Lacking in charisma hardly describes a person like Theo de Raadt. I've never met the man, but I doubt that someone who lacks charisma could have lead a dedicated, opinionated team through more than 40 releases (counting OpenBSD releases alone!), over a period of almost 25 years now, a team which not only developed a sturdy (if equally opinionated) operating system but also a bunch of highly successful projects like, I dunno, Open-bloody-SSH.

I mean, maybe it's not too much charisma but I'd be glad if I had only like 10% of that...

the same applies to Stallman, if you consider that the FSF has been running for 34 years.

But I believe grandparent didn't mean they lack charisma, but that they didn't have enough to swerve the general public.

I would posit that:

    impact = charisma * funding

so .1 charisma score of some faceless tech exec * 1B in VC funding goes alot more than 2.0 charisma score * 50k of grasroots funding..

But funding is also a function of charisma, among other variables.

I would posit that:

    funding = charisma * suitability for capitalism

so .1 charisma score of some faceless tech exec * 1B in VC funding goes alot more than 2.0 charisma score * 50k of socially oriented funding..

I wish i could favorite a comment.

You can. Click on the timestamp of the comment, and then click "favorite"

Woah thanks. Dunno why someone downvoted this lol

I'm not sure, but commenting on downvoting is likely to attract downvotes as it's explicitly against the guidelines.

https://news.ycombinator.com/newsguidelines.html

Fair. But thank you for the information.

With charisma, it’s not just quantity but quality. What appeals to some will repel others. De Raadt has qualities that entice him strongly to some, but are irksome to many, many more. See for example the trollish attitude to Comic Sans.

And Stallman is very off-putting to many with how unabashed and unashamed he is about some of his more extreme progressive views. Unfortunately for him, that excludes almost half of the potential support he would receive.

I'm a right-wing libertarian, and I've never felt excluded or anything like that because of his leftist views. This for many reasons:

1) He's not a hypocrite in any way. He's honest and you can tell that he has truly thought about his opinions.

2) In my country, I get bombarded with a ralentless stream of leftist ideology. The worst kind of leftism: the lazy 'slogan' leftism, from people too stupid to realize the full implications of their discourse. In comparison to them, Stallman is a moderate, thoughtful, sweet person.

3) I see his leftism as orthogonal to his software freedom ideology. I use and support free software, and I'm more pro-capitalism than Milton Friedman.

> 1) He's not a hypocrite in any way. He's honest and you can tell that he has truly thought about his opinions.

I think that's crucial. I remember he was discussing one of the aspects of software freedom with my friend and she said "I don't agree." He answered: "No problem, you have your view, I have mine, we don't have to agree on everything."

It struck me as I had expected he'll try to convince and win her over his ideas.

RMS has seen (and likely started) more flamewars in his lifetime than most of us ever will. He has clearly developed (or adopted) a meta-system to deal with differing views. If you ever talk to a smart priest, it's the same playbook: when it comes to deep beliefs, there is no point hammering something in your face, because it won't stick. Either you get to "truth" out of your own reasoning, or it's not worth it.

I don’t care about his views on those kind of politics at all. But when it comes to free software he is an ideological maximalist. Take a look at how he uses computers personally, his values (at least currently) don’t fit in with most users expectations of what personal computing should be. His contributions aren’t in question, and his voice is a valuable one to have in the choir, but he’s not a person willing to accept a middle ground, and as such the RMS way of doing things is never going to be widely accepted.

>> but he’s not a person willing to accept a middle ground

You need somebody as guideposts to stand at the extreme ends. I am glad RMS stands at his end.

From my perspective, The RMS Way and Libertarianism have this in common:

They aren't meant to be widely adopted, but mean, rather, as a critique of the status quo.

> he might as well be shoving Jews into ovens himself.

In what way is this not utterly, appallingly offensive? For shame.

It was meant to be.

Now try and think it trough instead of having knee jerk outrage as your reaction.

I don't think Stallman's political views are that extreme when you consider that a lot of free software advocates are actual communists.

I think deep down all people are communists - they all like things for free.

I disagree. Just because people like free stuff doesn't mean they want to force others (and themselves) to provide that free stuff. Some certainly do, but there are plenty who don't.

But people are "forced" to work anyway, free stuff or not.

"Forced" by human nature (hunger, cold, etc), but not forced by other people.

I’ll take a commie over a pedophile apologist any day.

