Hacker News Reader

Comment by rincebrain | Hacker News Reader

This seems like a flashback to the xscreensaver fights with Debian of yore, given that the entire fight seems to distill to "OBS is shipping EOL Qt because of unfixed regressions in newer Qt, Fedora views shipping EOL Qt as unjustifiable neglect and repackaged it with newer Qt, which, as described, breaks things." [1]

For those who don't have that in their context - jwz got very upset at people reporting bugs against xscreensaver that had been fixed for a long time in upstream but e.g. Debian doesn't just ship upstream updates every 30 minutes. He requested Debian stop shipping it (or update it? I didn't go reread the entire chain before replying), Debian declined.

He then put in a piece of code that popped up a notification if the system time was sufficiently far past the hardcoded value, informing people they should upgrade, and Debian debated patching his message out.

[1] - jwz dot org/blog/2016/04/i-would-like-debian-to-stop-shipping-xscreensaver/

(Link turned into not a link because I had forgotten how jwz feels about HN referrers.)

View on HN

> Debian doesn't just ship upstream updates every 30 minutes.

This grossly understates the problem.

The debian xscreensaver package was years old, and contained bugs related to screen locking which were an actual security issue.

Your comment is in very poor taste.

People who actually use Debian and similar distros will disagree. In their view there’s nothing wrong with shipping older, patched versions of open sourced software. The license says they can do it!

So they grossly understate the problem, make it seem like it’s the person authoring the software at fault or the one who’s being unreasonable.

They’re quick to tell you how great the maintainers are, how much effort they put in for free but they don’t share that same love for the author of the package. You know, the person who actually wrote the software. They don’t acknowledge that without the author they’d have no software to begin with, and that providing support to older versions of software is a cost to the author. Not just older, but possibly broken in subtle ways because of the patches applied on top. The author still gets all the blame and all the support requests for changes they didn’t make.

To be clear, there’s nothing wrong with wanting to run old, stable software. No one questions that their distro is “the most stable”. That they cannot or will not see the costs of doing so on the author is a shortcoming, but there’s no solving that.

when it's your screensaver, and I can break into your computer using a bug that's been publicized, so every idiot with access to Google knows about it, yes there's something wrong with running old software. that's just my opinion though. btw, where's your office?

Yeah, but it's a problem for the person who wants to run old software. It's their choice, I support that choice. As long as it doesn't affect me, I'm fully supportive. Of course I'll be affected if my data is stored on such a server, but I'm assuming some level of competence here.

I personally run on latest, apply all updates zealously within a week or two.

I don't like leaving this decision up to either the maintainers or the author, TBH.

They have different goals/purposes, often, and they frequently don't line up with my own.

Maintainers are exhausting in their own right, they do a ton of work and so they think their decisions are more important because of the work they do, user be damned...

Authors usually only care about their version of the software.

I think, a better medium, would be if a third party is packaging an application, perhaps they should always explicitly state they are the ones packaging it. Then there is less confusion.

Or, you know, let the author keep control of that...

why are you arguing with a person you agree with?

I don't agree with the sentence

> To be clear, there’s nothing wrong with wanting to run old, stable software.

Ah, alright, I see.

The screen locking bugfix had already been backported to Debian stable on the day it was released.

Debian is the most stable distro for a reason. They don't rebase from upstream every 30 minutes because it is a community project. It is wonderful that volunteers have continued the Debian project for so long.

In contrast, Red Hat Enterprise Linux, a distro funded by IBM and countless faceless backers, has recently stopped patching many vulnerabilities, recommending to their users to rely on mitigations instead, despite the availability of upstream patches.

Furthermore, the recent vulnerability threatscape is inundated with CVE hunters who are desperate to call the most minor degradation of service a vulnerability. For a community project (and apparently an enterprise-serving megacorporation), this causes patching fatigue.

Where is the "every 30 minutes" coming from? You and another commenter have both used this identical phrase.It sounds as though the complaint was not because a patch hadn't been applied after 30 minutes, or even 30 days or 30 weeks. More like 30 months.

I said "every 30 minutes" as a piece of hyperbole, in my original comment.

I'm not really sure why everyone is focusing on that phrase, though. I think it's pretty clear if you read any of the source material, as said, that that is not an accurate representation of what was going on, and I would have also expected "every 30 minutes" to be a pretty clearly hyperbolic expectation for anyone to process updates after.

> I'm not really sure why everyone is focusing on that phrase, though

Is everyone focusing on the phrase? I thought I asked about it, and that's all that's happened.

> I would have also expected "every 30 minutes" to be a pretty clearly hyperbolic expectation for anyone to process updates after

I couldn't imagine a benign use of hyperbole in timeliness when some expectations of timeliness are silly, and some are sensible. I thought I'd ask, in case there was a good faith reason for it, rather than just assume you're trying to use insinuation to change people's minds.

