I guess the takeaway from the xz backdoor situation is:

If you’re an open-source project maintainer, and somebody starts getting on your case for not doing enough free work for them, you reply β€œbig Jia Tan energy there” and then block them forever.

@zarfeblong Hard cases make bad law. I'd want to be careful about adopting such a rule.

@mike @zarfeblong

Thing is, it's a good rule to have even if there is no malicious intent.

As a volunteer maintainer, it is wise to always put your sanity and mental well being above the project. If you think you have the energy to deal with rude folks, by all means proceed, but do ensure you *can* handle them.

Personally, I've found the "returns" for dealing with them to be in the net negative. So I ignore/block them. I owe them nothing, even if they spent 10 days writing a beautiful patch.

@beetle_b @zarfeblong I don't really disagree, but ...

If I spent ten days writing a beautiful patch only to have it rejected because of the tone of my communication, I don't the lesson I learned would be "I need to improve my tone". It would be "It's a waste of time trying to contribute".

@beetle_b @zarfeblong And in fact already knowing that there are people who think the proposed rule is a good one is enough to discourage me from investing my own effort into other people's projects. Not sure what to make of that.

@beetle_b @zarfeblong @mike if you genuinely think you'd ever have to worry about this, the takeaway should be "maybe I shouldn't be an asshole to people online". Please don't spray water on the slope just to make it slippery; it's hard enough to determine intent of text.

This kind of rule is "don't be an asshole". If you think your method of communication is going to be seen as "being an asshole" by some projects, that's cause for reflection, not anger.

@KayOhtie @zarfeblong @mike

Some years ago, I deep dived into the communications, studying as much as I could.

A thing that many books point out: There's no surefire way *not* to trigger people. Much of the focus is on having the exploratory conversation after being triggered.

So I mildly disagree: Yes, one should introspect. But if a maintainer thinks you're being an a$$hole, it's not a given that you're the problem.

Still - it's his project, and you have to respect that authority.

@mike @beetle_b @zarfeblong If you want to talk me, me, me, let's talk about you. Are you so important that this conversation gets to be framed around you, your feelings, and your contributions, personally?
@mike @beetle_b @zarfeblong You don't seem like much, at least. If Mike Taylor is suggesting he won't contribute to my project because of some vague notion that his feelings might possibly theoretically be hurt, should I be sweating?
@TheEntity @beetle_b @zarfeblong Please, feel free to care just as little as you wish. If you think I'm the only person out here who feels this way, I think you are very very mistaken. I am just the one who's saying it out loud β€” and regretting it. I won't be doing that again: I'll just join all the other silent non-contributors. I assume that's what you wanted, so I guess we both win? /shrug/
@mike @beetle_b @zarfeblong bluhhh?? bhbubuddddururhburr? buhhhhhh
@mike @beetle_b @zarfeblong sorry i posted this to the wrong thread
Reading Comprehension Tips – Learning Center

Do you ever feel overwhelmed with the amount of reading you have? Do you ever have trouble staying focused and motivated while reading? Do you sometimes have difficulty understanding and remembering what you read? If so, you’re not alone. Many … Read more

Learning Center
@mike @beetle_b It turns out social skills, including β€œbeing nice to people”, are important in this field.

@zarfeblong @beetle_b That's true. But project maintainers are also perfectly capable of being jerks, and I find myself thinking the Selfish Rational thing to do it not put myself at the mercy of their capricious whims.

No-one comes out of this ahead.

@mike @zarfeblong

Agree. Some really are jerks - I can give examples πŸ™‚

Thing is, contributing to a volunteer SW project always has been putting yourself at the mercy of their capricious whims.

I certainly don't put much effort into contributing, either - beyond bug reports. It's not a "loss" for these projects that people like me don't contribute, because this has always been the reality.

When Free SW took over the world, it did so despite this perceived flaw.

