Some naive questions [LWN.net]

Some naive questions

Posted Nov 21, 2024 11:36 UTC (Thu) by bluca (subscriber, #118303)
In reply to: Some naive questions by LtWorf
Parent article: PyPI now supports digital attestations

> You don't know if the project works, if it changes API every week, or has malware in it.

...because that's not the point? The point is to answer the question of whether basic stuff that is known to cause problems in many cases happen or not. If you are not interested in such things, then don't look at it. Many users are however very interested in knowing whether a project they are considering uses peer-reviewing or not, whether it force-pushes to main or not, and so on and so forth, and having a standardized way to show that is useful to those people.

to post comments

Some naive questions

Posted Nov 21, 2024 16:21 UTC (Thu) by LtWorf (subscriber, #124958) [Link] (24 responses)

What's the point of not pushing to master if it calls into C code and never checks a buffer boundary though?

I'd rather use code that doesn't segfault and they can push wherever they want.

Some naive questions

Posted Nov 21, 2024 16:34 UTC (Thu) by bluca (subscriber, #118303) [Link] (12 responses)

> What's the point of not pushing to master if it calls into C code and never checks a buffer boundary though?
> I'd rather use code that doesn't segfault and they can push wherever they want.

Those are non-sequiturs. Project management practices and code quality are not mutually exclusive. The point of this is to have a standard, certain way of saying "this projects follows the following project management best practices". It doesn't mean it's perfect or bug-free, and it's not meant to.

Some naive questions

Posted Nov 21, 2024 16:47 UTC (Thu) by LtWorf (subscriber, #124958) [Link] (11 responses)

Can you explain what is the point of project management practices for projects which involve 5 people to be very very very abundant?

And how does project management transfer to making the library better/safer exactly?

Some naive questions

Posted Nov 21, 2024 17:11 UTC (Thu) by bluca (subscriber, #118303) [Link] (10 responses)

> Can you explain what is the point of project management practices for projects which involve 5 people to be very very very abundant?

Sure: ensuring changes go through CI, ensuring there are always at least two pair of eyes on any changes, ensuring git history doesn't get rewritten, and so on. Some people value these things. If you don't, that's fine: don't use such workflows and don't integrate in such scoreboard.

> And how does project management transfer to making the library better/safer exactly?

On average, CI, reviews and so are well known to increase quality, and that's why they are industry-standard practices. It doesn't mean the code magically gets perfect, and nobody says it does.

Some naive questions

Posted Nov 21, 2024 17:31 UTC (Thu) by LtWorf (subscriber, #124958) [Link] (9 responses)

This is similar to "we want kids to learn logic, so we teach them latin", instead of "we want kids to learn logic, so we teach them logic"

Some naive questions

Posted Nov 21, 2024 17:52 UTC (Thu) by bluca (subscriber, #118303) [Link] (7 responses)

No, this is like "we want projects to use known-good common industry-standard practices, so we tell them to use known-good common industry-standard practices"

Some naive questions

Posted Nov 22, 2024 17:08 UTC (Fri) by LtWorf (subscriber, #124958) [Link] (6 responses)

"We want hobby projects to behave like professional projects, but without salary, but sucking all the fun away and having all the work bureaucracy"

There, I translated it to make it clearer :D

Some naive questions

Posted Nov 22, 2024 19:25 UTC (Fri) by raven667 (subscriber, #5198) [Link] (5 responses)

If it's a hobby project then why would you care about any of this stuff? This kind of tool is mostly relevant for commercial software vendors who are charging money and need to manage the risks associated with licensing and incorporating FOSS into their products, to encourage them to be more choosy and not randomly grab stuff just because they can without thinking more about the lifecycle and future maintenance. Why else would you care to attest that the source code repository thoroughly describes the CI process unless you need to prove that to a downstream user of your code? If you have users who *need* this for compliance reasons then why can't they contribute to the maintenance manpower required to make it happen?

A lot of people feel social obligations around the code that they freely share and some commercial vendors take advantage of that to treat contributors like employees they don't have to pay, which is a recipe for unnecessary stress and burnout, especially when vendors use FOSS in critical infrastructure, then try to hold individual developers accountable for maintenance when it was the vendors choice to license FOSS in the first place.