It simply means he can convince some people who are open to technical arguments and do not think too differently from him. And that's about it.

Charisma means being able to persuade all kinds of individuals, regardless of their inclinations and initial positions.

Does that apply here? The BSD guys chose security over speed, as is their mantra, but companies that run linux for profit prioritize speed and cost per computing unit over security. I think 'disable hyperthreading' would be a difficult sell even for Steve Jobs.

This is why we need enormous fines for security breaches, and smaller fines just for not following best practices.

Right now, only the people worried about paying more for performance, dev time, or security engineers are listened to. We need the legal teams inside companies to have something more substantial than possible negative publicity with which to motivate the CEO and CTO as a countervailing balance.

Just like the majority of industries, we need real negative consequences for when we dump incompetent code out into the world. We've tried the "no consequences at all" plan for a long time and it's gotten us, well, continual data breaches via the easiest possible things to control. S3 buckets and databases open to the world. An inability to patch known CVEs in under 3 months (hi Equifax!).

The problem with fines is that they happen after the fact and only if the worst actually happens. Tons of companies have totally abominable security and never get breached only out of dumb luck. So you'll still get lots of companies playing Russian Roulette where they make higher profits for ten years before they may or may not suffer a breach and get fined into oblivion, at which point they file for bankruptcy and start over.

You also end up creating a lot of really perverse incentives, like nefarious companies not disclosing data breaches because disclosing them would result in liability even though that's necessary for the victims to take steps to mitigate the damage. There's a reason the NTSB does no-fault investigations.

And a lot of mediocre but still harmful incentives like cargo culting decades-old security checklists to satisfy compliance requirements even though they don't actually result in improved security, but do create a false sense of security.

More than that, the problem is that humans are fallible, so even if you do 99.9% of everything right you can still make a mistake. A company with one security vulnerability can get just as compromised as a company with ten thousand. Does it really make sense to destroy OpenBSD with fines as soon as they have one security vulnerability? Or every random company that uses OpenSSH on a day that a not publicly known 0-day is being exploited in the wild? Or a company that updates to the latest version of some software that claims to have fixed a CVE even though it didn't?

The real problem here is architectural. It shouldn't be possible for someone to breach Equifax and get all your information because they shouldn't have that information to begin with. They shouldn't exist. Your data should be yours, on your device, so that it isn't possible for someone to get it by breaching a third party because the third party doesn't have it.

If you make the fine large enough that it may cause the company to go under, you can bet they'll buy some insurance. And you can bet the insurance companies will have some standards to reduce the risk of a company getting breached, such as doing audits regularly.

For example, if Equifax faced a fine of $5B (more than 1/4 of their market cap) instead of $500M, you can bet they'd be more serious about audits in the future. However, we've conditioned business to expect minor consequences for breaches, so security becomes an afterthought. Likewise, the $5B fine against Facebook is unlikely to change anything, though a $200-300B (20-30% market cap) fine would be much more convincing.

The point isn't necessarily to ruin companies, but to set a precedent that says these types of issues will not be tolerated. It'll force companies to get insurance, and the insurance will have an incentive to avoid collection on the policy.

Using fines that large is how you get them to not buy insurance, because it would cause the insurance to be prohibitively expensive, assuming you could even find someone to sell you a policy that large.

It also doesn't make any sense to base fines on market cap because the two things have nothing to do with one another. All that would really do is cause corporations to restructure their operations to separate the entity that does all the dirty work from the one that owns all the assets, so that the entity that exists in your jurisdiction and is susceptible to being fined is renting/leasing everything and has only a nominal market cap, whereas the one with all the assets is a totally independent company that isn't even in your jurisdiction and never does anything "wrong" because all it ever does is lease and license things to a different entity.

It also seems kind of obvious that even if you could try to impose a fine equal to 20-30% of a company's global market cap, all that would do is cause the local entity declare bankruptcy, dissolve and abandon your jurisdiction without actually paying the fine, because that large of a fine would exceed the long-term value of operating there. Especially when there isn't any guarantee it won't happen again if they stay. For that matter it would tend to make companies not want to operate there to begin with, because it's possible to do your best and still fail, and that kind of uncertainty is precisely how you drive businesses away.

But most importantly, it still generally isn't the large tech companies who are the ones with poor security. It's the other industries, especially finance and government, that are collecting just as much data but then doing a much worse job of securing it. What does a fine mean to the DMV or OPM?

