Skip Navigation
109 comments

  • I presumably already do. Am I expected to know every single maintainer of every single piece of software I boot up? That is a LOT of homework to run an application.

    Genuinely can't tell if this a real question or some weird reductio ad absurdum thing on the not separating art from the artist trend in modern society.

  • You use so much open source software--often indirectly--that it's almost impossible to avoid every asshole with an opinion.

    That said, there is one dev where I disagreed with his actions so much that I actively avoid his stuff. It's not really political, but he's one of those devs who can do incredible work on his own, but has the social skills of a moldy sandwich. You may have used his work in the past indirectly, as his event library (libev) used to be the basis for Node.js. (The Node.js devs moved elsewhere many years ago due to technical issues such as Windows compatibility).

    Anyways, he had a Perl event library known as AnyEvent. It has a bit of a weird, inside-out interface compared to most other event libs, but it works really well once you get the hang of it. The problem that came up was that he didn't like the way a certain extension module used AnyEvent. He threw a tantrum and had AnyEvent detect if that extension was loaded, and die() with a big error message about his personal opinion on the matter. This broke perfectly functioning systems when they upgraded AnyEvent.

    That's when I stopped using his stuff and urged my coworkers to do the same. Can't risk that time bomb going off. Wasn't a small matter, either, as he also wrote the most common way to parse JSON on Perl.

  • Yes, since not liking or disagreeing with someone isn't the same thing as likelihood they are pushing malicious code. If something is open source that's a really good sign, because they could also push closed source code and be more likely to get away with it that way. More points if it clearly has other eyes on it; even if I am not checking over the code myself, someone probably is for a lot of projects.

    It's like "separate art from artist" except even more so because software tends to be even more quantifiable as its own independent thing than art is.

  • One my neighbors is a highly skilled craftsman. I dont use that label loosley. I'm a very competent DIYer but his work is in a class above mine. He built a metal railing around his deck and it is immaculate. Clearly constructed by someone with years of welding experience and a keen eye for detail.

    We don't really talk politics but I know for a fact that there are at least a few things we disagree on.

    That said, I would absolutely hire him to fabricate something for me if I needed it. I really doubt he does his day job because of his political beliefs. I assume he takes a lot of pride in his work and would do the same quality job for me as he would for anyone.

    It's a serious error to constantly try to distill people down to their politics. That's a divisive tactic intended to devalue and dismiss "the other side." Whoever that happens to be at the moment. Don't misunderstand what I'm saying. Politics are important and the way our governments and societies operate affects all of us. But, people are complex and multi-faceted beings with a wide variety of experiences that shape who we are. Our lives are highly contextual and consequently, so are our dealings with others.

  • If it has lots of independent eyes on the code and provides a service I need and can't find a superior solution to, sure, as I will not be needing any services that disagree with my political opinions and as long as I'm not financially supporting said developer.

  • Most of the time : Yes

    But it depends on a lot of things :

    Is there any viable alternatives ? What's the nature of the disagreement ? Is there a possibility of a fork emerging ? Etc...

    I hate google but I can't replace Android studio at work or ask my employer to stop releasing updates on google play. If the disagreement is about project governance, I would support forking, see CoMaps or Forgejo. I will avoid projects for a variety of reason, two good examples are Manjaro and Hyperland, I avoid the former because of their collaboration politics and the later because they are plain bigots.

    Politics can encompass a lot of thing and open source is a very political subject.

  • Would you drive on a road made by nazis? Your life literally depends on the quality of the road, but where does political ideology come in to this equation?

    With software though, different things are at stake, but how will ideology affect the quality? I think it does have a effect on features and how the project is run, but isn’t quality a mostly separate area?

  • Depends on the context but generally I will. Like I don't love the lead of GrapheneOS but I still use there project. But I strongly disagree with Protons ethics and many other issues so I avoid them. Really it's a question of how much I want to care and how much I disagree with them.

  • There's such different views on life that I don't think its possible to get software designed close to what you or I believe in.

    If the source is open, the code is viewable. So yes I think I can trust, at least the code.

    Also there's a saying "trust but verify". So actually check to see if the binaries your getting actually behave the way you think.

  • I can't really apply "you don't understand the code yourself" because I do.

    So I do check the code if it's something critical, but otherwise don't bother. For example the Lemmy server I'm running I didn't really check much because it can't really do any harm to me.

    But if I was running Lemmy somewhere on my home network, I'd either isolate it or thoroughly check it (but probably just isolate it from the rest of the network and put it in a VM, nobody's got the time to read other people's source code).

    Since you're asking specifically for "on my machine" I usually put stuff I don't fully trust in a VM.

  • I trust the Lemmy developers enough to use their platform hosted on external servers despite them being Marxist clowns, but I wouldn't self host without a thorough code review.

    And I'm seriously just waiting for a decent piefed app in order to ditch the platform altogether. So far voyager is the most functionally complete one, but doesn't look very appealing.

  • open source is safe.

    even non-technical people can learn how to look at issues on Github (or wherever the code is kept).

    it's like restaurant reviews: if there are dozens of people saying they got malicious food, then you have reason to be careful, even if you don't understand why the food is malicious.

    caveat: if the code is open source but no one has had time to review it, it's potentially dangerous even if there are no issues yet. it takes time for people to review the code. and there should be multiple reviewers; there's always the chance that a single malicious developer has created multiple github users. Time is on your side here.

  • If there's no alternative that has the feature set that software has, the alternatives are ultimately worse, and/or I cannot find a fork from another less egregious dev, then it's like I'd have any other choice if I need the software. If I don't need the software, good chance I might just stop using it and just uninstall.

    It's why back when I heard that the people in charge of Audacity, back a few years ago, had potential plans on adding telemetry, I stopped using it all together. Of course I kinda moved back because, as far as I know, all the forks are basically dead and the team went back on those plans due to community uproar. Now I just keep it unable to connect via firewall to be safe.

109 comments