latest vulnerability report? If your experience with code review is that it never catches anything, either you're the greatest programmer in human history who never makes mistakes, or the people doing your code reviews aren't trying. I participate in open source code reviews on a daily basis against multiple repositories and we catch bugs/oversights in each others' work all the time.

mardifoufs 2y ago

I agree that this isn't really something I'd switch over on its own, but what entitlement are you talking about? How is discussing not using an app or switching to something else... entitlement? I reread the whole thread and I couldn't find anything that felt like entitlement tbh...

freehorse 2y ago
I think it is fair to realise that the risks that come with using a third party terminal emulator do not outweight the pros of having some of its features for your usecase. But a lot of comments here are outright aggressive for no real reason.
trymas 2y ago
Firstly, iterm2 is open source software (free as in beer and as in speech) and comes with no warranties. Secondly, solo developer of iterm has excellent reputation from my point of view. History of his work on this project is something to strive for any developer and seems that always acts in (very) good faith while releasing software and replying to issues in threads. https://news.ycombinator.com/item?id=42582206 https://news.ycombinator.com/item?id=42582206 - entitled for what features should exist or not in open source software. Also that feature was opt-in as far as I am aware. (EDIT: this user is also new and commented only on this post, with karma in the negative) https://news.ycombinator.com/item?id=42581350 https://news.ycombinator.com/item?id=42581350 - entitled to how solo FOSS developer should act and write a critical update release response, with hints that said developer may not act in good faith. https://news.ycombinator.com/item?id=42579595 https://news.ycombinator.com/item?id=42579595 - again entitled to what (or how many) features FOSS application should or shouldn’t have. Ironically also complains with entitled attitude that another FOSS software doesn’t have enough feature development. There’s more, but obviously it’s subjective to reader’s interpretation. There were couple comments with attitude - that the developer shouldn’t be allowed to touch software ever again, but either I have missed them or they have deleted their comments.
- soraminazuki 2y ago
  > There were couple comments with attitude - that the developer shouldn’t be allowed to touch software ever again, but either I have missed them or they have deleted their comments. It was too offensive and got flagged. Worse, the commenter doubled down instead of taking it back, I'm afraid. https://news.ycombinator.com/item?id=42581359 https://news.ycombinator.com/item?id=42581359

soheil 2y ago

Nailed it - entitled captures it accurately. I've been on HN since 2011 and it has never been this hostile, unhelpful and flat out arrogant.

deleted 2y ago

[deleted]