@beetle_b @mike @zarfeblong Conversely, putting free software out there puts you at the mercy of the whims of random strangers. Sometimes positively, sometimes negatively. The former generally outnumber the latter, in my experience, but the latter have much more impact on the energy and willingness to continue.
@jelte @beetle_b @zarfeblong All true. There are complex weights and balances at play here.

@mike

So don't "put yourself at their mercy" then

Looking at your profile it's not anything you've ever concerned yourself with anyway

Which never stopped anyone from being a pretentious, pedantic twit

cc @zarfeblong @beetle_b

@FinchHaven @zarfeblong @beetle_b This seems like rather an extraordinary reply. I've not seen anyone on this thread being a pretentious, pedantic twit; and anyone who cares to take a moment figuring out who I am will know that I have created, maintained and distributed rather a lot of open-source software in many fields, going back to the 1980s. Also a bunch of open specifications, and open-acces scholarly works.
@mike @beetle_b @FinchHaven @zarfeblong ah see, I think I figured out why you didn't notice anyone being a pretentious pedantic twit; big Jia Tan energy there
@mike @zarfeblong @beetle_b then don't submit to those projects. Forking a project just so you don't have to deal with asshole maintainers is good and we should do it more.

@mike @zarfeblong

If only one project rejected you for that reason, I understand your thought process. If the plurality of them did, I think you may reconsider ;-)

Beyond that, one should *never* spend 10 days on a patch hoping that someone out there will review it. Get some kind of a commitment from them first!

As always, one of the benefits of permissive licensing is that you can always fork the project, apply your patch and (if desired), announce it to the world.

@mike @beetle_b @zarfeblong thing is: people who actually spend 10 days writing a beautiful patch, tend to not behave like entitled twats. Those who do, find many excuses not to contribute in a meaningful way.

At least, that has been my experience.

@JorisMeys @beetle_b @zarfeblong Fair point. The real issue for me is not so much that I expect my contributions to be offhandedly discarded; it's that the possibility of that reduces the likelihood of my even getting started.

@mike @JorisMeys @zarfeblong

Yes, a classic example of differing expectations.

Me: If you wrote a PR, you solved a problem you had. Now I decide whether I want it. If I ignore it, I'm not hurting you.

Reality: You could have solved the problem sloppily with poor code if it was only for your private use. But for a PR, you expended effort polishing it, and want that acknowledged.

Still, I go with: Inform the owner of your fix. Ask first if they're interested. Only then should you polish it.

@beetle_b @JorisMeys @zarfeblong That all makes sense. At least in the case that a PR was written primarily for the benefit of its author.
@mike @beetle_b @zarfeblong
You can always fork it, my dude.
@Okanogen @beetle_b @zarfeblong That is true, but not necessarily practical. And almost no use at all if the goal was to give something back to the community, rather than to scratch my own itch.
@mike @beetle_b @zarfeblong
And yet you will assign a maintainer homework, and blame them for being lazy, stubborn, unreasonable, uncaring or a dictator if they don't jump when you say "hop!".
@Okanogen @beetle_b @zarfeblong Screw it, no, I won't. I'll just not contribute to projects owned by people other than me and my friends. It's the safe course. You've persuaded me.
@mike @beetle_b @zarfeblong
Sounds like the best course for everyone, but I doubt you will understand why.

@Okanogen @mike @zarfeblong

Passive aggressiveness isn't winning you any Brownie points.

@beetle_b @mike @zarfeblong
Mike blocked me. I guess I didn't communicate in a way he appreciated.

@Okanogen @mike @zarfeblong

I was tempted to as well.

@beetle_b @mike @zarfeblong
Ah. Well I'm not that important and you wouldn't be missing much.
@[email protected] @beetle_b @zarfeblong
Very interesting is the arguments used by the F-droid attacker are nearly verbatim what Mike has used here. "People won't want to contribute if this is how their contributions are treated." "I have a full time job", "Why aren't you respecting my work.".
Read through here:
https://www.404media.co/xz-backdoor-bullying-in-open-source-software-is-a-massive-security-vulnerability/
Bullying in Open Source Software Is a Massive Security Vulnerability

The Xz backdoor and a near miss on the F-Droid app store show how the entitled attitude of some people in the open source community can be used to push malicious or insecure code.

