4 ms·

So now you can disregard the notion of "private function" if you pass 100k stars on GitHub ?

by IMTDb 1y ago

ruined 1y ago
all APIs are public APIs
- NetMageSCW 1y ago
  Only if you don’t care about your users or your apps reputation. Of course, if you are using Electron those ships have already sailed.
javawizard 1y ago
There's definitely a line of thinking that would say "yes": https://www.hyrumslaw.com/ https://www.hyrumslaw.com/
- 0x457 1y ago
  Sure, someone will depend on it, we all ignored "private" vs "public" at least once. Okay to do and okay to be mad when your thing breaks because you decided to depend on it? Nope.
  - Dylan16807 1y ago
    Okay to be mad the OS vendor didn't do anything to help when the users are the ones that face the fallout? Yes. Even if you disqualify the devs from being mad, everyone else gets to be mad.
    - 0x457 1y ago
      Vendor did help...marked function as private. I view this specific incident as another argument against electron, so I'm biased.
      - Dylan16807 1y ago
        That's a good initial step. But once it got put on a zillion computers, there should have been additional mitigation steps. In an ideal situation, they would have noticed the widespread use of this private function a long time ago, put a note on the bug report that it works around, and after they fixed the bug they would have reached out to electron to have them remove that access.
        javawizard 1y ago
        Exactly. As they say: if you owe the bank $100, that's your problem; if you owe the bank $100 million, that's the bank's problem.
        0x457 1y ago
        No? Developers had access to _developer_ preview builds on macOS to test their apps. Those builds are meant for this.
        javawizard 1y ago
        That's not what that quote is about. If you owe the bank $100 and don't pay, that's your problem: you'll get in trouble for it, and the bank isn't going to be unduly harmed. If you owe the bank $100 million and don't pay, that's the bank's problem: the loss of that $100 million is going to hit the bank hard, whether or not they're the ones who are in the right and regardless of how much trouble you get in over it. Likewise, if you're a small time app developer and you use a private method that gets yanked and your app breaks, that's your problem: your users are going to be pissed at you, you'll take the reputational damage, and even if your users are also pissed at the OS vendor they represent such a small group of individuals that the OS vendor isn't going to be unduly harmed by that. If, on the other hand, you develop one of the most widely used frameworks and you use a private method that gets yanked and your app breaks, that's the OS vendor's problem: the number of people who are pissed off at them (rightly or wrongly) is now much larger and they're going to take some reputational damage over it, whether or not they're the ones who have the moral high ground and regardless of how much reputational damage you also take. And that's exactly what we're seeing here: it doesn't matter that Electron used an API they weren't supposed to, people are pissed at Apple about this and Apple, rightly or wrongly, has to contend with that reputational damage if they don't take steps to prevent this sort of thing before it happens (like letting the developers know that private-on-paper API is going to be yanked in advance, or making it mechanically impossible for anyone outside of Apple's own code to invoke that API long before someone depends on it).

So now you can disregard the notion of "private function" if you pass 100k stars on GitHub ?

by IMTDb 1y ago

So now you can disregard the notion of "private function" if you pass 100k stars on GitHub ?

ruined 1y ago

all APIs are public APIs

NetMageSCW 1y ago
Only if you don’t care about your users or your apps reputation. Of course, if you are using Electron those ships have already sailed.

javawizard 1y ago

There's definitely a line of thinking that would say "yes": https://www.hyrumslaw.com/ https://www.hyrumslaw.com/

0x457 1y ago
Sure, someone will depend on it, we all ignored "private" vs "public" at least once. Okay to do and okay to be mad when your thing breaks because you decided to depend on it? Nope.
- Dylan16807 1y ago
  Okay to be mad the OS vendor didn't do anything to help when the users are the ones that face the fallout? Yes. Even if you disqualify the devs from being mad, everyone else gets to be mad.
  - 0x457 1y ago
    Vendor did help...marked function as private. I view this specific incident as another argument against electron, so I'm biased.
    - Dylan16807 1y ago
      That's a good initial step. But once it got put on a zillion computers, there should have been additional mitigation steps. In an ideal situation, they would have noticed the widespread use of this private function a long time ago, put a note on the bug report that it works around, and after they fixed the bug they would have reached out to electron to have them remove that access.
      - javawizard 1y ago
        Exactly. As they say: if you owe the bank $100, that's your problem; if you owe the bank $100 million, that's the bank's problem.
        0x457 1y ago
        No? Developers had access to _developer_ preview builds on macOS to test their apps. Those builds are meant for this.
        javawizard 1y ago
        That's not what that quote is about. If you owe the bank $100 and don't pay, that's your problem: you'll get in trouble for it, and the bank isn't going to be unduly harmed. If you owe the bank $100 million and don't pay, that's the bank's problem: the loss of that $100 million is going to hit the bank hard, whether or not they're the ones who are in the right and regardless of how much trouble you get in over it. Likewise, if you're a small time app developer and you use a private method that gets yanked and your app breaks, that's your problem: your users are going to be pissed at you, you'll take the reputational damage, and even if your users are also pissed at the OS vendor they represent such a small group of individuals that the OS vendor isn't going to be unduly harmed by that. If, on the other hand, you develop one of the most widely used frameworks and you use a private method that gets yanked and your app breaks, that's the OS vendor's problem: the number of people who are pissed off at them (rightly or wrongly) is now much larger and they're going to take some reputational damage over it, whether or not they're the ones who have the moral high ground and regardless of how much reputational damage you also take. And that's exactly what we're seeing here: it doesn't matter that Electron used an API they weren't supposed to, people are pissed at Apple about this and Apple, rightly or wrongly, has to contend with that reputational damage if they don't take steps to prevent this sort of thing before it happens (like letting the developers know that private-on-paper API is going to be yanked in advance, or making it mechanically impossible for anyone outside of Apple's own code to invoke that API long before someone depends on it).