zizek23

Mozilla is playing a double game of pretending to be on the users side while completely being in Google's pocket. For Google this ensures they cannot be accused of being a monopoly.

And those working for Google attempting to divert attention to Hollywood are symptomatic of the reality distortion field and self deception of SV. Google is a spyware company engaged in mass surveillance and creepily following everyone on the planet for profit. There are no redeeming values here. SV is basically a gold rush with greed and money being the primary driver glossed over with dollops of pretension.

The world just has to step up to take control and diminish the ideology that drives SV. So far be it open source, web services, standards or regulations there is no contribution. Why are there no alternatives to Firefox, Google, Facebook and others? You can't be completely dependent on these companies and then claim victimhood.

Only the developers know why they need 150 deps, there is no way for end users or deployment to verify this chain or stay on top of this.

They simply need to deploy the app and keep it updated safely. If developers and languages have not thought of this basic step then please defer to the distribution package manager which has.

These kind of frauds won't pass the average distribution package managers scrutiny and CVEs will have quick updates that are tested to work.

Contrast this with users scrambling to update affected apps and their individual local libraries which in turn may have their own specific deps which may not have been updated and thus will fail because of version inconsistencies. End result. Millions of man hours wasted because of clearly bad engineering practices.

There is always a 'pragmatic' silence about PHP on slack discussions here. Wikipedia, Facebook, Slack. PHP has unquestionably delivered on scale.

There are a lot of constructive ways to begin to solve this but I guess you prefer the camel in sand approach.

Every single Ruby post has commentators complaining about dependency hell and steering clear of Ruby apps. This was not the case even a couple of years ago.

This is effectively a user boycott which Ruby may not deserve but has brought on itself by letting the 'break everything crowd' run amok. They have moved on to Node and will move again to the next big thing but it's Ruby left dealing with the fallout.

You are fighting a strawman. Either use the system package manager which has already thought about and solved these issues or if you must use a 'home brew' package manager, design a secure one. And if you can't do that limit the circus to developer machines.

A package manager must at a minimum address code security, dependency hell and deployment. A json parser that wgets urls into a folder is not a package manager.

These things must be thought of upfront and cannot be left vague and open to adhoc practices that leak to end users and deployment creating insecurity.

For instance a package should be a package, it should not be a simple class or function that in turn pulls in a hundred dependencies. 10 packages like this can pull in 600 packages all with conflicting versions. This is exactly dependency hell that creates insecure practice as no one can verify the chain and sheer number of packages.

Language developers cannot just sit back and let this happen. Eventually you will pay the price for this kind of shoddy engineering. This should be the minimum required from any responsible language.

And best then if you don't use the system package manager, do not mix up both to create a frankenstein language that multiplies complexity for everyone.

The biggest thing is stop being faddish. Recognize upfront that there are always developers and groups jockeying for influence and creating dependencies on their apps and platforms. Discourage them from hoisting their self serving bad ideas on the ecosystem and multiplying complexity for everyone. Ultimately the language and ecosystem have to develop consensus on robust engineering practices or a wildland which will eventually lose users.

The casual culture of pulling in hundred of dependencies, and mushrooming language specific package managers is ridiculously insecure and has to go.

There is no way for anyone to know what all this code is doing, there is little way to verify updates and its simply untenable.

If some developers like this sort of unsafe practice it should be strictly limited to their machines and in no way make it across in any form as a deployment artifact.

There are already secure distribution package managers with the necessary infrastructure, you are not special, use those. Ruby is already paying a price for imposing dependency hell of users and wasting millions of man hours. Many have suffered and do not even bother with Ruby apps anymore. Node and others who think this is a good model will be next. Users should simply boycott such user hostile developers and languages that encourage this kind of insecurity.

Some technologies empower, others disempower and if iot devices and things like self driving cars are not rolled out with proper systems of user control and privacy they will disempower people.

For many in the industry this is not a concern, a mere technology issue, an inevitability, an opportunity for profit.

Fortunately there is growing skepticism and awareness of the intrusiveness. And self congratulatory messages on technology forums belittling user ignorance - oh they are dumb so we will take control - as if everyone should be a technology expert will be seen for the betrayal of users it is.

Self preservation comes naturally to humans and given most technology folks are happy, even proud to work with deeply intrusive spyware companies, they are not going to be perceived as harmless as before. There is going to be a backlash against the so called 'nerds' involved in this one way transfer of power.

The business model of journals seem to be particularly perverse and artificial. The universities not only have more brand value and credibility but also the resources to publish journals themselves.

It's interesting how the journals managed to get a monopoly on this over 50 years. There seems to little reason for a private entity to be able to inject themselves here and take control of public output.

It's like the public paying for oil exploration with private companies like Exxon Mobil stepping in when it is found to take control and sell the oil. This doesn't seem to have anything to do with capitalism or any ism, it looks like pure theft.

No one is forcing anyone to release an open source project or make anything available for free. It's a choice. There are entitled, selfish and extremely immature users but also projects.

Open source users frequently put up with extremely poor products in the beginning and help them mature and grow.

In the case of users some are frequently on HN itself complaining if a project repo on github is not updated in a week. There are startups who are successful who let alone give anything back to open source projects do not even properly acknowledge their use. This is hand waved away on HN when it should be the leading force of change against this kind of self serving culture.

Users pay you with their attention, that is the currency of open source and adds tangible value to your project in the beginning when you have no users. So projects like Caddy have been paid and validated by their users which enables them to now make a commercial push.

Once you gain traction you can't suddenly change the rules of the game and change the narrative to 'free' and 'paid' users or 'developers' and be dismissive of users who supported you.

Yet when even projects like Debian dismiss users to focus on developers now that they have traction, nevermind a project without users has no reason to exist, its not surprising this is the predominant dismissive attitude in open source towards users.

These are authoritarian fascist policies that are brazenly infringing on people's personal effects, content whether a diary, phone or laptop is your inviolable personal effect.

They can search the physical books and laptops all they want but not the content, that is crossing a huge red line that simply cannot be crossed in any free state and raises serious questions about our constitution, the rule of law and the court system.

When it comes to China or Russia we automatically presume the moral high ground to point fingers, but then do not detect the contradiction in this quiet acquiescence or being reduced to seeking workarounds in chrome books and such.

There is a dissonance of principles observed more in posturing and grandstanding that makes criticisms of other states not a commitment to principle but the worst kind of denial and jingoism.

It really is time to stop reacting and quietly reflect on what we have become. Are we simply a society of income and access to products with everything else open to expediency and pretension.