This doesn’t seem similar at all. Debian didn’t break xscreensaver, they merely shipped a two-year old version at some point, in line with their stable releases. This is unlike how Fedora apparently broke their own OBS repackage.

Yeah, I'm a bit disappointed at how quickly the perception turned against OBS. Maybe I'm missing something, but their "threats" actually seem pretty reasonable: They asked Fedora to stop shipping a broken version of OBS/make it clear that the Fedora version is unofficial, they got absolutely no response for three weeks, then they requested that Fedora cease using the OBS trademarks. This is not like xscreensaver, this is much closer to Firefox/Iceweasel/etc.

I wasn't trying to suggest I thought OBS was in the wrong here, to be clear, just that the debate between maintainers and developers, and not wanting to get bugs for things that were external, reminded me of that exchange.

There's plenty of other examples, of course - one that springs to mind was when Ubuntu shipped a patch of their own design in OpenZFS that caused data loss, and it got reported to upstream.

To be fair, not necessarily singling out your comment: I've seen mixed sentiment around the net. I think the characterization of the threats as being "legal threats" makes people more prone to see this as the OBS project being vexatious, but it seems like it's more a last resort to get Fedora to even pay attention.

And credit to Fedora, it looks like they're working quickly to fix the problem now. It's pretty obvious it wasn't malice that led them to not respond quickly.

If you read the actual bug thread with the back and forth, they weren't to the point the fedora contact was pretty hostile about their use of a slightly old QT version and was adamant about keeping it in place. The fixes only happened within hours after the trademark/copyright request presumably because that went to legal and legal WTF'd at the whole situation and their maintainer's handling of the situation and magically it got fixed almost immediately thereafter.

> It's pretty obvious it wasn't malice that led them to not respond quickly.

So stupidity then.

Seems legit.

That’s a poor faith comment.

I’m a Fedora packager (not for this package). Like many others I have an unrelated day job.

If there’s an upstream complaint I might get to it this weekend, maybe next. If I’m busy for a few weeks that doesn’t make me stupid.

Have had my share of “discussions” with upstream who want the latest version packaged when this might not be completely in line with our guidelines. Not an uncommon issue.

Yeah it’s not fair to expect volunteers to show up on weekdays, I agree with you.

But equally, I don’t think it’s fair that packagers want to have it both ways. Packagers want to make subtle, possibly breaking changes to software they didn’t author. The end users feel the pain and complain to the author. The author has no control over the situation, and they’re feeling the pain during the working week.

So the packager has been instrumental in creating the problem with the patch, and when requested to do something about it, turns around and says “buddy I do this for free, I’ll get to it over the weekend, maybe.” Sure, but the author is feeling the pain right now.

Again, it’s nice that you’re volunteering your time for others. But it would be good if you acknowledged that the costs of packaging aren’t borne entirely by packagers. Authors bear part of the cost when they get blamed for broken software.

Sometimes changes are required to meet packaging guidelines, sometimes you can get exemptions. Of course users often don’t realise who’s done what.

I suppose my advice to upstream would be to direct the end user to the Fedora bug tracker, where the bug can land in my queue. Or advise the user to install from a different source.

The upstream that I’ve dealt with have been kind enough to lodge a bug themselves on the package I look after, which is also an option, and much appreciated.

> I suppose my advice to upstream would be to direct the end user to the Fedora bug tracker, where the bug can land in my queue. Or advise the user to install from a different source.

How is upstream supposed to make this happen when distro maintainers not only don't mark the package as modified by them, but also silently change the flatpak configuration so that installing packages from flatpak in the way that would normally install a clean upstream build doesn't do so?

Thanks for being a packager for Fedora. I appreciate your work. About to start playing with Fedora again on my Steam Deck.

It’s a rewarding experience. A bit voodoo magic until you wrap your head around all the utilities, build systems, workflows, and then quite pleasant.

> That’s a poor faith comment.

Less of a poor faith comment, more like a badly landed gag. In my head, everybody would have known I was riffing off:

"Never attribute to malice that which is adequately explained by stupidity." -- https://en.wikipedia.org/wiki/Hanlon%27s_razor

I love Debian but the version of xscreensaver was old and if there were security issues unpatched and getting the blame sent to jwz, that’s not right.

This wasn’t about security issues. Security fixes are regularly applied to Debian stable releases, and have been in the case of xscreensaver.

https://news.ycombinator.com/item?id=43046053 seems to suggest otherwise.

I vaguely remember this happening but I’d need to check.

