this post was submitted on 24 Oct 2024
1060 points (96.9% liked)
Technology
59629 readers
3127 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
You know. I don't like what the Russian leadership and military are doing. I feel like ultimately we're in the cold war era. But you know, at the height of the cold war, radio operators around the world still worked Russian stations.
Yes, there was a very clear policy, neither side talked about ANYTHING beyond their signal report and working conditions (information about radio, power output and aerial basically). At the height of the actual cold war, the individuals were not cancelled like this.
Sanction the leadership, sanction the money, and sanction the military. But the normal people that are subject to the propaganda? I don't understand the benefit in doing this. I also don't see how the sanctions effect an open source project..
Seems a bit weird. Maybe there's information we're not privy to, but on the face of it, just based on what we're seeing. Seems like a very very odd move.
FSB wants backdoor in kernel. FSB notices subsystem maintainer is Russian, lives in Chelyabinsk. Can close eyes to backdoor, can pretend to review. FSB in Moscow make call to FSB in Chelyabinsk telling to buy heavy wrench at hardware store.
Same could be said for any intelligence service . it is better to focus on preventing and detecting these things through analysis and code reviews.
And they could just offer boatloads of cash to someone in another country to insert something so this doesn't really prevent anything it only isolates a certain subset of people.
So if we can't completely 100% deal with a problem, we shouldn't even try? I mean, you're correct, but we can't solve all problems at once. If we deal with at least one, then we've made progress. Then we can try to deal with the next one.
No but this doesn't do anything to "deal" with the problem as anyone can built up trust like Jian tan showed. The argument that this makes us more secure is like saying closed source is more secure cause the hackers dont have access to the source.
We have evidence of the US messing with nist standards so by that same logic should we assume all us actors are bad ?
The solution is to verify the code maybe have multiple people from different locations have to review stuff. Build more checks into the process.
The whole point of it being open is that it can be reviewed. It shouldn't matter where the contributor is from as all code should be subjected to a rigorous review process.
What... You realize that NIST is literally a government agency? It's part of the United States Department of Commerce. It's literally the US government. Are you saying that the government is messing with itself? What does that even mean?
What's so strange about that? It's not like the government - any government - is just one person. Of course some people in government can mess with other people in government. Even people in the same office mess with each other. Intra-office politics, and so on.
If that were true, surely they'd not trust ANY of their existing work, or at least any done since the Special War Operation. Wouldn't that make sense?
They've left the code, and removed the people arbitrarily. Seems a bit off to me.
I don't think this only happens now, governments like Russia, USA, China, Israel will likely always be making these attempts.
Security. Torvalds did this for security.
Is it really that hard to parse?
And I'll say the same here as I did above. If it was for security, their code is tainted too. It's an arbitrary reaction that is not complete as a solution to anything.
They can check existing code. You have to be able to trust people who are contributing.
They can check new code by these risky people as it comes in, but it why risk it?
You can't untaint code if the tainters (lol that sounds funny) can still edit the code.
If Torvalds is correct (he is), patching can now take place for vulnerabilities.
Good point!
Well it seems it was more to do with sanctions, if the open letter from one of the chopped developers is to be believed. In which case, I think the right thing is to move the names to contributors (they did still contribute), remove them from maintainers (some maintainers are actually paid by the foundation, I mean not a lot, but some are paid).
I still find it all a little odd. But likely there was a bit of a prod from somewhere higher as to how sanctions should be followed.
I am on your side and don't understand the fury of down votes in this section regarding this stance. I am from a shit hole of a country too and if my life long contribution to open science (hypothetically speaking) could be so completely disregarded because of something ultra shitty that my country did, I would be super sad and probably mad at the OS community for leaving me behind so quickly.
I also don't understand the benefit of doing this. Most people seem to claim it's for security reasons but that does not make sense to me. Closing doors to someone without any proof of malintent is so against open source philosophy that it is perhaps more damaging in its core. And being the kind of government Russia is (or for that matter Israel, China, USA etc etc) they will always try to gain cyber war advantage by such methods. This approach is therefore clearly unsustainable. You would only be able to give dev access to a handful of countries in the world.
It sure as hell won't scratch a dent in the Russian government's armor when all these sanctions did not. It is not going to achieve 1/1000th of what all those ambargoes, frozen accounts etc aimed and failed to achieve.
Therefore there is either missing information (external pressure to take this action) or this is simply an action based on personal judgement.
Looking at the other post about NVidia drivers, I am starting to wonder if western governments (or perhaps just the US) are going after large orgs and suggesting how current sanctions should be interpreted. In which case, not sure I can then blame the Linux foundation, since you know, you don't need government heavy breathing down your neck.