Conversation

Notices

1. Christine Lemmer-Webber (cwebber@octodon.social)'s status on Friday, 28-Jun-2019 12:35:08 UTC Christine Lemmer-Webber

   • Alexandre Oliva

   @lxoliva TBH I think it's the wrong perspective. Look at event-stream in npm as a good example of something that was in theory free software, and from the trusted upstream, being backdoored.

   See Ka Ping-Yee's thesis on why auditing can't catch intentionally placed malware. http://zesty.ca/pubs/yee-phd.pdf

   We need software freedom. But software freedom *is not enough* to protect and secure users. For the full suite of user freedom, we need security too; better architectures are also necessary for that.

   • Christine Lemmer-Webber repeated this.
   • Christine Lemmer-Webber (cwebber@octodon.social)'s status on Friday, 28-Jun-2019 12:40:07 UTC Christine Lemmer-Webber

     in reply to

     • Alexandre Oliva

     @lxoliva It's *not possible* to audit the entire free software codebase you run on your computer. Bad news: nobody has done it. ESR's "may eyes make all bugs shallow" quote doesn't scale to the level of software we have. Of course it helps though, and the *more important* thing that software freedom delivers is that software can't get away with *known* abuses; the community can fix it. Not so with unknown ones though.

     Christine Lemmer-Webber repeated this.
   • Christine Lemmer-Webber (cwebber@octodon.social)'s status on Friday, 28-Jun-2019 12:40:53 UTC Christine Lemmer-Webber

     in reply to

     • Alexandre Oliva

     @lxoliva My challenge to you would be: stop making it a free software vs secure architectures debate. Instead make it a "look at what we can do if we *combine* free software and secure architectures" argument. That's a lot more powerful (and a lot less victim blame'y).

     Christine Lemmer-Webber repeated this.
   • Christine Lemmer-Webber (cwebber@octodon.social)'s status on Friday, 28-Jun-2019 12:44:51 UTC Christine Lemmer-Webber

     in reply to

     • Alexandre Oliva

     @lxoliva I want to be clear: I don't think it's just you. I think the default mode of approaching when we hear about security vulnerabilities is victim blaming in our society, and it pisses me off. With retrospective, we can always see the bugs and problems. But not everyone is an expert, first of all, and it's impossible to identify many vulnerabilities up front... *even in free software*.

     Let's take a better approach. Let's fight for secure systems by default. Everyone wins by that.

     Christine Lemmer-Webber repeated this.
   • Charles U. Farley (freakazoid@retro.social)'s status on Friday, 28-Jun-2019 14:45:48 UTC Charles U. Farley

     in reply to

     • Alexandre Oliva

     @cwebber @lxoliva The fact that it's "vs" is also an ESR legacy. When you promote "open source" as a better development methodology instead of "free software" as a moral imperative, you become vulnerable to this sort of argument.

     Chris, have you read Vinge's Rainbows End? The SHE and the system they'd built on top of it vs Free Software might make a good show topic.

     Christine Lemmer-Webber repeated this.
   • Christine Lemmer-Webber (cwebber@octodon.social)'s status on Friday, 28-Jun-2019 18:28:56 UTC Christine Lemmer-Webber

     in reply to

     • Charles U. Farley
     • Emacsen

     @freakazoid YES! I've actually been wanting to do so for a while. In fact I just convinced @emacsen to order this book this week so maybe we could do an episode about it! Glad to hear that audience members are already interested in it :)