> Fedora views shipping EOL Qt as unjustifiable neglect

That's rich, coming from a project very closely tied to Gtk, which has a history of massive breaking changes, and outright removing functionality, leading to many projects continuing to use older versions of gtk for a very long time.

One of those project is the OG — GIMP.

Many different people have different priorities in fedora.

I believe they mainly remove functionality between major releases of GTK, not within a release. Can you cite an example where they have done this between gtk minor releases ? Aka gtk 3.1 -> 3.2 ?

How is fedora “closely tied to Gtk” in any way that it isn’t also “closely tied to Qt”?

Fedora KDE is literally release blocking and has been approved for promotion to be on the same level as Fedora Workstation.

Fedora is owned by Red Hat, which is a major contributor to gnome and gtk.

Red Hat isn't as involved with Qt, which is mainly maintained by yhe Qt group company.

> How is fedora “closely tied to Gtk” in any way that it isn’t also “closely tied to Qt”?

RedHat employees make the majority of commits to Gtk and I think are some of the maintainers/managers?

Don't link to this guy's site. He has a serious personal problem with every reader of HN (including the vast majority he's never met and knows nothing about) and serves an NSFW image to anybody that has this site in the referrer request header.

I find it insane that everybody is seemingly okay with the fact that websites get to know what a user was browsing before landing on their site. And that there's no straightforward way to disable this behavior without the use of extensions.

Highly recommend installing https://addons.mozilla.org/en-US/firefox/addon/smart-referer

Hmm, the addon description says "has been largely superseeded by better browser defaults"

huh, no idea why it would say that, the only sane default is when referrer is not leaked to websites at all.

Doesn't seem NSFW to me at all. It's a skin textured egg with hairs in an egg cup.

https://cdn.jwz.org/images/2024/hn.png

Huh, looks like he changed the image in 2024 (based on url). Before today, I'd have said the jwz image was goatse.

It was always the hairy egg/scrotum.

This is a piece of Internet lore I'm not familiar with! Any good summary or article or anything you'd recommend?

There's nothing much to it. Jamie Zawinski just doesn't think highly of Venture Capital etc. He thinks that the first tech boom ruined San Francisco and he thinks that Paul Graham is terrible. That's pretty much it.

Considering that I've spent many a night at Bootie SF (back when it was at DNA Lounge) on too many drugs or alcohol to respond to on-call issues, it's entirely possible that he had more power over tech than it had over his life.

Like many people in San Francisco, he is an intelligent guy with great will to power and eccentric views.

Why do you need an article? Just find a link to some page on http://jwz.org somewhere on news.ycombinator.com, and click it. Note that you will get a (really quite tame) NSFW image. Said image will explain jwz's feelings regarding Hacker News.

Presumably they are looking for more than the 2 lines in the image that don't explain anything about why.

The lines do explain why, from the horse's mouth. I don't know what value-add you'd expect from an "article" - an interview with jwz?

https://www.jwz.org/blog/2011/11/watch-a-vc-use-my-name-to-s... doesn't mention HN directly, but will give you a sense of his POV (copy-and-paste the link or you'll get the behavior described up-thread)

Alright, maybe "article" was a poor word choice? Thanks for an example of of what happens when you link to their site from here, I was just curious to read into the drama, it sounds like an interesting story from a pocket of the internet I'm not familiar with.

When I said "article," I guess I meant that I don't want to watch a youtube video detailing the drama or whatever, I was hoping to just read about it. Either way, thanks for the link and the explanation further down the thread.

Coders at Work has an interview with a pretty comprehensive backstory of his time in the tech industry. If you want to get more of his vibe, he's also in the documentary Code Rush.

Honestly it's refreshing to see someone in tech stand up to the VC-only vision of what tech can be. I still enjoy HN, but got a good laugh at image that popped up and agreed he has a point.

He seems to have a pretty good grasp of the average commenter here, I don't know what your problem is with him exercising his free speech rights on his own website to deal with people he feels that way about.

Sounds like you're the one with the personal problem. Let people read and link to what they want, and mind your business.

Get a better browser that doesn't leak the site you came from all over the place.

Yeah, I remembered that after, had to open another browser window to confirm it because otherwise I just got the cached one, and then edited.

You can hate jwz as much as you want but the fact remains that probably 95% of ycombinator funded startups couldn't exist without making extensive use of the gpl, bsd, Apache and similar licensed software produced by a lot of open source curmudgeons and greybeards.

Many of whom share his same opinion on VCs and late stage capitalism.

> You can hate jwz as much as you want

I don't hate him and didn't write anything of the sort. I've never met him. He might as well be the tooth fairy or the Easter bunny as fas as I'm concerned.