These large rich tech companies are really responsive to 'compliance' with the letter and spirit of laws that otherwise might cause severe losses. Look at, eg, gpdr, and google suddenly getting religion about you being able to mass-download your data. Yes you can legislate solutions to corporate behaviours.

"These large rich tech companies" are not the ones getting breached. The likes of Google and Microsoft take security seriously already. The problem is the likes of Equifax and Capital One and government databases with poor security that nonetheless contain all kinds of sensitive information that they shouldn't be aggregating and retaining to begin with and they certainly shouldn't be required by law to collect and store, even though they frequently are right now.

Also:

> and google suddenly getting religion about you being able to mass-download your data.

They had that even before the GDPR.

Letter, yes. Spirit, I'm not so sure, it feels like Google and FB want to keep doing what they're already doing, and comply where they have to, instead of reconsidering whether they actually need all that data and need these dark patters for consent (which would be the spirit of GDPR)

And the smaller-than-FAANG companies... too many checklists, contracts and theater ("GDPR requires us to disable autofill on this form") and not enough actual rethinking what they're doing and if they should change their approach to data... so we'll still be seeing plenty of breaches where they shouldn't even be having the breached data

It'll probably be a decade before we see real effect from the GDPR...

What ever incentive you create and analogy you make. The hardware / software / internet has no parrellel. I’ve been thinking about the place of software in the context of other disciplines and here is the thing. If you are thrown back to the prehistory with 50 man dream team of engineers, and are told to recreate ... something. Let’s say the train station I was just in. A rudimentary train network could be created in maybe 50 years? ( starting with, how to make steel. ) Wat ever estimate you have, the work required before they recreate the lcd screens showing the time of arrival is easily double that.

With that as a barrier to entry , the only solution I could see working for security is: public domain hardware and software.

The only solution I believe

Don't know why you're comment is grayed, we absolutely need heavy monetary penalties for the worst kinds of data breaches. The abstract idea of a class action lawsuit isn't enough, even after the Equifax breach.

Is there anything about how breaches are currently remediated that might contribute to better outcomes than if we adopted a higher and harsher penalty system?

It seems like it might create some perverse incentives as the risk escalates.

That's true. I'm sure that the perverse incentive could be resolved with some system for self-reporting and fixing.

Do you have a similar opinion in regards to crimes? Do you think that there will be less crime if there are harsher prison sentences? Are you in favor of mandatory minimum sentences?

If not, why do you think harsher punishments are needed here but not for crimes?

White collar crimes (like this should be) are all about making value calculations. Take the famous Ford Pinto memo. They decided the risk to their customers' lives was smaller (in terms of pure dollar amount, after potential litigation) than fixing the gas tank issue. If you penalize reckless security practices that lead to data breaches companies will be far more inclined to look after their customers. We already issue fines like this with COPPA, so it's not a new concept.

Street crimes have a far different cause and should be treated differently. I'm surprised I even have to type that, it seems obvious.

Do you think there would be less murders or more if there was no punishment at all for murdering people?

That's where we are atm with security breaches.

If street crime had lesser penalties than the profit of said crime, yeah, I'd be pushing for harsher sentences, yes.

That's pretty exclusively the purview of white collar crime behind a corporation though.

Compared to effectively zero penalty, probably.

In all honesty, security is just really hard and we're really bad at it. Perhaps an alternative would be to establish standards when it comes to security team headcount and salary in an organization? That way they're incentivized to follow the rules and you have more leeway to punish them if they don't follow the baseline.

The solution to being bad at security isn't to establish quotas (that's a great way to make sure DevOps engineers get rebranded as Dev-Ops-Sec engineers, and not much else), but to get better at security.

Imagine if any other field said that. "Not burning people's houses down with electrical wiring is just really hard and we're really bad at it." "Keeping bridges standing is just really hard and we're really bad at it." "Flying across the country without killing any passengers is just really hard and we're really bad at it."

Isn't GDPR supposed to be an attempt at this kind of thing, treating privacy issues as a punishable negative externality similar to pollution?

I only ask because that all makes perfect sense to me, but I see a lot of negativity about GDPR on here, that all it ever does is stifle innovation and produce ever more cookie-agreement popups.

The EU has seen poor results with fines. The big tech companies (Google, Amazon, etc) pay them with the change they find in their couch cushions. Then, they continue doing whatever they want to do. It doesn't dissuade them.