Some naive questions

Posted Nov 23, 2024 1:31 UTC (Sat) by LtWorf (subscriber, #124958) [Link] (4 responses)

Because people working in companies will happily create bug requests asking for this stuff, and will not even entertain the notion that they might give a helping hand.

I couldn't find a link but a while ago there was a microsoft employee being very vocal and complaining about an issue in some hobby project.

So there's pressure for sure, and of course people love it when their project becomes used.

Some naive questions

Posted Nov 26, 2024 11:37 UTC (Tue) by paulj (subscriber, #341) [Link] (3 responses)

> I couldn't find a link but a while ago there was a microsoft employee being very vocal and complaining about an issue in some hobby project.

I read this as a reference to certain other commenters to this very article, whether you intended it or not (i.e., there is an MS employee in other comments here, and they're somewhat vocal in advocating for process).

Some naive questions

Posted Nov 26, 2024 11:55 UTC (Tue) by LtWorf (subscriber, #124958) [Link] (2 responses)

No, it was a different microsoft employee :)

Some naive questions

Posted Nov 26, 2024 13:30 UTC (Tue) by andresfreund (subscriber, #69562) [Link] (1 responses)

Me reporting the xz backdoor?

Some naive questions

Posted Nov 26, 2024 20:32 UTC (Tue) by LtWorf (subscriber, #124958) [Link]

No.

It was something completely out of place. But looking for "microsoft employee rude github" kinda gives too many results to find the event I'm thinking of.

Some naive questions

Posted Nov 22, 2024 8:24 UTC (Fri) by Wol (subscriber, #4433) [Link]

> This is similar to "we want kids to learn logic, so we teach them latin"

Thing is, this probably empirically works - Latin is a "dead" language (although many close relatives are alive and kicking), and it's very much a matter of "what are the rules (grammar), what are the symbols (vocabulary), how do we manipulate them to make our meaning clear?". Pretty much EXACTLY the same setup as the study of logic, I would think?

And as a subject dear to me, there is plenty of evidence that extra MUSIC tuition increases kids MATHS marks better than extra maths tuition. ESPECIALLY with bottom set students. So why are we cutting music education in schools?

Cheers,
Sol

Some naive questions

Posted Nov 21, 2024 16:39 UTC (Thu) by mb (subscriber, #50428) [Link] (10 responses)

>What's the point of not pushing to master if it calls into C code and never checks a buffer boundary though?

There's no point.

In fact, such checker tools *reduce* the code quality and security for certain projects, because now developers are doing voodoo things (such as creating useless PRs instead of pushing to master) instead of developing safe code.

Most maintainers are no idiots.
But some companies start to treat them as such. For whatever reason. I don't know.

In real life the only thing that improves security is *reducing* pressure from overworked maintainers.
And real security code audits.
But certainly not by *adding* useless process paperwork.

Some naive questions

Posted Nov 21, 2024 22:17 UTC (Thu) by sdalley (subscriber, #18550) [Link] (9 responses)

> >What's the point of not pushing to master if it calls into C code and never checks a buffer boundary though?

> There's no point.

There would be plenty of point, if, for example, the CI step were scripted to include a test for that buffer boundary.

Then it would automatically check for this serious potential problem without any further bother, once it was set up. Any regression would immediately be flagged up, and master would end up getting a fixed version instead of a broken one.

CI tests and a well-set-up project repository are not pointless busywork. They can *save* a great deal of time and confusion in the long run.

Some naive questions

Posted Nov 21, 2024 22:27 UTC (Thu) by LtWorf (subscriber, #124958) [Link]

We're not discussing about tests here (at least I am not). Please go and read the website I'm talking about before commenting further.

Some naive questions

Posted Nov 22, 2024 6:59 UTC (Fri) by mb (subscriber, #50428) [Link] (7 responses)

>CI tests and a well-set-up project repository are not pointless busywork.

You are absolutely right.
Correctly developed tests do help a lot to find problems.
A correctly implemented CI does help to find problems early.
But without a real code audit it's not possible to find whether these things are present.

