Earl C. Ruby IIIApr 3, 2024
Meredith Whittaker

I keep brooding on the way the xz backdoor was enabled in significant part via weaponizing the FOSS culture of shitty behavior and abuse.

Yes, there're other pathologies at work here (the big tech capitalist pillaging of the commons, etc).

But what is striking is that the uncool, mean standards of FOSS conduct that many of us have decried for years, & that many defended as authentic, tough, etc., ended up not just being exclusionary loser behavior, but a significant attack surface.

Apr 2, 2024 at 5:10pmWeb
Show threadJPApr 2, 2024
@Mer__edith lots of parallels with admin + moderation work in post-centralized community spaces - individual admins having to take all kinds of shit both in public and behind the scenes, resolve disputes, make tough calls... all with little to no resources. obviously these spaces are also opportunities to do things better than the big toxic apathetic platforms, but the costs are also more private, and therefore so are the risks.
Show threadVincent TunruApr 2, 2024

@Mer__edith Unfortunately the only proposed solutions I've seen to deal with FOSS maintainer abuse come down to "why can't everyone just...", which isn't a solution at all. Even if 99% were to behave perfectly, 1% is still enough for maintainers of any somewhat-often used project to encounter shitty behaviour regularly.

Add to that the fact that that behaviour sticks with you far more than a compliment, and we've got.. Not a great situation.

Show threadÓscar Morales VivóApr 2, 2024
@VincentTunru @Mer__edith You don't need "everyone to just…" you need "most people to not tolerate this bullshit whether directed at them or someone else"
Show threadBen RosengartApr 2, 2024
@MyLittleMetroid @VincentTunru @Mer__edith This. We don’t need universal perfection, we need better *norms*.
Show threadVincent TunruApr 2, 2024

@fivetonsflax @MyLittleMetroid

I agree with you, but that is still an "if only everybody just..." solution. People have been calling for better norms forever, and yet here we are 😢

Show threadÓscar Morales VivóApr 2, 2024
@VincentTunru @fivetonsflax The whole point of norms is that they aren't followed by everyone but they are socially enforced by the majority.
Show threadBen RosengartApr 2, 2024
@VincentTunru @MyLittleMetroid I don’t think changing these habits is such an intractable problem.
Show threadVincent TunruApr 3, 2024
@fivetonsflax @MyLittleMetroid I hope you're right! But I do wonder why it hasn't happened so far, and why/how it would happen this time around.
Show threadBen RosengartApr 3, 2024

@VincentTunru @MyLittleMetroid I believe there is a generational component. Open source communities have inherited a lot of values from Silicon Valley engineering culture. As open source becomes more important in the world and more widely used, not all those values are serving us well.

I believe that open source scenes can take feedback from people who aren't my demographic (middle-aged straight white men) and become fairer and more welcoming.

Show threadMarioApr 2, 2024

@Mer__edith

"The lone hacker trail also seems unlikely given the time and resources invested, or even the capabilities of exploiting such a massive flaw. An intelligence service, a powerful group of hackers, or even a state are more likely suspects…"

Source: https://gettotext.com/who-is-jia-tan-and-how-this-hacker-almost-controlled-millions-of-websites/

Why am I not surprised? 🧐

2024 - Who is Jia Tan, and how this hacker almost controlled millions of websites!

But who is this Jia Cheong Tan? Unsurprisingly, many have investigated this person since the discovery. All three parts of its displayed name are certainly

Gettotext.com
Show threadWren ReillyApr 2, 2024
@Mer__edith One makes more money in FOSS as an apologist and enabler for abuse. Opposing it, on the other hand? Better have a backup plan.
Show threadRaven OnthillApr 2, 2024
@Mer__edith nodnodnod. there is too much focus on individual aggression and too little focus on cooperation.
Show threadGeoffray LevasseurApr 2, 2024
Makes me think about the bullrun program from the NSA. I wonder if there's a connection somewhere.
Show threadTodd A. Jacobs | RubyistApr 2, 2024

@Mer__edith I'm not entirely sure I understand what you're saying. Popular #FOSS is generally higher-quality than commerical closed source apps and libraries, but any tool with a low bus factor has higher inherent risk than something with tons of active contributors.

I've never had to maintain a FOSS tool with enough stars to have to please anyone but myself, but there are *many* tools we all rely on that have very few maintainers that understand the whole code base. What's different here?

Show threadKhyrieApr 3, 2024
@Mer__edith yeah, the attitudes are why I've been interested, but never followed through on any OSS contribution
Show threadmav Apr 3, 2024
@Mer__edith
I brought this up to an "open source evangelist" and unsurprisingly got yelled at, heh
Show threadStacey CampbellApr 3, 2024

@Mer__edith I worked for SCO back in the late 80s and early 90s, and a (now) extremely well known open source evangelist was trying to get the word out about open source, including getting a major project he was running in use on SCO Unix.

There was an incompatibility between that project and the package that SCO already shipped that did the same task. But, in theory both packages could be used at the same time if the incompatibility was resolved.

