3 ms·

We do take security reports very seriously, when they were brought to the project repo: https://github.com/docker/docker/issues/9719 https://github.com/docker/d

by shykes 12y ago

We do take security reports very seriously, when they were brought to the project repo: https://github.com/docker/docker/issues/9719 https://github.com/docker/docker/issues/9719 If you are looking to gauge our reaction to legitimate criticism and bug reports, you should follow the github repo and mailing lists, not hacker news.

jsmthrowaway 12y ago
I'm not talking about Docker. I'm talking about you. Your first inclination is how people are wrong and only you are right, in every case. I don't understand your need to make everyone who criticizes Docker feel wrong, or like they missed something. Your thread here about Rocket was extremely alarming and directly motivated me to plan for a future without Docker. Best way forward here would have been "hey, thanks for looking into this, we know it's an issue." All of which you said later after making sure the author knew he missed something, which no normal user is going to look for anyway. The real bummer is you remind me of the CEO of Linode, whose company will fail for similar reasons. He is equally infallible and ignores criticism.
- nknighthb 12y ago
  > you remind me of the CEO of Linode Hmm... You've just increased my respect for Solomon. > He is equally infallible and ignores criticism. As a long-time Linode customer, I know this to be absolutely false. Was it your intent to so thoroughly discredit yourself?
  - jsmthrowaway 12y ago
    I was employed by Linode for three years, so I know it to be absolutely true. I'm not willing to tie my actual identity to this account very publicly (in fact, I'd rather not be here), but many people know who I am in various circles and can vouch for that. It was also a throwaway remark about handling criticism and less an indictment, because I am capable of moving on with my life and wish Linode no ill will. You're happy, so you're happy. That's all that matters. Ignoring criticism and developing an echo chamber is dangerous, that's my point. I see shykes doing it, and caker does it too. Most of Linode has quit in the last year, too, so if you ignore the wrong criticism too long, well, people leave.
    - nknighthb 12y ago
      So you're a bitter ex-employee who comes to HN only to anonymously sling mud? That sounds about right.
      - Gigablah 12y ago
        These are some Reddit-level retorts. You're not doing yourself any favours.
    - levlaz 12y ago
      :s/most/some
- shykes 12y ago
  That's an understandable criticism, even though it makes me want to die inside. Let me try and explain my point of view, and why this whole situation is so frustrating to me. First, my impression is that I do spend most of my days listening to criticism by people smarter than me, revisiting my assumptions, and trying very hard to make people feel appreciated for their effort in the process. Most of that effort is spent on IRC, the Docker repository, and the Docker mailing lists (in decreasing order of time invested). Obviously, I am biased. But I'm willing to bet that if you spent a week or 2 on the IRC channel interacting with me and the other maintainers, you would develop an entirely different picture of how we work and how we treat criticism. Second: aggressive blog posts by competitors and their coverage in Hacker News. This is something new to me, and I acknowledge that I have been handling it very poorly. I thought I had learned my lesson last time, but as your message points out, it appears I have not. Basically, I handle very badly the combination of 1) feigned indignation and ignorance by people with clear conflicts of interest; 2) a small number of vocal haters waiting for an opportunity to pile on, and 3) lots of intelligent but uninformed bystanders. When someone makes a valid criticism, with the ultimate goal of improving the project, as harsh as it is, I will be the first to embrace it. But here we are talking about something different: a blog post written by commercial competitors, with the intent of making the project look as bad as possible - using valid known criticism when available, but not shying away from recycling old criticism which has since been addressed, or sometimes making up facts altogether - resulting in a more compelling narrative that will "stick" better. These are posts crafted by venture-backed companies competing with Docker, inc. in the same general space (developer and IT tools), with all sorts of conflicts of interests. I now these people personally, they are all part of the Silicon Valley scene, and what they do is very intentional. It has nothing to do with honest criticism or attempts to improve the project - those are taking place all day long on the repo, and never generate any drama. It's just business as usual, but as an engineer it drives me crazy. What drives me most crazy is how easily people fall for it. But, I acknowledge that it's not an excuse for the sort of knee-jerk reactions I've engaged in. As frustrating as it is, I think the proper reaction would be to 1) stay under the radar, wait for the drama to die down; 2) take a solid look at the criticism, extract the real one from the political bs, and focus on fixing that; 3) take a solid look at how well we communicate what we do. For example, we have made good progress on security compared to 6 months ago, but clearly we have done a poor job at explaining that and showing solid proof points. 4) as outrageously hypocritical and unfair as these posts appear to me, who know the full back story and understand the commercial motivations, remember that the rest of the world is not aware of the commercial back story. And frankly, they don't care. What they'll remember is our response to the criticism. So - I did my best to express my point of view on all this. My personal lesson is that success is not that fun, and sometimes I regret the days when Docker was not successful. But at the same time there is a sense of responsibility: a great many people use this tool every day, and we are responsible for improving those tools every day. Once these vc-backed competitors (whether it's coreos or flynn) are done writing their blog posts, they aren't going to fix the project. That's our responsibility, and nothing else should matter. So, for what it's worth, my new year's resolution will be to do a better job at the above - and perhaps take a break from Hacker News altogether, too ;) Feel free to join the IRC channel if you want to discuss this some more. In the open, of course!

