I can feel your hatred of LLMs and the article is clearly written by it. But don't let it blind you. "One" maintainer makes perfect sense here, "the" would sound odd. It's truly been used that way for a long time.
why though? number of maintainers is a function of how much work is needed now rather than how important the project is ? I would imagine sudo isn't getting that much commits/changes now. What would 10 maintainers do on sudo ?
Found vulnerabilities faster? Rewritten it in a safer language? Made a safer doas-like subset compilation target? Made it harder to trick a single person by having more eyes on code reviews?
> but may very well be undesirable to the project.
That would be a valid point of you actually said it would be and why, not that it may be. It may also be desirable. Now what? Would the project benefit from more maintainers because there may be desirable improvements or would it not because nothing may be desirable, it's literally fully secure and feature complete?
How big and how much work do you think is occurring in sudo? Try guessing the churn for last month. You are probably underestimating it by a factor of 100x.
Reflecting the enormous effectiveness of free markets in the software space. If there was a strong regulatory system around software development it might cost orders of magnitude more to run a modern OS.
While I don't doubt that regulatory bodies and/or ethics boards would have some cost effect, I don't think it'd be to the degree that you suppose. If anything, the long-term costs might be less. For example, say you take bad legal advice from someone online, which you follow, and now you've been found liable for some misconduct and have to pay a fine. Whereas, if you had paid for an actual solicitor and followed their advice, the initial cost would've been higher, but you wouldn't have had to pay the higher cost of the fine.
Similarly, it might have preempted things like the $99 Apple Developer Program: if your software-engineering licence is at jeopardy, you may be less likely to upload malware, or target micro-transactions to children, or make cars lie about their emissions, etc. How many lives have those ruined?
It might help with the AI-slop crisis too: Speedy Web Compiler might not have needed to adopt a policy of rejecting every external PR out of hand if they could have chosen a "licensed software-engineers only" policy instead.
Some other things to consider too like what effect this would have on anonymous/pseudonymous contributions, and whether the regulatory body/ethics board would accommodate that in some way. There's been some discussion about how governments flirting with age verification laws could do so without forcing everyone to dox themselves to every website they use, or allowing the government to track everything they do. Perhaps a similar system could be adopted for contributions. Etc.
Overall, I do agree that the upfront cost would likely be somewhat higher, but I think the overall cost to run a modern OS would be somewhat lower, resulting in a similar-enough cost overall. Though this is just my opinion based on vibes. I'd love to see any data about this.
Only a few months ago I read some article detailing the XZ backdoor and Jia Tan.
It was a fascinating, scary and sad story. Can't really find the article right now, so here's the wikipedia article about it in case other readers don't get the reference.
The problem with open source like this is that it’s too difficult to work on, and if you start studying just to be able to work on it, it’s hard to get noticed. Most core open-source projects start with optimization and are extremely difficult. But would people with that level of skill really dislike being noticed?
Often in such 1-maintainer open source projects, although the code is out in the open, the roadmap, work-in-progress, and the real list of issues is only in the maintainer's head. And the dev environment only works correctly on the maintainer's machine etc.
If you can't get on frequent (sometimes hour-long) phone calls with the maintainer, it's a Herculean task to onboard onto such projects.
The crux of why programs like GSoC work at all is because they require a mentor-mentee relationship (similar to a new hire onboarding at a company) between an existing maintainer and the new contributor.
They define "public funding source" later as a list of specific funding organizations like OpenCollective. But that definition feels odd, and like much of this feels like it might be AI generated.
What scares me is the new generation are mostly tech illiterate just like boomers, only millennials and some gen x are lifting the tech world, now add AI to the mix and how it’s making newer gen are even dumber, the future is bleak.
I am Gen-Z who works on the Linux kernel and who still values hardcore stuff. We need more support from the Gen-X and the Millennials. I try my best to hack on things, write and contribute patches to enables features that would otherwise only exist in proprietary software. I feel like the veterans are not supporting us enough. I get a lot of hate and push back just for trying. In my opinion, a society cannot thrive without elders providing support for the young. But the general atmosphere feels completely the opposite these days.
It varies wildly from community to community. Sadly, a lot of tech spaces are much more judgemental/toxic than they should be.
The motorcycle and sports groups I've been a part of have had a lot more support from the veterans in the space and were just more positive in general. It's a lot easier to call out/shun the assholes when they're not hiding behind a screen.
