5 ms·

Linux dev quits after "personal attacks" from user over antivirus tool

36 points by bundie 1y ago

stuaxo 1y ago
Respect them not wanting to deal with arseholes. This sounds useful, I'll be building it and having a try.
2OEH8eoCRo0 1y ago
It's basically an open source rite of passage to be harassed by entitled jerk users. I wish people weren't so nasty online.
McDutchie 1y ago
While the developer's decision must be respected, I don't really understand it. Why not simply ban the troll instead of engaging with them in any way? I wouldn't want to give a troll any power or influence at all.
- alephnerd 1y ago
  Based on the thread, they were doxxed by that troll.
  - giancarlostoro 1y ago
    Defamation lawsuit sounds like a perfectly valid avenue if that is the case.
    - alephnerd 1y ago
      Lawyers take effort, time, and difficulty. It's much easier to shut down a project instead. Alternatively, people can instead choose to NOT be dicks to people who are altruistically developing stuff for no compensation and the net benefit of our industry.
      - giancarlostoro 1y ago
        I suspect the person who did this to the maintainer is probably mentally unwell. They likely do this to other people.
- serf 1y ago
  It's still effort. If you have someone shitting up your PRs with personal complaints you can either put the effort in to squelch the opponent or you can just walk away. For unpaid FOSS work there is often very little to be gained except for a bit of self satisfaction and kudos from the community. It's easy to walk away from an ungrateful community if you don't have gold in your pockets to soften the blows.
- Saris 1y ago
  It's easier to walk away sometimes, it takes more effort, more mental energy, more stress to deal with things.
gruez 1y ago
Note that "Linux dev" in this context means "person who develops for linux", not "contributor to linux kernel".
cwassert 1y ago
I think it is a bid problematic that anybody can create an account on github and open issues there (if enabled). No "professional", paid software would allow ordinary users to communicate directly with the programmer. Or allow outsiders to post comments on their products website. Just moving discussions to irc would already filter a lot of spam. As a last resort you could require some kind of proof that you are a maintainer of a bigger distribution. Or something in between.
- chatmasta 1y ago
  While it may not detract from your point, note that the behavior in question did not occur on GitHub but rather on Codeberg.org.
- balamatom 1y ago
  >I think it is a bid problematic that anybody can create an account on github and open issues there (if enabled). I think it's a bit problematic to use GitHub in 2025 if you are doing F/OSS
  - Kuinox 1y ago
    GitHub wasn't used there. It was on Codeberg.
hermannj314 1y ago
The angry, insecure and unwell are over-represented in technical forums. I find I am typically only browsing this site when I am not ready to present the best version of myself (tired, bored, demotivated). I don't know how we end the cycle of cruelty in our industry.
- bbuut 1y ago
  [dead]
- thatgerhard 1y ago
  "The angry, insecure and unwell are over-represented in technical forums." no, they're over-represented on all forums
  - lazyasciiart 1y ago
    This could be more agreeably written as “yes, and”. You are not disagreeing with his statement.
    - tonyedgecombe 1y ago
      Yes, but this is a technical forum ...
  - _DeadFred_ 1y ago
    "The people worth listening to leave, and the ones who can't leave stay and rot the place."
- lovich 1y ago
  > I don't know how we end the cycle of cruelty in our industry. Actually have consequences for it? When industry leaders like Linus act like assholes constantly but are given cover because they produce something so valuable, will always produce a situation where being empathetic becomes a social proxy for being weak or untalented
- John23832 1y ago
riffic 1y ago
when we say "Linux dev" we usually mean kernel development. It'd be nice if the headline reflected the actual project.
exabrial 1y ago
> LoucheBear > Joined on Jul 25, 2025 Probably a paid troll by a state actor would be my guess.
joelesler 1y ago
As the former community manager for ClamAV, there could have been some work done here to correct the situation and make both parties happy. I know ClamAV doesn't want to see third party utilities go away, and it's beneficial to the community for them to exist. Trolls exist, but there are ways to deal with them. I ran ClamAV and Snort for about 15 years, and we had plenty of heat over the years. This could have been avoided.
- kjs3 1y ago
  A single developer doesn't have a 'community manager' to deal with assholes. That said, why would one try to make the troll happy? What reading this results in "they both have a valid point we should address"?
  - joelesler 1y ago
    Im not saying the developer needs to have a community manager. Im saying this could have been handled differently by any number of people. I dont want to point fingers.
  - joelesler 1y ago
    Also, you can’t make a troll happy. But you can redirect them and shut them down.
phendrenad2 1y ago
Now hold on a minute. I'm reading the Codeberg posts, and I think Neowin is getting it wrong. The LoucheBear person seems to be saying that their ClamAV scan is clean without Kapitano, but not clean with Kapitano. Anyone want to grab the flatpak quick, just to see if somehow some malware hitched a ride? Anyway, if I'm reading this right, then these two people are just talking past one another, not understanding what the other is talking about. Off-topic: It's absolutely mad from a security perspective that you can't download flatpaks as a simple bzip file for security analysis.
- red-iron-pine 1y ago
  > Off-topic: It's absolutely mad from a security perspective that you can't download flatpaks as a simple bzip file for security analysis. You can download Flatpak bundles: Flatpak supports exporting apps as .flatpak bundle files, which are single-file archives that can be analyzed offline. These can be created using flatpak build-bundle or downloaded if the distributor provides them. If...
  - phendrenad2 1y ago
    From a security perspective, I don't trust the binary that downloads and installs a package to just download it. Some package installers, such as Bundler, like to run arbitrary code from the package on install. I don't trust that to not be invoked with a simple download. I'd rather use hardened tools like CURL or a web browser. It's just good security hygiene.