We haven't really seen the "end game" deployed by the EU yet (4% of global annual turnover fines).

I suspect when that happens the companies will launch a massive PR campaign and fight it in court but eventually lose. If they pull out of the EU or pay I have no idea.

Edit: seems like 4% of alphabets 2018 global revenue [1] is "only" 5.44 billion dollars. Wonder if it can be applied multiple times.

[1] https://www.statista.com/statistics/266206/googles-annual-gl...

Not taking anything away from your point, I think we should also have real negative consequences for the people who commit security breaches.

There is a real social stigma with regard to committing robbery, burglary, breaking and entering, etc. I feel like there isn't so much with online crime. As a community we really pile the blame on the victim for not be prepared and seem to give the perpetrators a pass for taking advantage of the situation.

Also, there is a real tension between anonymity on the Internet and the ability to identify perpetrators. It is a difficult tradeoff.

> It is a difficult tradeoff.

It's not a tradeoff we can make because the nature of computer security is that unless you fix the software and networks, you can't even identify the criminals, let alone catch them, presuming they're even in your legal jurisdiction. There's a tremendous asymmetry between attacker and defender in terms of cost+benefit, and it heavily favors the attacker.

In any event, computer crimes are punished with an iron fist in the U.S. What's not criminally prosecuted and punished very well is harassment. Yes, if social media platforms offered less anonymity, we could deal with harassment easier. But organized criminal organizations don't need the anonymity of Twitter to pilfer and fence credit card numbers; they have the anonymity of zombie networks and stolen accounts. And you can't address that with harsher penalties. If you penalized that activity with summary execution, the problem would substantially remain. And in fact in some respects it could get worse by deterring security research.

We have no choice but to fix the vulnerabilities. We have to make it more difficult to execute these attacks from a technical perspective, dramatically increasing the likelihood of identification and capture, before we can even hope of using criminal penalties as a substantial deterrent. We're a long way off from that day.

I agree with you about the asymmetry, which I was alluding to but didn't really spell out. I also agree with you that we are limited by our current software/network infrastructure and fundamental changes in that area may be necessary to get to a better security "story".

> but lacking in sufficient charisma to create more than a small following.

IMO it's not that Linus has more charisma than Theo, it's simply the network effect of one project over the other.

It wasn't Linus; it was RedHat, SuSE, and the rest of the early commercial Linux endeavours.

Right, this is what I said.

The difference is because of the license. GPL license (created by Stallman, btw) won over BSD license.

The emergence of a GPL-licensed kernel was inevitable. If Linux didn't appear when it did, some other kernel would appear. Maybe folks would have more motivation to work on Hurd, and it would be the main kernel for everything now.

Why is that the case? Isn't the BSD license more relaxed? I would think companies like RedHat would have liked the BSD license more.

Its more relaxed nature is the problem. Linux is strong not because of Red Hat or any of the other contributors individually, but from their collective efforts--which they're required to make open by the GPL. BSD doesn't have this, so you end up with companies like Apple building whole ecosystems around a BSD kernel (not so much now, but once upon a time) without improving BSD as a whole at all.

It was inevitable insofar as, at least, the GNU project was intending to make one.

Seems like the history of science and technology is littered with crackpots (alchemists, egotists, etc) who made amazing discoveries.

"lacking in charisma" sort of implies that they have too little, but still some and doesn't really account for how they actively piss off other technologists and push them away, however right they may be technically.

Tannenbaum perhaps somewhere in the middle. Huge install base, but little noteriety.

Minix only has a "huge install base" because of Intel ME firmware junk.

Its not really meaningful, because the firmware could be pretty much any arbitrary OS and it would make zero difference to any end user.

Tannenbaum himself didnt even know about Intel using MINIX in their ME firmware until recently, so that should show you how much relevance it has.

This is, at least in part, a result of MINIX using a highly permissive license. It’s easier to use an open source OS in relative secrecy if you aren’t required to release your modifications. And an organization with deep technical expertise like Intel would not likely need much assistance from the community for their implementation.

> This is, at least in part, a result of MINIX using a highly permissive license.

Not at all. MINIX was actually Intel's second choice, they tried first to fit Linux into their new x86 based ME. But the maintainers were uncooperative:

https://www.phoronix.com/scan.php?page=news_item&px=MTY4MzM

Intel then submitted similar patches to the MINIX kernel, which subsequently got accepted.

https://www.cs.vu.nl/~ast/intel/

And this shows that the license really isn't that critical. Vendors don't like to maintain operating systems, so they have a vested interest in upstreaming their modifications. Why maintain something yourself if you can get someone else to do it?

