• 0 Posts
  • 57 Comments
Joined 1 year ago
cake
Cake day: July 10th, 2023

help-circle
  • At least its plugins, which are what needs to be regularly updated as platforms change, are open source. I imagine someone will clean-room reverse-engineer the core app and make an open source one that uses the plugins.

    Reverse-Engineering and reimplementing something is a lot of work, especially if it is a moving target that is still actively developed. I don’t expect anyone to do it.

    Also, Louis Rossmann said they only reserve the right to go after forks to prevent a situation like all the shady ad-ridden NewPipe ones flooding Google Play Store.

    That is some kind of hand wavy reasoning that might come from someone that could be sponsored by them. Louis should do better than taking any company by their word and promises. And spreading FUD about NewPipe (and by extension all of Open Source software) is also a straw man argument. An untrustworthy software repository is not a argument against the open source software application, but against the software repository and their maintainers.

    If you are concerned with that, you should stop using Google Play store.





  • One notable software business professional interviewed by RBC thought that the West’s decision would “adversely affect the life of the developer community, mutual trust within it, and therefore the quality of the product.”

    It was Russia and other autocracies etc. that diminished the trust by actually financing developers for multiple years to first earn trust and finally introduce backdoors into open source software, as demonstrated by the XZ utils backdoor.

    In open source projects, maintainers need to have some initial trust into each contributor, and let this trust naturally grow with time and contributions. They cannot perform intensive background checks on everyone before accepting a patch.

    While it is easier to uncover backdoors in open source software, there is no good way to defend and prevent against this kind of attack in this type of development process. All open source projects can do is trying to take away some trust from people within higher risk groups. This of course might lead to discrimination.


  • But to install from local storage, you first download or fetch a storage medium from a remote location with the file on it. There isn’t that much of a difference IMO.

    I would not call it side-loading when I download a file and then install it on the same device. Because that is how it has always worked. I never before heard people describing downloading and executing a setup.exe as “side-loading”.


  • Until some time ago, I always though that “side-loading” is something different. Since I first saw “side-loading” used in ADB, so I thought that it means using another system on the side to load and install software onto a target system.

    So to me that seems fitting, but now it seems to be used differently. How is installing software using just one device “side-loading”. What side do they mean?



  • I don’t agree with the generalization here. Sure, it is generally advisable not to rely on security through obscurity, but depending on the use-cases and purpose it can be effective.

    I dislike DRM systems with a passion, but they, especially those for video games like denuvo, can be quite effective, if the purpose is to protect against copying something for a short time until it gets cracked.

    Otherwise I agree that software developed in the open is intrinsically more secure, because it can be verified by everyone.

    However, many business and governments like to have support contracts so want to be able to sue and blame someone else than themselves if something goes wrong. This is in most cases easier with closed source products with a specific legal entity behind it, not a vague and loose developer community or even just a single developer.



  • Protects against what?

    What I read here is just a vague critic from him of the relation between hard- and software developer. Which will not change just because the ISA is open source. It will take some iterations until this is figured out, this is inevevable.

    Soft- and hardware developers are experts in their individual fields, there are not many with enough know-how of both fields to be effective.

    Linus also points out, that because of ARM before, RISC-V might have a easier time, on the software side, but mistakes will still happen.

    IMO, this article doesn’t go into enough depths of the RISC-V specific issues, that it warrants RISC-V in the title, it would apply to any up and coming new ISA.


  • My point is there never will be enough people to leave. Consumer boycotts do not work.

    Between thousands of different factors to consider wherever to buy a product from a certain producer or not, child labor, environmental waste, political attitude of the CEO, etc… it isn’t possible to make any decision on what product to consume.

    It isn’t about 'unless enough people leave" it is about “unless enough people protest to the government for market regulation” and “unless enough law makers care”.

    The free market is not self regulating, at least not with a long term positive effect.


  • This is the “consumer choice” argument.

    The problem is that consumers likely don’t have that choice. The “free market” is really bad in incentivising good long term behavior, they favor short term gains for their stockholders. Thus they likely all switch to practices that seemingly lower cost or raise short term profits. If they can fire employees and replace them with AI, they will do so.

    If they would think long term, they would prefer to hire humans instead of AI, because that way they would give their future customers money to buy their stuff. AI will not be their customer. They would pay them enough money to be a happy and good consumer.

    Customer choice doesn’t matter here, they either just have to buy whatever is cheapest, or die, because their employers (if they even have one) don’t pay they enough for them to have choice, because short term profits.




  • Generally, I tend to think more in the direction of that there is some misunderstanding happening, then people being stupid. Maybe that is just the optimist in me.

    What exactly is meant when people say they don’t know git. Do they mean the repository data format? Do they mean the network protocol? Do they mean the command line utility? Or just how to work with git as a developer, which is similar to other vcs?

    I think if you use some git gui, you can get very far, without needing to understand “git”, which I would argue most people, that use it daily, don’t, at least not fully.


  • It also means that anyone can make their own instruction set extensions or just some custom modifications, which would make software much more difficult to port. You would have to patch your compiler for every individual chip, if you even figure out what those instructions are, and what they do. Backwards, forwards or sideway (to other cpus from other vendors) compatibility takes effort, and not everyone will try to have that, and instead add their own individual secret sauce to their instruction set.

    IMO, I am excited about RISC-V, but if the license doesn’t force adopters to open their designs under an open source license as well, I do expect even more portability issues as we already have with ARM socs.



  • Depends a bit on what the default cloning url will be. If the domain is in control of mozilla, which forwards it to github, then fine, if most people start using the github url, then it is still a vendor lock in, because many people and projects will use it, and that is not so easy to move away.

    Update: To the people down-voting my comment, I would love to hear why you either disagree with me, or find that my that my contribution to this discussion is worthless.

    The upstream URL of a project or repo is important, because it will be used in other projects, like in build scripts for fetching the sources. If a projects changes that URL in the future, and the old URL is no longer available/functional, all those scripts need to be changed and the old versions of these scripts do not work anymore out of the box.

    If the project owns the URL, then can add redirect rules, that might help alleviate some of these issues. I don’t think github allows projects that move away from it to do that. So this is a sort of vendor lock-in. The project needs to maintain the repo on github, because they want to break the internet as little as possible.


  • Also state owned is only really useful for infrastructure, where it doesn’t make sense to have multiple providers and monopolies are easily attainable. Like roads, rails, electricity, internet backbone infrastructure and providers, social media, etc. Democracy is the currently best way we know of managing monopolies.

    For other stuff, you probably want employee owned democratic collectives. You would still have competition on the market, but its ordinary people that have the say. This would give more power to the people enthused about the tech and long term success, then all the short term gains.