News for hackers. Stuff that matters.
Re:Putty maintainer on his attitude towards security and ope... by hutzlibu on Sunday December 12, 2021 @03:06PM (#29533093)
"reminding colleagues that using OSS means we have to own and maintain the software whether the original community/author does or not"

No, we do not have to do this. We wouldn't get anything done, if we tried to maintain our full oss stack. Where would you start? In the linux kernel and move your way up to chromium/firefox? Have fun out there.

"There seems to be a hesitance to fork abandoned or slow moving software to update/fix issues "

And it is often easier to reimplement something from scratch, than taking up some underdocumented mess and trying to make sense of it.

So I would rephrase that to

" using OSS means we can own and maintain the software whether the original community/author does or not."

Re:Putty maintainer on his attitude towards security and ope... by Talanes on Sunday December 12, 2021 @07:24PM (#29535189)
>No, we do not have to do this. We wouldn't get anything done, if we tried to maintain our full oss stack. Where would you start? In the linux kernel and move your way up to chromium/firefox? Have fun out there.

Seems a little disingenuous to assume that GP meant that everyone should fully maintain their own OSS stack, when their comment could be read far more reasonably as a solution for when those processes aren't serving your needs entirely.

Re:Putty maintainer on his attitude towards security and ope... by hutzlibu on Monday December 13, 2021 @02:16AM (#29537480)
" could be read far more reasonably as a solution for when those processes aren't serving your needs entirely"

Yeah, that is why I rephrased it, to with OSS you can own and maintain your full stack.

Op said "must".

Re:Putty maintainer on his attitude towards security and ope... by zamalek on Sunday December 12, 2021 @03:38PM (#29533377)
It's much simpler: if you run into a missing bug/feature, report it to the maintainers and ask them to assign it to you.

If each individual licensee is itching their own scratches, then there's a really good chance the entire codebase gets love.

Absolutist approaches are the death of all good things. "Some" is better than "none."

Re:Putty maintainer on his attitude towards security and ope... by hutzlibu on Monday December 13, 2021 @02:26AM (#29537534)
"Absolutist approaches are the death of all good things"

Agreed. Hence "can" and not "must".

Re:Putty maintainer on his attitude towards security and ope... by nijave on Tuesday December 14, 2021 @10:09PM (#29561603)
>No, we do not have to do this. We wouldn't get anything done, if we tried to maintain our full oss stack. Where would you start? In the linux kernel and move your way up to chromium/firefox? Have fun out there.

People (sysadmins) have been doing this for years--it's nothing new. Software doesn't break that often. You generally start with wherever you're hitting the bug. Maintaining, running, and operating software is significantly different than writing from scratch (and generally less labor intensive)

What do you do when you hit a bug in production caused by some OSS? Throw your hands up and tell management you opened an issue on the issue tracker?

Re:Putty maintainer on his attitude towards security and ope... by deadbunny on Sunday December 12, 2021 @08:02PM (#29535413)
Eh, I've submitted patches for everything from the kernel to bash scripts because of bugs I've run into at work that really affected us which we needed to fix ASAP.

Sure I didn't have to but isn't that the point of open source?

Re:Putty maintainer on his attitude towards security and ope... by hutzlibu on Monday December 13, 2021 @02:24AM (#29537521)
There is a big cost of context switch. If you are such a genious, that you can just jump around in entirely different codebases fixing entirely different set of problems, in a way that actually improves things, than hats of to you, because I can't. I am not bored and I am fully occupied maintaining my own OSS codebase and I doubt some random dude could just come and fix a problem there (unless it is a really trivial one).