Founds vulnerabilities faster? Rewritten it in a safer language? Made a safer doas-like subset compilation target? Made it harder to trick a single person by having more eyes on code reviews?
> but may very well be undesirable to the project.
That would be a valid point of you actually said it would be and why, not that it may be. It may also be desirable. Now what? Would the project benefit from more maintainers because there may be desirable improvements or would it not because nothing may be desirable, it's literally fully secure and feature complete?
How big and how much work do you think is occurring in sudo? Try guessing the churn for last month. You are probably underestimating it by a factor of 100x.
While I don't doubt that regulatory bodies and/or ethics boards would have some cost effect, I don't think it'd be to the degree that you suppose. If anything, the long-term costs might be less. For example, say you take bad legal advice from someone online, which you follow, and now you've been found liable for some misconduct and have to pay a fine. Whereas, if you had paid for an actual solicitor and followed their advice, the initial cost would've been higher, but you wouldn't have had to pay the higher cost of the fine.
Similarly, they might have preempted things like the $99 Apple Developer Program: if your software-engineering licence is at jeopardy, you may be less likely to upload malware, or target micro-transactions to children, or make cars lie about their emissions, etc. How many lives have those ruined?
It might help with the AI-slop crisis too: Speedy Web Compiler might not have needed to adopt a policy of rejecting every external PR out of hand if they could have chosen a "licensed software-engineers only" policy instead.
Some other things to consider too like what effect this would have on anonymous/pseudonymous contributions, and whether the regulatory body/ethics board would accommodate that in some way. Etc.
Overall, I do agree that the upfront cost would likely be higher, but I think the overall code to run a modern OS would be similar enough. Though this is just my opinion from mere vibes. I'd love to see any data about this.
Only a few months ago I read some article detailing the XZ backdoor and Jia Tan.
It was a fascinating, scary and sad story. Can't really find the article right now, so here's the wikipedia article about it in case other readers don't get the reference.
The problem with open source like this is that it’s too difficult to work on, and if you start studying just to be able to work on it, it’s hard to get noticed. Most core open-source projects start with optimization and are extremely difficult. But would people with that level of skill really dislike being noticed?
Often in such 1-maintainer open source projects, although the code is out in the open, the roadmap, work-in-progress, and the real list of bugs is only in the maintainer's head. And the dev environment only works correctly on the maintainer's machine etc.
If you can't get on frequent sometimes hour-long phone calls with the maintainer, it's a Herculean task to onboard onto such projects.
The crux of why Google Summer of Code works at all is because they encourage developing a mentor-mentee relationship (similar to a new hire onboarding at a company) between the existing maintainers and the new contributors.
They define "public funding source" later as a list of specific funding organizations like OpenCollective. But that definition feels odd, and like much of this feels like it might be AI generated.
What scares me is the new generation are mostly tech illiterate just like boomers, only millennials and some gen x are lifting the tech world, now add AI to the mix and how it’s making newer gen are even dumber, the future is bleak.
I am Gen-Z who works on the Linux kernel and who still values hardcore stuff. We need more support from the Gen-X and the Millennials. I try my best to hack on things, write and contribute patches to enables features that would otherwise only exist in proprietary software. I feel like the veterans are not supporting us enough. I get a lot of hate and push back just for trying. In my opinion, a society cannot thrive without elders providing support for the young. But the general atmosphere feels completely the opposite these days.
It varies wildly from community to community. Sadly, a lot of tech spaces are much more judgemental/toxic than they should be.
The motorcycle and sports groups I've been a part of have had a lot more support from the veterans in the space and were just more positive in general. It's a lot easier to call out/shun the assholes when they're not hiding behind a screen.
You saw it here first hand today, with half the forum losing their minds because they built their tower of slop atop a javascript interpreter which will be sunset in a year. And that dependency is professionally maintained, with a 12 month off-ramp.
34 comments
[ 9.4 ms ] story [ 121 ms ] threadDo people who publish this stuff read this and think "this LLMism sounds good to me"?
* https://xkcd.com/2347/
Well, if other projects with a glut of devs are a sign, probably integrate AI into it somehow
All the other things you mentioned are just things you personally wish for but may very well be undesirable to the project.
That would be a valid point of you actually said it would be and why, not that it may be. It may also be desirable. Now what? Would the project benefit from more maintainers because there may be desirable improvements or would it not because nothing may be desirable, it's literally fully secure and feature complete?
Similarly, they might have preempted things like the $99 Apple Developer Program: if your software-engineering licence is at jeopardy, you may be less likely to upload malware, or target micro-transactions to children, or make cars lie about their emissions, etc. How many lives have those ruined?
It might help with the AI-slop crisis too: Speedy Web Compiler might not have needed to adopt a policy of rejecting every external PR out of hand if they could have chosen a "licensed software-engineers only" policy instead.
Some other things to consider too like what effect this would have on anonymous/pseudonymous contributions, and whether the regulatory body/ethics board would accommodate that in some way. Etc.
Overall, I do agree that the upfront cost would likely be higher, but I think the overall code to run a modern OS would be similar enough. Though this is just my opinion from mere vibes. I'd love to see any data about this.
It was a fascinating, scary and sad story. Can't really find the article right now, so here's the wikipedia article about it in case other readers don't get the reference.
https://en.wikipedia.org/wiki/XZ_Utils_backdoor
If you can't get on frequent sometimes hour-long phone calls with the maintainer, it's a Herculean task to onboard onto such projects.
The crux of why Google Summer of Code works at all is because they encourage developing a mentor-mentee relationship (similar to a new hire onboarding at a company) between the existing maintainers and the new contributors.
SQLite has a list of sponsors right on the homepage https://www.sqlite.org/
The motorcycle and sports groups I've been a part of have had a lot more support from the veterans in the space and were just more positive in general. It's a lot easier to call out/shun the assholes when they're not hiding behind a screen.
The people holding up the internet
https://news.ycombinator.com/item?id=50002494
Don't waste your time.