> the fact remains that probably 95% of ycombinator funded startups couldn't exist without making extensive use of the gpl, bsd, Apache and similar licensed software produced by a lot of open source curmudgeons and greybeards. Many of whom share his same opinion on VCs and late stage capitalism.

I've been using FOSS for personal use since I was a child. I'm a literal card-carrying supporter of the FSF. I'm more passionate about it than I am shitting on random people on the internet. If he has a problem with VCs then he can spam them with pictures of genitalia and ad-hominem attacks, not me, who's just some random dude who _isn't_ worth millions of dollars from a software business exit (along with thousands of others on this site).

It's a shitty move, I'll grant you, but it's also clearly a form of protest, and acts of protest are by-design intended to make the public uncomfortable in some way. As far as this kind of thing goes, I personally find it mildly amusing, mildly offensive, and mildly clever. I think the internet is more interesting for people like jwz doing things like this. Not necessarily "trolling," because this--for all its crude imagery and sardonic language--it's a very clever way to continuously raise awareness toward a larger issue they have taken with society. I was just motivated to read a pair of blog posts from 13-years ago, ones that required additional effort to access, and considered jwz's perspective on VCs and a hyper-aggressive work culture...for anyone who's ever attempted to publish any kind of content? That's kind of impressive.

Not that I would seek to deny your valid annoyance and offense. It's a non-consensual scrotum in a teacup. I personally would have gone a different direction, I get why that would raise someone's hackles.

> You can hate jwz as much as you want but the fact remains that probably 95% of ycombinator funded startups couldn't exist

wait, this would be a bad thing?

But without six different AI-enabled VSCode forks to choose from, how would I ever write software?

Sounds like a sensible and principled fellow.

Considering that Netscape used to have “about:jwz” as an Easter egg URL and he was influential in open sourcing Netscape…

Didn't any unknown about: string just lead to somebody's wwwhome with simple URL rewriting? At least, with some versions?

No there was a pretty small but interesting list of people in the source code.

https://www.jwz.org/doc/about-jwz.html

Aforementioned image for those who are curious: https://cdn.jwz.org/images/2024/hn.png

More importantly, the link to the referenced article, properly marked up, since some quorum of nincompoops who hate the Web flagged the other comment destroying the link for any user/agent without showdead on (which will include every agent not operated by a user):

<https://jwz.org/blog/2016/04/i-would-like-debian-to-stop-shi...>

Gilfoyle (Silicon Valley character) vibes

And Quod Libet vs. Gentoo (2006):

- https://bugs.gentoo.org/101619

- https://bugs.gentoo.org/124595

And Quod Libet vs. Debian (2007):

- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=421167

- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=477454

And tuomov (ion3) vs debian:

https://web.archive.org/web/20070307113840/http://modeemi.fi...

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=413469

>OBS is shipping EOL Qt because of unfixed regressions in newer Qt, Fedora views shipping EOL Qt as unjustifiable neglect and repackaged it with newer Qt, which, as described, breaks things.

Why do they still mingle with sw distributions? Wasn't the sandboxed blob trend born also to try blackbox strategies and have parallel versions without dealing with too much hell? Was that laziness/economical advantage (EOL'd library, no business in porting fixes, upgrade to the latest and greatest) or something else?

Backwards compatibility is not in style anymore. Upgrading several libs system-wide is likely to cause breakage in old apps. A statically linked application doesn't rot (because linux guarantees userspace compatibility). By "doesn't rot" I mean "will keep running indefinitely without requiring some maintainer to keep working on the code indefinitely."

This is crazy because it's a flatpak, which should be a blob with all its deps in there, like a statically linked application "but better" for other system reasons because e.g. you can sandbox the app by design.

For this reason I don't understand why did they changed the library in there (that build of OBS wasn't broken because of system-wide libs, it was because allegedly they changed the lib in the flatpak), whatever the security hole couldn't they block it "from the outside"?

I don't understand what the big deal was there. Debian has its own bug tracker for all of its packages so the distro maintainers get bothered about bugs in old packages shipped by the stable version of Debian rather than upstream developers. JWZ decided to voluntarily subscribe to the Debian bug tracker for his package and then add a nag screen and start a flame war over them shipping an old version.

This contract has not been upheld in practice for a very long time. Users will go straight to upstream a lot of the time.

When you look at the about box, does it say Debian Screensaver based on xscreensaver, or does it say xscreensaver? When you Google the name of the program, whose website comes up first?

Debian users frequently report bugs to upstream and not Debian.

An unfortunate side effect of github being extremely user-friendly, while debian's reportbug tool still greets "novice" users with "please enter your SMTP host" (I dread to think what questions it would have asked me if I'd selected the "expert" mode)

Distros have neither the knowledge nor the bandwidth to analyze bug reports for upstream projects.

Reply on news.ycombinator.com