Hacker News Reader

Comment by CiPHPerCoder | Hacker News Reader

I've argued in a blog post [1] that we need to delineate between "open source developer" and "supplier". If we don't do that, calling thankless unpaid volunteers and hobbyists a "supply chain" is kind of insulting [2].

I don't believe that "identity verification" for F/OSS developers is a good idea. Suppliers? Sure. That can be a contract negotiation when you decide how much you pay for it.

Also, I don't think identity verification helps when your adversary is a nation state, which can just falsify government identification if it suits them.

[1] https://scottarc.blog/2024/04/04/open-source-supply-chains-a...

[2] https://crankysec.com/blog/supply/

View on HN

Just because it can by beaten doesn’t mean making it harder isn’t useful. This person/team used a VPN. Masking your location is a big red flag for just dev work like this. These things could be exposed in UI.

> Just because it can by beaten doesn’t mean making it harder isn’t useful.

Fair.

> This person/team used a VPN. Masking your location is a big red flag for just dev work like this. These things could be exposed in UI.

I disagree strongly, and am surprised to hear this argument on Hacker News of all places.

People are so used to see artificial bureaucratic structures as more real than their real counterparts that they constantly invent such naive solutions. “Just make the gub'ment provide an official paper (with a stamp) that Joe Random Dude is a real developer, a father of two, not a fan of satanic metal music, and the project will be safe”.

People already do this in a general sense for authenticating a person and deciding if they’re trustworthy.

Not “trustworthy”, but “able to play their role in certain scenes”. When you're outside of that structure, those decorated clothes lose any meaning.

The VPN is just part of the picture (sock puppet accounts complaining about speed of dev, no meaningful history of other contributions from the dev, no trusted "personal network" for the dev, etc) that in hindsight should have raised red flags.

new project idea: OpenBackgroundCheck

volunteer osint researchers attempt to dox any identity you submit, so you can know whether they're the Right Kind of OSS contributor or not.

If they constantly are on a VPN and not willing to disclose a real location or IP then I fail to see why they should be trusted when they don’t provide anything trustworthy themselves.

Most people you interact with electronically, you don't even bother trying to see if they're using a VPN or make any attempt to geolocate them.

Sure but GitHub could have that as a badge to provide useful info that can help with vetting someone who wants to be a maintainer.

Not everyone dev that uses a VPN or something like Tor is doing so due to some malicious reasons. Some people face challenges regarding privacy.

Reply on news.ycombinator.com