What does not help quality at all is:
- The mere presence of a CI script. It has to do something meaningful to help.
- The mere presence of a test. It has to do something meaningful to help.
- The absence of direct main/master pushes.
- etc, etc.

These are just process "standards" from big companies that they want you to do.
Without paying you, of course.

Scanning Open Source projects with a tool and then assigning whatever score to the project based on the scan actively damages the project reputations.

How is such a scanner going to find out about my extensive custom made non-standard test suite? It will assign my project a bad score and it will force me to invest my time to improve the score. Quality won't improve, though.

Some naive questions

Posted Nov 22, 2024 12:23 UTC (Fri) by bluca (subscriber, #118303) [Link] (5 responses)

> What does not help quality at all is:
> - The mere presence of a CI script. It has to do something meaningful to help.
> - The mere presence of a test. It has to do something meaningful to help.
> - The absence of direct main/master pushes.

You cannot have good CI if you have no CI. You cannot have good tests if you have no tests. You cannot have good review processes if you have no review processes.
These are starting points and prerequisites. If you don't have the prerequisite, it can be surely asserted that you don't have the the one-ups either.

Some naive questions

Posted Nov 22, 2024 12:42 UTC (Fri) by mb (subscriber, #50428) [Link]

Stop making straw mans. I wasn't talking about that.

You cannot have CI without CI? You cannot have tests without tests? Duh?

My point was:
You cannot check for presence of CI, tests, or anything else with a tool.

If the tool says that I don't have tests, because it can't find them, that does *not* mean that there are no tests.
If the tool says that there are no reviews, because it can't find traces of reviews, that does *not* mean that there are no reviews.
If the tool says that I push to master/main and says that is bad. Wtf? Stop making up stupid rules is my answer to that.

And that is why such a tool hurts Open Source projects.
It tells an incorrect story about the projects.
It tells lies about projects to the managers making decisions whether to use a project or not.

And you want Open Source developers to make your tool happy anyway?
What about: Pay them to do that?

Some naive questions

Posted Nov 22, 2024 12:47 UTC (Fri) by pizza (subscriber, #46) [Link] (3 responses)

> You cannot have good CI if you have no CI. You cannot have good tests if you have no tests. You cannot have good review processes if you have no review processes.

>These are starting points and prerequisites. If you don't have the prerequisite, it can be surely asserted that you don't have the the one-ups either.

Okay, where do I send the bill for implementing (and maintaining) all of these "prerequisites" and "processes" ?

"Badges" don't keep a roof over your head.

Some naive questions

Posted Nov 22, 2024 15:26 UTC (Fri) by bluca (subscriber, #118303) [Link] (2 responses)

> Okay, where do I send the bill for implementing (and maintaining) all of these "prerequisites" and "processes" ?

To whoever funds your work, if any? And if not, you just... don't do it?
It's not like it's mandatory by law that everyone must do this...?

Some naive questions

Posted Nov 22, 2024 15:56 UTC (Fri) by pizza (subscriber, #46) [Link] (1 responses)

> To whoever funds your work, if any? And if not, you just... don't do it?
> It's not like it's mandatory by law that everyone must do this...?

These statements appear to contradict each other given the context.

The overwhelming majority of "maintainers" aren't funded at all, yet these demands for them to "do better" keep coming nonetheless.

Some naive questions

Posted Nov 22, 2024 16:35 UTC (Fri) by bluca (subscriber, #118303) [Link]

People can ask whatever they want. You can ignore them. What's new?

Some naive questions

Posted Nov 22, 2024 17:31 UTC (Fri) by LtWorf (subscriber, #124958) [Link]

One of those idiotic scanners flags a project of mine as "inactive", because they don't see new commits (because I moved it on codeberg).

Ironically, they do notice there are new releases, because they scan pypi, but since they see no new commits on the abandoned github project (which contains a link to the new location) they think there is no activity.

Now if someone uses this tool (my $DAYJOB does) and imports my library, it will flag it as a bad dependency because it's inactive.

Automated scans are worse than useless, they cause harm.