Post #2340677

2026-05-06 12:57 UTC

Thanks to @meena@cathode.church for prompting this - it's not like I'm some sort of Superior Programming Being whose every line of code is elegant snd brilliant and not worthy of the sweaty masses. I'm a tediously average programmer. I detest status-driven gatekeeping. I would like to share my work so the effort can be leveraged by others to do new and useful work. I support some ideal of open source circa 1995 where useful decent quality tooling is freely shared and available. That is not the environment we live in today. Beyond the individual entitled ankle-biters that harass devs for not doing work they want for free, we now have this extreme corporate bullshit of "open source supply chain", that freely-provided _caveat utilitor_ code should be treated like code acquired under a commercial procurement agreement with formal specs, requirements, and standards for security, quality, and lifecycle management. I work in this space in my day job, I'm the one who sets and verifies those specs for our acquired codes, and I'm going to say flat out, that is that absent an explicit agreement with a supplier, all that supply chain and capital-P procurement activity is *solely* on the code user, not on the code author, full stop. Screw off with that CTO/infosec/bureaucrat thinking. Into the sea with you. For those of you in the back: _IF THAT PROCUREMENT AND ASSURANCE WORK IS IMPORTANT TO YOUR ORGANIZATION, YOUR ORGANIZATION NEEDS TO PAY FOR IT_. Further: _WITHOUT AN EXPLICIT AGREEMENT, NOBODY IS REQUIRED TO PROVIDE THAT SERVICE TO YOU AT ANY PRICE_. And finally: _WHAT PART OF 'USE AT YOUR OWN RISK' IS UNCLEAR TO YOU?_ I will curse all day long about research-grade software being built and distributed by organizations who explicitly know they are working on nuclear safety applications and do not perform adequate diligence in design, implementation, and testing. This goes beyond #ResearchSoftwareEngineering - it's production software engineering practice. These are organizations who absolutely know how their code is used (we have monthly meetings with them). I hold these organizations and individuals to a higher standard because this is quite literally our jobs. By contrast, this is not the job of @bagder@mastodon.social and expecting or demanding he do some corporation's or industry's V&V and SQA work is laughable, expecting him to do it _for free_ is arrogant, insulting, and delusional. But this is where we are now with sharing our code. Ethically, I believe anyone who puts their code in public bears some personal responsibility to ensure it's of a reasonable level of quality, functionality, and security. It's as if you were bringing homemade food to a potluck - the expectation is that it's edible and not spoiled or adulterated. You aren't expected to disclose every significant allergen, provide a list of ingredients, or a nutritional statement but you're expected to wash your hands, use clean utensils and ingredients of good quality, and ensure the food is cooked all the way through. That's gatekeeping, absolutely, and I won't apologize for setting that demand or an analogous one for "potluck" software. I am old enough to remember Matt's Script Archive and I have seen what happens when we don't do this sort of positive gatekeeping. For those unfamiliar, Matt was the Typhoid Mary of insecure internet software and his formmail.pl script was the poster child for bad and dangerous code you found for free on the internet. https://en.wikipedia.org/wiki/Matt%27s_Script_Archive And while I appreciate he was a teenager when he posted most of that code, as an adult he was repeatedly told how damaging his code was and yet he kept distributing broken versions for YEARS.

Replies (4)

@arclight@oldbytes.space 2026-05-06 13:34

So what am I actually arguing here? This is not 1995 and the expectations surrounding publicly distributed code are very different now. Some of those expectations are reasonable. If an author knows their code is dangerously broken, it should be fixed or be pulled from distribution. You need to be better than Matt from Matt's Script Archive. You should not be publishing to npm or PyPi or CRAN or CPAN or any of the public repositories unless you accept the minimal responsibility for fixing or retiring your code. _RETIRING CODE IS ALWAYS AN OPTION, EVEN IN A PUBLIC REPOSITORY_ But let's take npm as a bad example. What happens when an author decides to retire their code and stops distributing it and pulling it from a public archive breaks other people's applications that rely on code from that public archive? Do we accept the breakage that results from our naïve expectations of the public archive or does the archive continue to distribute the retired code against the author's wishes without forking the code and taking responsibility for it? I was on call the night of Friday, December 31, 1999. The right answer is that organizationally, you take responsibility for your code _AND ALL ITS DEPENDENCIES_ and you factor in that the public repository is not guaranteed to be there when you need it and that any code you pulled in from the internet is your responsibility. You own those dependencies once you start relying on them. Unless you have an explicit agreement with the original author, they owe you _NOTHING_. That is apparently not the modern expectation. The modern expectation is that authors who make their code public owe free maintenance, development, and security fixes to corporations for free forever and if you ever try to extract yourself from this implicit serfdom by retiring your code, some asshole organization will keep distributing your retired code under your name and keep you yoked to that millstone. Am I arguing to have it both ways? No. It's reasonable to distribute code of average quality and maintain it on one's own schedule. It's also reasonable to retire code for any reason but specifically because you no longer have the time or interest to maintain it at an average or (personally) acceptable level of quality. Mark it as archived and unsupported so it's clear to everyone what the project's status is. In an extreme case, stop distributing the code - that's what should have happened with Matt's Script Archive.

Open ##2340678
@idlestate@toot.cat 2026-05-06 13:02

@arclight@oldbytes.space there's a transposition in the middle two letters from the animal name to the curl dev: "bagder" @meena@cathode.church

Open ##2340693
@graydon@canada.masto.host 2026-05-06 13:06

@arclight@oldbytes.space Coding, having been stolen from women ("calculator", as a thing you got paid to do) had a couple generations of being a semi-elite specialty; the gold rush meant you could make a lot of money at it. After the gold rush, it's like being a plumber. The result has to work, you can make decent money, and most people both wouldn't want to and ought not, because it does take a certain specific view of the trade to be effective. The social change isn't free from stress. @meena@cathode.church @badger@mastodon.social

Open ##2340694
@davidfetter@kolektiva.social 2026-05-06 13:15

@arclight@oldbytes.space @meena@cathode.church @badger@mastodon.social Matt indirectly made me money back when I had a shingle out that read something along the lines of Perl Monger, and he did it the way someone showing up at the potluck with botulism-infected food would have made money for a caterer.

Open ##2340695