36 points by bundie 1y ago

Respect them not wanting to deal with arseholes. This sounds useful, I'll be building it and having a try.

It's basically an open source rite of passage to be harassed by entitled jerk users. I wish people weren't so nasty online.

McDutchie 1y ago

While the developer's decision must be respected, I don't really understand it. Why not simply ban the troll instead of engaging with them in any way? I wouldn't want to give a troll any power or influence at all.

alephnerd 1y ago
Based on the thread, they were doxxed by that troll.
- giancarlostoro 1y ago
  Defamation lawsuit sounds like a perfectly valid avenue if that is the case.
  - alephnerd 1y ago
    Lawyers take effort, time, and difficulty. It's much easier to shut down a project instead. Alternatively, people can instead choose to NOT be dicks to people who are altruistically developing stuff for no compensation and the net benefit of our industry.
    - giancarlostoro 1y ago
      I suspect the person who did this to the maintainer is probably mentally unwell. They likely do this to other people.
serf 1y ago
It's still effort. If you have someone shitting up your PRs with personal complaints you can either put the effort in to squelch the opponent or you can just walk away. For unpaid FOSS work there is often very little to be gained except for a bit of self satisfaction and kudos from the community. It's easy to walk away from an ungrateful community if you don't have gold in your pockets to soften the blows.
Saris 1y ago
It's easier to walk away sometimes, it takes more effort, more mental energy, more stress to deal with things.

gruez 1y ago

Note that "Linux dev" in this context means "person who develops for linux", not "contributor to linux kernel".

cwassert 1y ago

I think it is a bid problematic that anybody can create an account on github and open issues there (if enabled). No "professional", paid software would allow ordinary users to communicate directly with the programmer. Or allow outsiders to post comments on their products website. Just moving discussions to irc would already filter a lot of spam. As a last resort you could require some kind of proof that you are a maintainer of a bigger distribution. Or something in between.

chatmasta 1y ago
While it may not detract from your point, note that the behavior in question did not occur on GitHub but rather on Codeberg.org.
balamatom 1y ago
>I think it is a bid problematic that anybody can create an account on github and open issues there (if enabled). I think it's a bit problematic to use GitHub in 2025 if you are doing F/OSS
- Kuinox 1y ago
  GitHub wasn't used there. It was on Codeberg.

hermannj314 1y ago

The angry, insecure and unwell are over-represented in technical forums. I find I am typically only browsing this site when I am not ready to present the best version of myself (tired, bored, demotivated). I don't know how we end the cycle of cruelty in our industry.

bbuut 1y ago
[dead]
thatgerhard 1y ago
"The angry, insecure and unwell are over-represented in technical forums." no, they're over-represented on all forums
- lazyasciiart 1y ago
  This could be more agreeably written as “yes, and”. You are not disagreeing with his statement.
  - tonyedgecombe 1y ago
    Yes, but this is a technical forum ...
- _DeadFred_ 1y ago
  "The people worth listening to leave, and the ones who can't leave stay and rot the place."
lovich 1y ago
> I don't know how we end the cycle of cruelty in our industry. Actually have consequences for it? When industry leaders like Linus act like assholes constantly but are given cover because they produce something so valuable, will always produce a situation where being empathetic becomes a social proxy for being weak or untalented
John23832 1y ago

riffic 1y ago

when we say "Linux dev" we usually mean kernel development. It'd be nice if the headline reflected the actual project.

exabrial 1y ago

> LoucheBear > Joined on Jul 25, 2025 Probably a paid troll by a state actor would be my guess.

joelesler 1y ago

As the former community manager for ClamAV, there could have been some work done here to correct the situation and make both parties happy. I know ClamAV doesn't want to see third party utilities go away, and it's beneficial to the community for them to exist. Trolls exist, but there are ways to deal with them. I ran ClamAV and Snort for about 15 years, and we had plenty of heat over the years. This could have been avoided.

kjs3 1y ago
A single developer doesn't have a 'community manager' to deal with assholes. That said, why would one try to make the troll happy? What reading this results in "they both have a valid point we should address"?
- joelesler 1y ago
  Im not saying the developer needs to have a community manager. Im saying this could have been handled differently by any number of people. I dont want to point fingers.
- joelesler 1y ago
  Also, you can’t make a troll happy. But you can redirect them and shut them down.

phendrenad2 1y ago

Now hold on a minute. I'm reading the Codeberg posts, and I think Neowin is getting it wrong. The LoucheBear person seems to be saying that their ClamAV scan is clean without Kapitano, but not clean with Kapitano. Anyone want to grab the flatpak quick, just to see if somehow some malware hitched a ride? Anyway, if I'm reading this right, then these two people are just talking past one another, not understanding what the other is talking about. Off-topic: It's absolutely mad from a security perspective that you can't download flatpaks as a simple bzip file for security analysis.

red-iron-pine 1y ago
> Off-topic: It's absolutely mad from a security perspective that you can't download flatpaks as a simple bzip file for security analysis. You can download Flatpak bundles: Flatpak supports exporting apps as .flatpak bundle files, which are single-file archives that can be analyzed offline. These can be created using flatpak build-bundle or downloaded if the distributor provides them. If...
- phendrenad2 1y ago
  From a security perspective, I don't trust the binary that downloads and installs a package to just download it. Some package installers, such as Bundler, like to run arbitrary code from the package on install. I don't trust that to not be invoked with a simple download. I'd rather use hardened tools like CURL or a web browser. It's just good security hygiene.