Comments such as:
letting more people help with Kbin development.
…
Why not getting some help? I know that Ernest already said he has a problem trusting people, but
Why has Ernest insisted on being the only developer to work on this? This creates a potential “single point of failure” situation.
I understand the desire to keep kbin a solo project in order to maintain control over it, but if this is going to see any success in the long term, then there needs to be a team.
come up in almost all threads about KBin’s performance. At the time I just read them as nincompoops being whiners.
In hindsight does remind one a bit of similar social pressure leveled against Lasse Collin, does it not?
Not saying people are trying to backdoor this place or anything. The similarity just seemed worth pointing out.
I mean, he’s developing and administrating what’s essentially a Reddit clone all on his own.
I mean, he’s developing and administrating what’s essentially a Reddit clone all on his own.
And doing a damn fine job.
The question was if you saw similarity in the pressure to add maintainers to the project with the social engineering that lead to xz getting backdoored.
And he’s burning out. And more maintainers would be even better.
Yes, it’s similar, but every one-man project with real-world use is similar in that regard.
And he’s burning out.
I have seen no evidence of that. Also not the point of this thread.
No, he’s not. Kbin was recently down for a week. Then voting and comment counts broke. Before all that I had to get into the habit of reloading the page I was on every time I wanted to vote on something. It’s a terrible user experience.
That’s not to say I don’t like him or he’s not a good dev or whatever. Just that people have limits and it sure seems like he’s bumping against his.
I think Ernest is doing a fine job. [shrug] Especially when you consider none of us are being charged to be here.
Could we please stop talking about if Ernest is burning out though? That was never the question of this thread.
The question was if the comments reminded you of the social engineering that engendered the xz backdoor.
He is doing an excellent job, and I do not mean to denigrate his work when I say the task is beyond any one person, no matter how talented and dedicated. Look at the issues that went on recently while Ernest was indisposed, and we had months of federation issues that led to communities migrating away and Kbin.social getting defederated by other instances.
This project is getting too large for any one person, and it’s far too important to have one point of failure. And even someone as great as Ernest needs an understudy.
I don’t know what this xz thing is about, first time hearing it. But people saying he should get more help are trying to help him, not having malicious plans like installing backdoors or whatever.
I do think people should ask less for more maintainers — the project is already opensource, so it’s up to maintainers to join, not him to seek them out. But he should still get some help with managing the instance. Pauses in development are fine imo, but the instance shouldn’t be swarmed with spam and account deletion requests lost in limbo just because ernest got sick or something, which can happen with the best work life balances.
I don’t know what this xz thing is about, first time hearing it.
Someone pressured the maintainer of a compression tool used in a bunch of open source software to hand over the keys by citing burnout and offering to “help” then spent ~3 years slowly adding tiny changes that combined to form a backdoor in SSH that nearly compromised the entire internet or something.
It was only barely caught by accident because it made some thing some guy was doing that wasn’t even related a fraction of a second slower.
Been all over the FOSSiverse for days, and the social engineering that was used on the xz maintainer reminded me personally of similar pressure certain people have applied to Ernest in most threads about kbin performance I have seen.
The reason it worked is because sometimes burnout is a real problem, and getting extra help is a real solution. The fact that this was exploited in one situation doesn’t mean that all of a sudden there isn’t any real burnout or genuine offers to help any more.
A project can sometimes benefit from help even if there is no burnout. People have limits.
I typed a reply about how bad actors will use reasonable arguments to get their way, so we’d need genuine evidence
my comment didn’t send properly tho and i got an error message, so if you see me commenting twice, sorry
I switched away because kbin seemed stuck and unresponsive to users and uncommunicative. Changes that were made seemed to be ones the Ernest wanted to and not addressing issues that people were feeling in some cases.
I am a software developer for a living and I can tell you that you can both have more people contributing and be secure. Most projects do not have bad actors who successfully poison things. When someone does, they get caught in the review process. If this is your concern, then prove that Ernest himself isn’t a bad actor? I don’t believe he is, but being one person in control would certainly make that easy.
Erm, I thought kbin was open source? Can’t anybody fork it if they have a problem with it? This sounds like a whiny nothingburger.
Erm, I thought kbin was open source? Can’t anybody fork it if they have a problem with it? This sounds like a whiny nothingburger.
They can. That’s what mbin is.
That’s part of why I don’t get why people always pressure Ernest to add maintainers.
I said that already, mbin might be good but I didn’t like the advertisement.
I said that already, mbin might be good but I didn’t like the advertisement.
I’m not quite sure what your position is. I am by no means an mbin booster. In fact I find some of the people pushing mbin over kbin (in lieu addition too) jerks about it.
This whole thread has been about the similarities I noticed between comments people made about/to Ernest previously and the sort of comments we later learned led to the xz backdoor.
When I started to read breakdowns about the social engineering behind the xz backdoor I was like, “Waaaaitaminute, I’ve seen that sort of talk before.” I found it notable to point out the similarity and maybe poke around at it.
People decided to use the thread (to my excessive chagrin) to talk shit about kbin and rehash the exact same pressures I was attempting to analyze.