I wanted to try the new open source tool, so I emailed the maintainer (long before we used that word), and proceeded to have a brief and downright shitty exchange that didn't end up solving the compatibility problem.

After that I decided to avoid that individual from that day on, which I have. That was my introduction to FOSS culture.

I should point out that before Internet and search engines were in widespread use, most strangers I interacted with online assumed from my name I was a woman. The ick factor was high at times. Not sure if that influenced that crappy interaction outlined above, but later news about that individual makes me think so.

Show threadLeonApr 3, 2024
@Mer__edith it would be very, very FOSS if the thing required to change toxic culture was it proving to be a security vulnerability
Show threadmattApr 3, 2024
@Mer__edith true, but, also not true. I mean, in my life of working in and adjacent to FOSS I've had some shitty experiences, but I've also had the best ever -- high floating on clouds for 3 days kind of best. It's specific communities that are toxic, or wholesome.
Show threadhappyborgApr 3, 2024

@Mer__edith I don't get why anyone would tolerate shitty behaviour in a public context. Where there are other ties, like family you may choose to try harder etc, but in public why?

It's a serious question because helping people stop doing that would be a big positive step. I don't tolerate it anywhere, not IRL, not on SM and wouldn't on my FOSS 'properties'. (Lucky for me the latter are not yet popular enough to have attached that, but I do expect it as things take off.)

Show threadRue MohrApr 3, 2024
@Mer__edith did anyone trace any other contributions by that coder?
Show threadGeoff WinklessApr 3, 2024
@Mer__edith interesting. I'd taken exactly the opposite from it: that maintainers who don't have to conform to CoCs can more easily turn around and tell people to sod off if they don't like a particular style or method. I hadn't considered that maintainers could use the CoC to stop such.
Show threadlj·rkApr 3, 2024

@Mer__edith Not only that, it has been defended as *meritocracy* and* a filter* to keep all the "noobs" out and create code that's *truly the best*.

Odd.

Show threadFenneladon PrivacyasaurusApr 3, 2024

@Mer__edith Reminds me of this classic
- misogynists make great informants: https://truthout.org/articles/why-misogynists-make-great-informants/

-

Why Misogynists Make Great Informants

The state has already understood a fact that the Left has struggled to accept: misogynists make great informants.

Truthout
Show threadHans-Christoph SteinerApr 5, 2024
@Mer__edith seems pretty off base to call that FOSS culture. In my 30 years of working in FOSS, the people who are actually immersed in FOSS are much nicer and more helpful than in general. It is the people who treat FOSS contributors of any kind as some kind of service provider that are the shitty ones. Way back, I worked in corp tech support, and got treated shitty. So often, I see people laying on that kind of crap on volunteer FOSS devs on the internet. That is not FOSS culture.
Show threadMeredith WhittakerApr 5, 2024
@eighthave eh, I mean...read the long thread of comments and you'll see many people who disagree. A shitty culture in general isn't erased by a subset of kind people operating within that culture.
Show threadHans-Christoph SteinerApr 5, 2024
@Mer__edith Try to find the stressed out, overworked dev who implemented some piece of macOS or Google that annoys you. You can't, they are hidden within the corp. That doesn't mean they aren't an asshole, it just means you can't interact with them. FOSS devs are vastly more likely to operate in public and respond to feedback from anyone. So there is a data bias at work here.
Show threadRaiderTwix99Apr 6, 2024
@eighthave @Mer__edith I won't go into detail, but this threat (and some bits on Pedagogy I read earlier) helped me understand a part of society a lot better.
A honest "thank you" to the both of you!
Also this is my favorite piece of prove that social media can help us all to thrive and... Mature
Show threaddevnoname120Apr 21, 2024
@Mer__edith Could you expand on this? I'm struggling to understand what you mean with “mean standards of FOSS conduct” and how it actively enabled the xz backdoor fiasco to happen.
Show threadMeredith WhittakerApr 21, 2024
@devnoname120 there are many people providing a lot of additional context in the thread.
Show threaddevnoname120Apr 25, 2024
@Mer__edith I read the whole thread and it's mostly vague statements taking “FOSS culture” (whatever this means) as a scapegoat, just like some people claim that capitalism is the root of *all* evils. The abusive behavior that you see is more indicative of human behavior than FOSS. You see the same thing happening in pretty much every associations, cooperatives, political initiatives, boy scouts, you name it. It's misguided to point fingers at FOSS as if it enabled worse behavior than elsewhere.
Show threadTobyDec 19, 2024
@Mer__edith But but but... I have the right to be rude! ESR says so on account of "muh freedoms".
Show threadpoetasterDec 19, 2024
@Mer__edith as a foss maintainer I would interject that this xz case is far from norm. It's dramatic! Yes, deserves attention, but most of 'us' grunts doing 'the work' just resent getting smeared. writing this in tooter, the gplv3 mastodon client I maintain . This thread is full of polemics and little substance.