4 ms·

Would you hire a well known electrician who was not bonded and insured? Sometimes it's nice to know there is more than blind trust.

saagarjha 2y ago
Would you hire Electroboom?
- kadoban 2y ago
  Probably not, he might zap himself for a gag and scare the crap out of me.
  - lyu07282 2y ago
    and then he teaches you about safety around a thousand times more effectively afterward <3
- deleted 2y ago
  [deleted]
123pie123 2y ago
It's FOSS, you're more than welcome to inspect the code yourself
- Klonoar 2y ago
  They may not want to do that, just like they may not want to fix their own electrical issues. You’re sidestepping their point of professionalism and attempting to shove in something else.
  - fsflover 2y ago
    The FLOSS license allows you to rely on the community for the verification.
    - Klonoar 2y ago
      You are, once again, sidestepping their point. They are saying they want a verified authority, not "the community".
      - rollcat 2y ago
        You're already running this on top of Linux. You're already relying on community support, unless you got scammed by Canonical[1] or RedHat^W IBM[2]. [1]: https://utcc.utoronto.ca/~cks/space/blog/linux/Ubuntu2404BpftraceBadPackage https://utcc.utoronto.ca/~cks/space/blog/linux/Ubuntu2404Bpf... [2]: https://en.wikipedia.org/wiki/Dehomag https://en.wikipedia.org/wiki/Dehomag
        Dylan16807 2y ago
        This isn't about support, this is about trusting the download. If I get Ubuntu or Debian or download the mainline kernel, I'm trusting specific entities. That's very different from a vague idea that it's open source and hopefully someone checked if this particular random guy on github is putting out legitimate builds.
        bsimpson 2y ago
        As I recall, studies have looked into this, and the bystander effect in open source is very real. "You can view the source on GitHub" is very different than "A knowledgable person has audited the millions of lines of source code and confirmed that nobody added anything shady or stupid." People often don't take the time to comprehend all the source of the things they depend on, especially for large dependencies and/or prototyping-scale projects.
        pessimizer 2y ago
        > the bystander effect in open source is very real. Outside of open source, it was a NYT excuse for the NYPD failing to save Kitty Genovese. The number of witnesses was greatly exaggerated, and the police were called at least once. I don't think you mean to refer to the bystander effect, because the bystander effect says that the likelihood of intervention goes down as the number of bystanders goes up. You don't seem to be arguing that people are less likely to look at the source because the source is available to more people. More just claiming that people don't look at the source as often as you would like? That open source isn't always perfectly bug and backdoor free? Because I don't know if: > "A knowledgable person has audited the millions of lines of source code and confirmed that nobody added anything shady or stupid." Has been claimed about many large pieces of software, proprietary or not.
- alexvitkov 2y ago
  Alright, just give me 5 minutes to quickly inspect the likely over 100,000,000 lines of code that either go directly into a ROM or are part of the build tooling, and reverse engineer however many binary blobs are involved in the process. The "you can just read the code" mindset is completely unrealistic, even for software that's orders of magnitudes smaller. If the issue at hand is entering my Google password, I'd rather do it in a ROM built by Google.
  - LargoLasskhyfv 2y ago
    Use some LLM which is good at understanding code/coding, maybe supervised by one which is good at reasoning.
yjftsjthsd-h 2y ago
Let's assume you have a ROM straight from Google, and they've actually given you some meaningful promise to support it. How exactly are you running it? Because I'm quite confident that waydroid isn't "bonded and insured", and I rather doubt you're running on top of an operating system that is. So it seems like an odd sticking point.
- deleted 2y ago
  [deleted]
realusername 2y ago
There's no phone on earth which runs AOSP so it's the same on a real phone, you put a blind trust on the phone manufacturer.
lotharcable2 2y ago
What software are you using that has a parent company that pays out damages to you if it fails? Because that is the purpose of 'bonded and insured'. I haven't looked at every EULA and license of every piece of software I use, but I bet that "without warranty" clauses are part of every single one of them.
powersnail 2y ago
Different industries have different standard procedures. A huge portion of the world's internet relies on FOSS software, and none of those are insured. Community reputation is the current _de facto_ standard for consumer-facing software, even for stuff sold by big corporations. There's not much else to rely on.

