di4na

18 ms·

211.
by di4na 4y ago
This software is provided 'as is'. Noone built it as trust-assumption We all chose to trust because it allows us to look at ourselves in the mirror every morning and forget the free work we are exploiting. The problem is us. Not n
212.
by di4na 4y ago
And yet that is the rules of the contract. This software is provided 'as is'
213.
by di4na 4y ago
Nearly none for the really critical components. Even the one with sponsors do not make that much. Typical example. Last year was the first time the curl project could pay for their website hosting vs the author paying it from his own pocket
214.
by di4na 4y ago
I advise you to go read the Road and Bridges report i linked in the blogpost. As of today, the reality is not at all. As I mentioned elsewhere there are zero maintainer of autoconf since 2012, even less one well paid. Log4j devs took unpaid
215.
by di4na 4y ago
I mean. Talk to the SLSA framework and the growing mind share it has then. Also all the thought leadership post out there. "Log4j has to release better patch" and "how could they write this when obviously wrong" or &quot
216.
by di4na 4y ago
the road in front of your door are not a business model ;)
217.
by di4na 4y ago
I would note that the trusted actor did not went malicious. He did exactly what he was entitled to. If we follow the rules, the people that went malicious are all the trusted users and package repository that broke his intent . He was tota
218.
by di4na 4y ago
But i did write in big, capital letter that i am not a supplier in the licence, in the repo. See the last sentence.
219.
by di4na 4y ago
So I went to check SLSA Version Controlled: On the maintainer side Verified History: On the maintainer side Retained Indefinitely: Can be both Two Person Reviewed: On the maintainer side Scripted Build: On the maintainer side, c
220.
by di4na 4y ago
Aaaah fair. Well i will go cower behind excuses and say it is late (well early) on the first day of 2023 for me :) Thank you for the explanation
221.
by di4na 4y ago
Author here. The difference is that FOSS is not a business model. It is far closer to infrastructure, which is usually supported by other means than business models. Things like community structures for common goods (regularly called govern
222.
by di4na 4y ago
Author here Where did you message me ? I know i have all kind of problems with it but never had time to deal with it :D Also the TL;DR is the title :)
223.
by di4na 4y ago
This is basically what Tidelift does. I personally think that the solution is more in line of something like https://sovereigntechfund.de/ , where taxes pay for support of what is fundamentally infrastructure
224.
by di4na 4y ago
Author here. Yeah a friend quipped that when i explained to them i was writing this post, and i asked them if i could shamelessly steal it and use it. They agreed. So i ran away with it.
225.
by di4na 4y ago
Once again, if i leave my sofa on the curb, i am not a supplier. It may happen that someone pick it out. That does not change the fact i am not a supplier of sofas.
226.
by di4na 4y ago
Author here. As pointed out in the end, in a different paraphrase. If you take the sofa i left on the side of the curb to bring it home, i am not your supplier. You found something for free in my trash. That does not make me your supplier.
227.
by di4na 4y ago
Author here. You do realise that the main source of dangerous vulnerability is low level infrastructure that do not come from these package managers ? The purity and capabilities sadly solve nothing when the source of the problem is the fac
228.
I am not a supplier(softwaremaxims.com)
389 points by di4na 4y ago|238 comments
229.
by di4na 4y ago
This. As long as you keep the API relatively simple, something like basic CRUD "restful", it is really low cost to transform your domain model modules (regularly called "Context" in the community) into whatever JSON you
230.
by di4na 4y ago
As someone that has done and keep doing this in other niche... There are people that like to clean messes and make people life better from the shadows. These tend to be called engineers. You may be interested in https://www.fordf
231.
by di4na 4y ago
Basically it tells economists and anyone that think they can have an impact to present ways to change this inequality stuff.
232.
by di4na 4y ago
Re John Carmack. Seeing his journal, strongly a generalist that adapt. I mean look at how they ran Armadillo. It was just a bunch of random problem solving constantly.
233.
by di4na 4y ago
I think you massively misunderstand the impact of money on law.
234.
by di4na 4y ago
It changes because what was sold as "buying" need to fulfill the promises too. It is not only long term. Did you bought a game on Steam? Now they have to give you a lot of rights they were not allowed to give you. And still are no
235.
by di4na 4y ago
There have been multiple. It is considered illegal** ** This is here to point out that it being illegal can be interpreted in multiple ways. Some steps of the process have not been covered. Like "is writing everywhere that i allow you
236.
by di4na 4y ago
There are multiple cases going through the courts in multiple countries around this. The one i have in mind is in France (UFC Que Choisir vs Steam iirc) but i know there are others. From time to time, someone look at these, read the judge o
237.
by di4na 4y ago
No they are not. The courts have been swift and merciless on this shit for music, video and similar things. Google may seem big but they do depends on the law still.
238.
by di4na 4y ago
Right so a tool for something else. But great for them
239.
by di4na 4y ago
This. Tbf i think this is a generic problem in the frontend tooling side. The build tools documentation and DX all seems built with the idea your html come from js or as static assets too. When in reality it is probably handled by a server
240.
by di4na 4y ago
Tailwind has `@apply` from postcss

More ›