404 Media

@Okanogen @zarfeblong

You're cherry-picking from Mike's toots.

@mike @zarfeblong

On my publicly facing projects, I add an explicit disclaimer stating they can submit bug reports/patches, but I don't commit to looking at any. They have to decide if it's worth engaging with me.

What kills me is that I shouldn't *have* to put any such disclaimer. Rather, maintainers who want to be very active should be the ones explicitly stating their commitments.

Looking at the bulk of Github projects, my stance is the majority one. Thus I shouldn't need a disclaimer!

@beetle_b @zarfeblong Yes. A couple of years ago, I started sketching out a proposal for project maintainers to formally and efficiently state their attitude to different kinds of contributions β€” https://reprog.wordpress.com/2022/12/02/proposal-a-controlled-vocabulary-for-attitudes-towards-pull-requests-forks-and-bug-reports/ β€” but it didn't really go anywhere.
Proposal: a controlled vocabulary for attitudes towards pull-requests, forks and bug-reports

Yesterday I read Just Say No, a post by Jeff Geerling who maintains a bunch of popular devops project on GitHub. His position, which I am totally sympathetic to, is that maintaining a project is a …

The Reinvigorated Programmer

@mike @zarfeblong

I'm conflicted. I applaud your effort and your intention, and yet I see it as a symptom of the main problem: That many perceive the unspoken "default" is that project maintainers should engage actively with random people (with or without a PR).

My argument is that when a project doesn't make an explicit statement like the one you advocate, there should be no expectation of a response. If a maintainer *wants* contributions and PRs, let them state it explicitly.

@beetle_b @zarfeblong "I see it as a symptom of the main problem: That many perceive the unspoken "default" is that project maintainers should engage actively with random people."

I would say, rather, that the problem is there IS no default. We may wish there was, but there isn't. (And different people might well have different ideas about what the default ought to be if there way one.)

So I think it's best to be explicit.

@mike @zarfeblong

Agreed: It's always best to be explicit.

@mike @zarfeblong while it's one to apply judiciously, setting a few boundaries early and firmly is always worth considering, and when someone's clearly just gonna be a drain then intent doesn't really matter
@zarfeblong Sounds like the best defence we have for the foreseeable future!
@zarfeblong lol true. but if they were truly part of an APT group they may just come back at you via a different puppet or agent

@zarfeblong the mastodon 4th pedantry division really got deployed for this one, huh.

Open source is a long game and no pull request is worth putting up with pushy jerks.

@zarfeblong It's very rare I block someone and that's usually because they are a nuisance who does nothing but comment (wrongly usually) on bug reports and make proposals with no code.

Otherwise I try and respond constructively (things like "great, please submit patches" - which sometimes gets 'you should X' people to actually do X) and at times "That's not where I want to go, but please fork the project and have fun if you want to"

@zarfeblong I see a lot of submissions from bots these days. What they lack in rudeness they make up for in persistence

@zarfeblong

Ticket marked as Jia Tan

Ticket marked as Closed

@zarfeblong My policy has always been to express my regrets that it's not working out and "on behalf of management" to offer them a refund of twice what they paid, upon submission of a receipt.

Some laugh and get it, the rest go away. Bye, the rest.

@zarfeblong I consider myself very lucky that I've only experienced the "big Jia Tan energy" problem once - 20 years ago, when a contributor wanted his changes added ASAP but I was on a one-month vacation in Paris. I did it anyway, at night on a DSL line. I think the implicit threat was that if I waited until I got home to do the work, he would fork the project. In hindsight I should have told him "you do you" and blocked him forever.