saagarjha 2y ago

Would you hire Electroboom?

kadoban 2y ago
Probably not, he might zap himself for a gag and scare the crap out of me.
- lyu07282 2y ago
  and then he teaches you about safety around a thousand times more effectively afterward <3
deleted 2y ago
[deleted]

123pie123 2y ago

It's FOSS, you're more than welcome to inspect the code yourself

Klonoar 2y ago
They may not want to do that, just like they may not want to fix their own electrical issues. You’re sidestepping their point of professionalism and attempting to shove in something else.
- fsflover 2y ago
  The FLOSS license allows you to rely on the community for the verification.
  - Klonoar 2y ago
    You are, once again, sidestepping their point. They are saying they want a verified authority, not "the community".
    - rollcat 2y ago
      You're already running this on top of Linux. You're already relying on community support, unless you got scammed by Canonical[1] or RedHat^W IBM[2]. [1]: https://utcc.utoronto.ca/~cks/space/blog/linux/Ubuntu2404BpftraceBadPackage https://utcc.utoronto.ca/~cks/space/blog/linux/Ubuntu2404Bpf... [2]: https://en.wikipedia.org/wiki/Dehomag https://en.wikipedia.org/wiki/Dehomag
      - Dylan16807 2y ago
        This isn't about support, this is about trusting the download. If I get Ubuntu or Debian or download the mainline kernel, I'm trusting specific entities. That's very different from a vague idea that it's open source and hopefully someone checked if this particular random guy on github is putting out legitimate builds.
        bsimpson 2y ago
        As I recall, studies have looked into this, and the bystander effect in open source is very real. "You can view the source on GitHub" is very different than "A knowledgable person has audited the millions of lines of source code and confirmed that nobody added anything shady or stupid." People often don't take the time to comprehend all the source of the things they depend on, especially for large dependencies and/or prototyping-scale projects.
        pessimizer 2y ago
        > the bystander effect in open source is very real. Outside of open source, it was a NYT excuse for the NYPD failing to save Kitty Genovese. The number of witnesses was greatly exaggerated, and the police were called at least once. I don't think you mean to refer to the bystander effect, because the bystander effect says that the likelihood of intervention goes down as the number of bystanders goes up. You don't seem to be arguing that people are less likely to look at the source because the source is available to more people. More just claiming that people don't look at the source as often as you would like? That open source isn't always perfectly bug and backdoor free? Because I don't know if: > "A knowledgable person has audited the millions of lines of source code and confirmed that nobody added anything shady or stupid." Has been claimed about many large pieces of software, proprietary or not.
alexvitkov 2y ago
Alright, just give me 5 minutes to quickly inspect the likely over 100,000,000 lines of code that either go directly into a ROM or are part of the build tooling, and reverse engineer however many binary blobs are involved in the process. The "you can just read the code" mindset is completely unrealistic, even for software that's orders of magnitudes smaller. If the issue at hand is entering my Google password, I'd rather do it in a ROM built by Google.
- LargoLasskhyfv 2y ago
  Use some LLM which is good at understanding code/coding, maybe supervised by one which is good at reasoning.

yjftsjthsd-h 2y ago

Let's assume you have a ROM straight from Google, and they've actually given you some meaningful promise to support it. How exactly are you running it? Because I'm quite confident that waydroid isn't "bonded and insured", and I rather doubt you're running on top of an operating system that is. So it seems like an odd sticking point.

deleted 2y ago
[deleted]

realusername 2y ago

There's no phone on earth which runs AOSP so it's the same on a real phone, you put a blind trust on the phone manufacturer.

lotharcable2 2y ago

What software are you using that has a parent company that pays out damages to you if it fails? Because that is the purpose of 'bonded and insured'. I haven't looked at every EULA and license of every piece of software I use, but I bet that "without warranty" clauses are part of every single one of them.

powersnail 2y ago

Different industries have different standard procedures. A huge portion of the world's internet relies on FOSS software, and none of those are insured. Community reputation is the current _de facto_ standard for consumer-facing software, even for stuff sold by big corporations. There's not much else to rely on.