Tridge has responded on the rsync vibe disaster

[shadowjonathan@tech.lgbt]

@davidgerard also what the fuck are these replies glazing him

can you moderate replies as an author?

[addison@nothing-ever.works]

@davidgerard@circumstances.run Honestly, it's just kind of unpleasant to watch. I understand the pressures at play here, re: security-relevant bugs being reported at a higher rate (including some which actually exist). Also, there was a lot of criticism directed towards him for this, some of which was way too personal or rhetoric-laden. That tends to cause walls between people that stifle actual change. I doubt he will change course following this sequence of events.

On the other hand, the dismissal of legitimate concerns and criticisms is really gross to read; rubs me very wrong. It also irks me that he characterises all of the criticism he got as concerns about correctness, and how he addresses even that. I don't care at all if he thinks it's "right"; he hasn't put in nearly the same time or effort or thought as he would have needed to otherwise, and that's what he has 40 years of experience in. I care that it is well-reasoned, and doesn't rely on something so fundamentally problematic for reasons other than efficacy.

I don't know. This whole movement continues to reveal that a huge chunk of open source does not hold the values I expected.

[robinsyl@meow.social]

@ShadowJonathan @davidgerard I know someone with a Medium account and yes you can hide replies you don't like

[david_chisnall@infosec.exchange]

@robinsyl @davidgerard

The problem is finding people who are both willing and able to do it (and not, as with liblzma2, just there for the supply-chain attacks).

This is especially true for codebases written in C with a bunch of idiosyncratic things. I had a quick skim of some of the rsync source and it has a few more comments than a lot of contemporary code, but also some cryptic things. My favourite was an ad-hoc inlined memmove with a comment explaining that memmove didn't handle overlapping regions correctly on 'some platforms' (the only difference between memmove and memcpy is that the former is required to be able to handle overlapping regions). I wouldn't want to take over maintaining it, even if I had time to do so.

That said, I think we do need to normalise projects being done. No new features need to be added, the project is complete.

This is much easier when the project is designed around extensibility, so missing features can be added with external plugins, maintained by other people.

[robinsyl@meow.social]

@ShadowJonathan also possibly some sampling bias as people who use AI are prolly more likely to have a Medium account

[hsza@social.tudbut.de]

@ShadowJonathan @davidgerard chances are you can, but also picture the average individual with a medium.com account

[passocacornio@tech.lgbt]

@davidgerard no, like i get it... i don't know their level of understanding about machine learning, so i will not conflate their feeling overwhelmed by the surge in llm-driven issues reporting with lack of knowledge, also I don't know if any maintainer of rsync is trustworthy enough (in their experience) to pass the project to.
but i do think we need to normalize saying a software is complete more often.
what i mean by complete? that it will not get more features and will only get security updates and at a slowed down pace.
the "move fast and break things" did much more damage to to software engineering than we are comfortable admitting. i don't agree with their main points, but I empathize with the thought processes they are putting "to paper", even the subconscious ones.
anyway, let's migrate to openrsync

[mackensen@higheredweb.social]

@davidgerard it's clear that he doesn't consider any criticisms of his choice legitimate, which rather confirms what his critics are saying.

[davidgerard@circumstances.run]

@dysfun did any of them acknowledge that??

[li@tech.lgbt]

@davidgerard

> Also, nobody actually knows if human intelligence is just finer grained stochastic prediction as well.

lmfao yes we do, people are not LLMs

[dysfun@social.treehouse.systems]

@davidgerard i heard (though haven't seen) that fedora wouldn't take the update and they are all in.

[davidgerard@circumstances.run]

@sharpcheddargoblin he's got a lot to be arrogant about! unfortunately,

[sherapantsuit@mastodon.social]

@peter_sc @davidgerard Thanks, this was very funny. ️

[hsza@social.tudbut.de]

@Li @davidgerard has that “scientists are undecided on climate change” energy

i would rather not read a blost that is entirely product of slopsychosis tbh

[davidgerard@circumstances.run]

@dysfun yeah i went looking and can't find evidence for that one either sadly

[dysfun@social.treehouse.systems]

@davidgerard you have to find a source for your credibility, i am shitposting either way

[theonedoc@tech.lgbt]

@davidgerard and that's how you dig your hole with the help of an fucking excavator.

[davidgerard@circumstances.run]

@quincy yeah, it looks fine if you remove the context ...

[swaldman@mendeddrum.org]

@davidgerard Seems to me that a root issue may be "I don't want to be the maintainer of this package any more - I'd rather be sailing - but I am not taking any (apparent) action to get others to take it over."

I've no problem with a retired maintainer of a bedrock package wanting to avoid spending their life on it. The responsible approach is to look for somebody (or a group of somebodies) to take it over, rather than to try to automate the responsibilities.

[hugoestr@functional.cafe]

@Netzblockierer @davidgerard What happened with Vim?