• 0 Posts
  • 35 Comments
Joined 1 year ago
cake
Cake day: July 23rd, 2023

help-circle




  • All of these packaging systems have plenty of tutorials. Speaking from experience, many maintainers were not developers when they started maintaining packages for distros other than the official distros. I have worked with several maintainers who do work in tech and know socially several who had no background. This could be a great place for you to start!

    You bother because FOSS is as much paying it forward as it is getting shit for free.







  • This doesn’t appear to cover the cost of the electricity it would take to keep your stuff running. There is no way to pay anything out at all. Seems like a pretty straightforward pump-and-dump where the end users are collecting imaginary points while some company abuses their resources. Every blog and Reddit post I looked at to try to understand this was full of referral links. Equally classic sign of pump-and-dump pyramid scheme.




  • If a repo is very popular, it should have a lot of forks. The higher the upstream popularity, the higher the downstream popularity. When a dev makes a claim that there are a ton of malicious forks stealing IP, we can vet that claim by looking at the forks that respect the upstream. Big projects have a big community with big forks with many stars. The popular downstreams drive traffic to the upstream.

    In this case, we have a couple hundred direct forks. That’s not a ton. Out of those, only three have stars. All of them only have one star. At face value, that could imply a few things: the repo is not very popular, the community is centralized around the upstream, or something else along those lines. Comparing this to other open source projects, our initial conclusion is that this is not a hugely popular repo and does not get a lot of development outside of its incredibly niche community.

    Occam’s razor is a tool, not objective truth. Based on the facts as we can see them, this focus on forking from the dev is much more indicative of a burnout spiral, incredibly common in the FOSS community, than nefarious actors. If we see receipts, eg a collection of takedown requests on malicious forks attempting to claim ownership of the code, our analysis falls apart. That’s still a possibility, however remote.


  • There were forks that wanted to hide the fact that they were Floorp forks, forks that did not want to contribute to Floorp at all, forks that used the code for life and just changed the name of Floorp, and many other forks were born.

    There are three visible forks that have any stars. All of them have one star. You’re telling me that a project that is so widely and maliciously repackaged has no normal forks with more than one star? Is this tech that only bad actors want to use and has no following in the open source community?

    Where are these evil forks, how do we actually know they’re forks, and why are they still up if they’re breaking license?

    Edit: Here is a fork with 200+ stars that isn’t a direct GH fork. Given its premise is an opinionated and branded Floorp, is it morally wrong for its maintainers to not contribute to Floorp (assuming they don’t only for the sake of argument)? Does your answer apply to fediverse server owners (eg Mastodon, Lemmy) whose premise is hosting an opinionated and branded instance often explicitly without the technical skill to suggest patches?




  • My stance has been that, just as long as I’m interviewing with someone, I’m happy to do it, up to an undetermined time threshold. A screening interview, a tech screen, and then a bunch of panels is what I expect from a solid firm. Just as long as I’m interviewing with someone, I have a lot of opportunities to learn myself. I will also occasionally do a take home if and only if there’s a novel problem I want to solve related to that take home (eg I want to learn a library related to the task) but this is very rare.

    As a hiring manager, I try to keep things to a hiring screen, a tech screen, a team interview, and a culture interview. My team is small. I don’t want to spend more than three hours of someone’s time (partially because I can’t really afford to spend more than that myself per candidate or lose more team hours than that). My tech screens are related to the things I actually need people to do, not random problems you’ll never see.

    My assumption is that a good dev has lots of opportunity and I am in competition with everywhere else. I need to present the best possible candidate experience. Big companies with shitty employee experience telegraph that by presenting a shitty candidate experience, which is where the employee experience begins. You can’t have a good customer focus without starting from a good employee focus.



  • The issue here is that Canonical pushed the snap install without warning about its reduced functionality. I don’t think highlighting a wildly different experience between a snap install and the Docker experience people are used to from the standard package install is “bashing it just because it’s popular to hate on snap.” For example, if you take a fresh Ubuntu server 22 install and use the snap package, not realizing that snaps have serious limitations which are not explicitly called out when the snap is offered in the installation process, you’re going to be confused unless you already have that knowledge. It also very helpfully masks everything so debugging is incredibly difficult if you are not already aware of the snap limitations.