Personal usage over months. Third party evals. Not saying it's 100% accurate but it's close enough to trust. linuxstans.com news articles are mostly ai generated, it's a slop shop.
That they only use texts they already know in their mind that it's AI. I'm sure that if I use it to pass everything posted on HN through it will give me "high confidence" unless it's badly written. People confuse correct grammar with artificiality...
You saw it here first hand today, with half the forum losing their minds because they built their tower of slop atop a javascript interpreter which will be sunset in a year. And that dependency is professionally maintained, with a 12 month off-ramp.
bigyabai | 22 hours ago
luqtas | 22 hours ago
calvinmorrison | 21 hours ago
vatsachak | 21 hours ago
jszymborski | 21 hours ago
Do people who publish this stuff read this and think "this LLMism sounds good to me"?
pixl97 | 21 hours ago
asdf88990 | 19 hours ago
“One maintainer” makes no sense here, it is THE maintainer.
Use of colon there is also a blind mimicry, xz isn’t defined by the exploit that put “one maintainer” in spotlight.
It is total rubbish.
gertop | 19 hours ago
asdf88990 | 18 hours ago
epestr | 19 hours ago
throw0101a | 21 hours ago
* https://xkcd.com/2347/
KazaNLP | 21 hours ago
manquer | 21 hours ago
umvi | 20 hours ago
Well, if other projects with a glut of devs are a sign, probably integrate AI into it somehow
eviks | 19 hours ago
gertop | 18 hours ago
All the other things you mentioned are just things you personally wish for but may very well be undesirable to the project.
eviks | 18 hours ago
That would be a valid point of you actually said it would be and why, not that it may be. It may also be desirable. Now what? Would the project benefit from more maintainers because there may be desirable improvements or would it not because nothing may be desirable, it's literally fully secure and feature complete?
Veserv | 17 hours ago
roenxi | 21 hours ago
Defletter | 19 hours ago
Similarly, it might have preempted things like the $99 Apple Developer Program: if your software-engineering licence is at jeopardy, you may be less likely to upload malware, or target micro-transactions to children, or make cars lie about their emissions, etc. How many lives have those ruined?
It might help with the AI-slop crisis too: Speedy Web Compiler might not have needed to adopt a policy of rejecting every external PR out of hand if they could have chosen a "licensed software-engineers only" policy instead.
Some other things to consider too like what effect this would have on anonymous/pseudonymous contributions, and whether the regulatory body/ethics board would accommodate that in some way. There's been some discussion about how governments flirting with age verification laws could do so without forcing everyone to dox themselves to every website they use, or allowing the government to track everything they do. Perhaps a similar system could be adopted for contributions. Etc.
Overall, I do agree that the upfront cost would likely be somewhat higher, but I think the overall cost to run a modern OS would be somewhat lower, resulting in a similar-enough cost overall. Though this is just my opinion based on vibes. I'd love to see any data about this.
rrr_oh_man | 21 hours ago
compass_copium | 21 hours ago
lgl | 19 hours ago
It was a fascinating, scary and sad story. Can't really find the article right now, so here's the wikipedia article about it in case other readers don't get the reference.
https://en.wikipedia.org/wiki/XZ_Utils_backdoor
jdw64 | 20 hours ago
roncesvalles | 12 hours ago
If you can't get on frequent (sometimes hour-long) phone calls with the maintainer, it's a Herculean task to onboard onto such projects.
The crux of why programs like GSoC work at all is because they require a mentor-mentee relationship (similar to a new hire onboarding at a company) between an existing maintainer and the new contributor.
remywang | 20 hours ago
SQLite has a list of sponsors right on the homepage https://www.sqlite.org/
thayne | 20 hours ago
tamimio | 20 hours ago
afr0ck | 20 hours ago
seabrookmx | 19 hours ago
The motorcycle and sports groups I've been a part of have had a lot more support from the veterans in the space and were just more positive in general. It's a lot easier to call out/shun the assholes when they're not hiding behind a screen.
ChrisArchitect | 20 hours ago
The people holding up the internet
https://news.ycombinator.com/item?id=50002494
duhhhhh1212 | 20 hours ago
Don't waste your time.
functionmouse | 20 hours ago
duhhhhh1212 | 20 hours ago
adastra22 | 19 hours ago
giancarlostoro | 18 hours ago
braiamp | 6 hours ago
erelong | 19 hours ago
murodbeck | 19 hours ago
penskymaterial | 19 hours ago