by shykes 12y ago

jsmthrowaway 12y ago

I'm not talking about Docker. I'm talking about you. Your first inclination is how people are wrong and only you are right, in every case. I don't understand your need to make everyone who criticizes Docker feel wrong, or like they missed something. Your thread here about Rocket was extremely alarming and directly motivated me to plan for a future without Docker. Best way forward here would have been "hey, thanks for looking into this, we know it's an issue." All of which you said later after making sure the author knew he missed something, which no normal user is going to look for anyway. The real bummer is you remind me of the CEO of Linode, whose company will fail for similar reasons. He is equally infallible and ignores criticism.

nknighthb 12y ago
> you remind me of the CEO of Linode Hmm... You've just increased my respect for Solomon. > He is equally infallible and ignores criticism. As a long-time Linode customer, I know this to be absolutely false. Was it your intent to so thoroughly discredit yourself?
- jsmthrowaway 12y ago
  I was employed by Linode for three years, so I know it to be absolutely true. I'm not willing to tie my actual identity to this account very publicly (in fact, I'd rather not be here), but many people know who I am in various circles and can vouch for that. It was also a throwaway remark about handling criticism and less an indictment, because I am capable of moving on with my life and wish Linode no ill will. You're happy, so you're happy. That's all that matters. Ignoring criticism and developing an echo chamber is dangerous, that's my point. I see shykes doing it, and caker does it too. Most of Linode has quit in the last year, too, so if you ignore the wrong criticism too long, well, people leave.
  - nknighthb 12y ago
    So you're a bitter ex-employee who comes to HN only to anonymously sling mud? That sounds about right.
    - Gigablah 12y ago
      These are some Reddit-level retorts. You're not doing yourself any favours.
  - levlaz 12y ago
    :s/most/some
shykes 12y ago
That's an understandable criticism, even though it makes me want to die inside. Let me try and explain my point of view, and why this whole situation is so frustrating to me. First, my impression is that I do spend most of my days listening to criticism by people smarter than me, revisiting my assumptions, and trying very hard to make people feel appreciated for their effort in the process. Most of that effort is spent on IRC, the Docker repository, and the Docker mailing lists (in decreasing order of time invested). Obviously, I am biased. But I'm willing to bet that if you spent a week or 2 on the IRC channel interacting with me and the other maintainers, you would develop an entirely different picture of how we work and how we treat criticism. Second: aggressive blog posts by competitors and their coverage in Hacker News. This is something new to me, and I acknowledge that I have been handling it very poorly. I thought I had learned my lesson last time, but as your message points out, it appears I have not. Basically, I handle very badly the combination of 1) feigned indignation and ignorance by people with clear conflicts of interest; 2) a small number of vocal haters waiting for an opportunity to pile on, and 3) lots of intelligent but uninformed bystanders. When someone makes a valid criticism, with the ultimate goal of improving the project, as harsh as it is, I will be the first to embrace it. But here we are talking about something different: a blog post written by commercial competitors, with the intent of making the project look as bad as possible - using valid known criticism when available, but not shying away from recycling old criticism which has since been addressed, or sometimes making up facts altogether - resulting in a more compelling narrative that will "stick" better. These are posts crafted by venture-backed companies competing with Docker, inc. in the same general space (developer and IT tools), with all sorts of conflicts of interests. I now these people personally, they are all part of the Silicon Valley scene, and what they do is very intentional. It has nothing to do with honest criticism or attempts to improve the project - those are taking place all day long on the repo, and never generate any drama. It's just business as usual, but as an engineer it drives me crazy. What drives me most crazy is how easily people fall for it. But, I acknowledge that it's not an excuse for the sort of knee-jerk reactions I've engaged in. As frustrating as it is, I think the proper reaction would be to 1) stay under the radar, wait for the drama to die down; 2) take a solid look at the criticism, extract the real one from the political bs, and focus on fixing that; 3) take a solid look at how well we communicate what we do. For example, we have made good progress on security compared to 6 months ago, but clearly we have done a poor job at explaining that and showing solid proof points. 4) as outrageously hypocritical and unfair as these posts appear to me, who know the full back story and understand the commercial motivations, remember that the rest of the world is not aware of the commercial back story. And frankly, they don't care. What they'll remember is our response to the criticism. So - I did my best to express my point of view on all this. My personal lesson is that success is not that fun, and sometimes I regret the days when Docker was not successful. But at the same time there is a sense of responsibility: a great many people use this tool every day, and we are responsible for improving those tools every day. Once these vc-backed competitors (whether it's coreos or flynn) are done writing their blog posts, they aren't going to fix the project. That's our responsibility, and nothing else should matter. So, for what it's worth, my new year's resolution will be to do a better job at the above - and perhaps take a break from Hacker News altogether, too ;) Feel free to join the IRC channel if you want to discuss this some more. In the open, of course!