Post #756234
2026-03-23 02:49 UTC
Replies (5)
-
@coderanger@cloudisland.nz 2026-03-23 03:00
By all means invest in lifecycle security tools, BOMs are nice and package signature checks keep out the simple attacks. But they don't solve the deep social issue of mass collaboration at a planetary scale seems to be beyond the capabilities of our fragile brains. We are too easily taken in by things which appear to be a person which shares our values. Modern open-source leadership is effective a mental DDoS, and if that breaks down then what is going to replace it? If you think the AI coding models are advancing so well that we'll all soon just be coding via prompts alone then okay, I strongly disagree but that's at least a consistent world view. If not, genuinely where do we go from here. Having a thousand little webs-of-trust is not functionally better than having a million random "people", and that's being extremely generous on the scale of those webs. I don't care if Dunbar's Number is real or what the value is but the slippery slope has slid, whatever the limit we are over it.
-
@dalias@hachyderm.io 2026-03-23 03:16
@coderanger I do have what I think is a viable model for this, but piggybacking on SSI that you first build out relationships on for social networking, like a truly decentralized, instanceless version of the fediverse. As for the immediate problem, we pin back and plan to phase out whatever dependencies are accepting slop.
-
@chansecodina@sunny.garden 2026-03-23 18:19
@coderanger I've been thinking for a while now that it might be worth taking another shot at the web-of-trust. Long term, I think it's the only way forwards, but I agree unless it's dead simple to use it'll be impossible to hit critical mass. I think there will need to be some compromises on the theoretical security (TOFU vs key signing parties? verifying social media handles vs verifying government IDs?). If we could share a <128 character code on Mastodon (or Matrix or IRC) that served the same purpose as a GPG pub key, I think it'd be a lot easier to get people started. I guess what I'm saying is: I recognize that getting a web of trust going is a Herculean task and that it failed once before, but in the absense of other good options I think it's worth considering whether we should take another stab at it having learned our lessons from the past.
-
@ThisCJ@mastodon.nz 2026-03-23 22:27
@coderanger @davidgerard or, as I once heard an LE officer put it: “Web of trust? Sounds a lot like chain of evidence to me”
-
@robinadams@mathstodon.xyz 2026-03-24 01:59
@coderanger "Not everything scales, should scale or needs to scale." - Douglas Rushkoff Maybe we don't need scalable ecosystems, or software that everyone in the world can contribute to, leading to everything being millions of lines of code that nobody understands fully. Small software built by small teams is sounding better and better every day. The idea that scaling is always good, the criterion for success, is what gives us proposals for a million satellites in orbit. I'm moving more and more away from "I'll run your software unless I learn it's bad or you're a Nazi" and more towards "You have to prove you're worthy of my trust before I run your code on my machine".