Hacker News Reader

Comment by erikb | Hacker News Reader

I'm a huge fan of FOSS, but do you really think that you have full control over any modern piece of software? I think that underestimates how many people actually work on such a project and how many new updates we're getting on a daily basis. Nobody is more than %-wise controlling that stuff anymore. And this % is based on regular financial(!) investment in developer-hours but not in what software you use.

PS: I just fetched a project I'm actively working on. Last fetch was Friday afternoon or Saturday morning. >50 new commits fetched today. Until I'm finished reading and understanding all of them, there will be >500 more I suppose.

View on HN

It's not about meticulously reviewing every commit for every project that I use, obviously nobody has time for that. For me the most important part is being able to fork the project if you want to add features or are unhappy with the way the original project is going, you don't merely have to beg the maintainers to add a certain feature, you can do it yourself. And perhaps more importantly I'm not screwed if, for one reason or an other, the original maintainers decide to drop the project.

It's very important to me that emacs is open source not because I review every single commit (I don't) but because it means that I can commit a lot of time tweaking and learning the ins and outs of the editor without worrying about having to switch to a different one a few years from now when the original devs get acqui-hired by Facebook and they stop working on their project.

Also, simply making the source-code visible to all, helps keeps the honest guys honest. That's true even if the licence isn't truly Free and Open Source.

No-one dares to commit spyware to GitHub.

The fact that the source code is available does not guarantee that the blob is the product of that source.

That's true and, to me, has been brought on the spotlight from Microsoft practices around VSCode. On the other hand, for an OSS project, building the binary is not that hard.

This is why there is the "Reproducible Builds"[0] initiative from Debian folks.

[0] https://reproducible-builds.org/

> No-one dares to commit spyware to GitHub.

I see where you are coming from, but this is simply not true. You can argue nobody concerned with his own reputation commits spyware to a public repo, but malicious actors are usually not concerned with that or try to stay anonymous in the first place.

Here is a recent example of malicious commits to a github repo: https://news.ycombinator.com/item?id=17458329

> You can argue nobody concerned with his own reputation commits spyware to a public repo, but malicious actors are usually not concerned with that or try to stay anonymous in the first place.

It's not so black-and-white though, hence "keeps the honest guys honest". Are Microsoft and Google 'malicious actors'? They're hungry for our data, but they often only do it when they don't think we'll be able to find out what they're doing. https://news.ycombinator.com/item?id=17749330

> or me the most important part is being able to fork the project if you want to add features or are unhappy with the way the original project is going

Which is not "complete control" and that was the point I was arguing against. That having source code access enables you to gain some control over your own life is not a point I was arguing against.

Additionally another point: even if you fork you can't keep that fork alive without manpower. Nowadays all the dependencies and apis change all the time as well.

The purpose of the open source requirement is not so I can figure out what is going on and exert control.

The purpose of the open source requirement is so that many other people -- some much smarter than I am, and others only a little smarter than I am -- can figure out what is going on, and then post warnings to me about why I should avoid it.

I completely agree. The rapid flux in these huge browser projects makes personal security audits impossible even if you are one of the top 10 super-rigorous C++ devs in the world. Would be nice if some project forked the browser of their choice and then got some very careful well-respected teams/rockstars to audit it, and from then on, applied only security fixes and outright-rejected dubious stuff like WebUSB, google auto-login, etc. With Chrome and Chromium, sure, you get a very good security team working on it for you at Google, but you also get changes which are not in your best interests and/or undermine security directly or indirectly like, well, WebUSB. This is not ideal.

Reply on news.ycombinator.com