BSD licensed projects see plenty of contributions, they're just not as popular as Linux because of historical reasons. I and most BSD fans blame the AT&T lawsuit for BSD losing popularity and Linux gaining popularity. That being said, BSD is still quite popular, though somewhat niche.

Companies not upstreaming code will happen regardless of the license. Plenty of companies maintain Linux change sets because they're not obligated to release them, but plenty more upstream their changes when not strictly necessary. It just depends on the value proposition of releasing improvements.

They could still require redistributions to include a copyright notice. I think the real issue is that Intel might engage in product binning without changing the source code.

I'm pretty they just forgot. MINIX is under a license that does actually still require a copyright notice, and I'm pretty sure that after the news came out about it being used, they went and fixed the fact that they'd apparently forgotten to include it.

Yes, but it is significant that an industry leading company chose it over a RTOS or other embedded system for a high volume project.

Why? Intel hasn't contributed anything to the project to my knowledge.

I know they at least formally requested some changes, but I don't know if that means they contributed. I'm guessing they didn't want the public to know they were using it, likely because of the nature of IME.

But with that in mind would Android count for Linux?

I'm still looking forward to the day when someone figures out how to install X11 on Intel ME, thus ushering in the Year of the MINIX Desktop rather instantaneously.

I think Stallman is more of a Tiresias

How so? I had to look Tiresias up on Wikipedia, a blind prophet, but I still don't see the connection. Would it be possible for you to please explain?

Tiresas' prophecies come true because of a poetic or literary recursion built into the Oedipus cycle or the Oresteia or whatever. (I'm AFK, where K means "my library.") So when the guy to whom Tiresias prophecies that said guy will commit patricide in fact kills his father, he does so because he tried to not kill his father, and in attempting to escape his destiny, inflicted it upon himself. Stallman's apocalyptic ravings have had their basic gist "come to pass," in this interpretation, because of the actions of the developer community or tech community or whatever, in the struggle to develop software, which software has spiraled beyond all reasonable control, even as the guy killed his father by trying not to do so. Thus this wise guy is hella Greek. And this parent poster is also a wise guy. And this patricide is about to become all-too-ironic, because throwing out one-liners of the parent's (post's) sort is a bleak literacy, which I have now killed. And literacy rises like a phoenix in my child post, and the guy who kills his father is blinded as punishment, and becomes a wandering seer himself. So there.

TLDR is that prophecies are self-fulfilling. Tiresias is the OG self-fulfilling prophet.

The analogy of Cassandra is inferior because:

1. Cassandra is usually at the center of attention, an object of desire to Agamemnon and his troops, an object of hatred and jealousy to Clytemnestra and Aegisthus. Tiresias isn't nearly as ostentatious, and mostly exists passively in the background, waiting until someone else asks his opinion on something. Tiresias gives off a kind of awkward vibe, much like Stallman, compared to Cassandra, who's totally a social butterfly.

2. Cassandra is cool and sexy, Tiresias is a blind old dude. Richard Stallman eats stuff off his foot and often looks like he hasn't showered since the last emacs release.

3. Cassandra's prophecies are very straightforward, Agamemnon and his buddies understand what she says and even listen to her to some degree, they just don't care enough to do anything. Tiresias is much more cryptic and is always derided until the denouement when it is revealed that he was right all along, just in a way that nobody else could have foreseen. Likewise, Stallman's insights into the future of our technological dystopia seem absurd and maniacal until they inevitably come true a few years later.

I like your comment though =)

I rather enjoyed this exchange between you folks; thanks.

djb also comes to mind.

lol, I enjoyed it, but you might consider citing any greek mythology when its obscure and easily confused with a database.

The story of Cassandra is one of the most well-known of the Greek myths and the allusion a standard rhetorical device in at least the English language. The fact that anyone would have confused the reference with a database in this context makes me sad for the state of 21st century humanities education.

A corollary is that our field is not as coldly rational and technical as we'd like to think.

> History will show that Theo was right in a manner similar to how Stalman was right: technically correct analysis and eerily accurate predictions, but lacking in sufficient charisma

Your assessment of charisma is foreign to me. I cannot imagine anybody who is more charismatic that these two men, theo and rms.