3 ms·

Obviously source control has its benefits, but ironically often tarball-only developers produce very high quality software (the most prominent example is djb at

by sfk 11y ago

Obviously source control has its benefits, but ironically often tarball-only developers produce very high quality software (the most prominent example is djb at cr.yp.to). Conversely, GitHub is full of low quality software.

navait 11y ago
You're cherry picking a few example of tarball only developers and then comparing it to the entirety of github? How is that a fair comparison at all?
geofft 11y ago
djb's software is pretty low-quality for very many metrics of "quality". Lots of it is not elegantly interoperable with existing UNIX systems, because he has his own idea of how UNIX systems should work. There's the entire qmail backscatter thing. There are pieces of crypto code written in a custom assembler. Curve25519 has its own reimplementation from Chrome's Adam Langley, and all of NaCl its own repackaging in the form of the libsodium project, because the official distributions are difficult to use. NaCl has been promising certain features in the "next release" for years (notably Ed25519 signatures), but no release has been seen. All the downloads are over plaintext HTTP with no cryptographic signatures: I've always interpreted this as implying that if you're not qualified to audit the entire tarball you downloaded, the software isn't for you. None of this is to claim that he's a bad cryptographer, or even a bad software engineer. But pure code output is far from the only important metric for software. GitHub makes it easy to do release engineering well, or to let other people help you with that if it's not your forte. (libsodium, for instance, is on GitHub.)
- deleted 11y ago
  [deleted]
sfk 11y ago
Wow, -3 for this horrible comment. HN is full of idiots. Now go on, make it another -10; it will be the only thing in your day that makes you feel that you have any influence.

3 ms·

Obviously source control has its benefits, but ironically often tarball-only developers produce very high quality software (the most prominent example is djb at

by sfk 11y ago

navait 11y ago
You're cherry picking a few example of tarball only developers and then comparing it to the entirety of github? How is that a fair comparison at all?
geofft 11y ago
djb's software is pretty low-quality for very many metrics of "quality". Lots of it is not elegantly interoperable with existing UNIX systems, because he has his own idea of how UNIX systems should work. There's the entire qmail backscatter thing. There are pieces of crypto code written in a custom assembler. Curve25519 has its own reimplementation from Chrome's Adam Langley, and all of NaCl its own repackaging in the form of the libsodium project, because the official distributions are difficult to use. NaCl has been promising certain features in the "next release" for years (notably Ed25519 signatures), but no release has been seen. All the downloads are over plaintext HTTP with no cryptographic signatures: I've always interpreted this as implying that if you're not qualified to audit the entire tarball you downloaded, the software isn't for you. None of this is to claim that he's a bad cryptographer, or even a bad software engineer. But pure code output is far from the only important metric for software. GitHub makes it easy to do release engineering well, or to let other people help you with that if it's not your forte. (libsodium, for instance, is on GitHub.)
- deleted 11y ago
  [deleted]
sfk 11y ago
Wow, -3 for this horrible comment. HN is full of idiots. Now go on, make it another -10; it will be the only thing in your day that makes you feel that you have any influence.