brokentone

I agree that it does feel a bit paradoxical, but reversing a product for repair purposes verses reversing it for duplication are treated fundamentally differently by reasonable people. One is "right to repair" the other is "counterfeiting" or violating patents. To your statement, "We have a right to repair, but you don't" -- this clearly is not what is intended by Taylor, to repair these Kytch diagnostic tools. If that were the case, I think that would carry.

I'm personally working on migrating a DB I've had for tracking some economic time-series data from Influx to TimescaleDB, and I have to say Outflux is the most savage tool name ever.

Wonderful post, so glad that Mrs. Hansson stepped out for this cause, as uncomfortable as it was.

I've personally wondered at credit scores + credit offered for a long time. The amount of regulation provides wonderful cover for these big institutions to really do whatever they want and lean back on "algorithms" / that they can't override the policy due to regulations, etc. Meanwhile, it's becoming more clear that the algorithms have encoded biases. In addition, the whole credit system is not one of those things you can opt out of (if you ever want a home or car, which I get, not everyone needs), and the whole thing is based on previous borrowing, so responsible (using cash) or underprivileged (never had the chance to start the credit bootstrap) folks are extremely disadvantaged.

The interesting twist in this story that I find damning is that Apple actually overrode the algorithm due to pressure -- this pokes a HUGE hole in this "cover" these institutions have created to date.

Sure, so you can represent the other far extreme. I certainly advocate for review, but we should be practical. No one reads all the code down to the proc to ensure nothing malicious is happening, and the average software dev wouldn't be able to understand something malicious at that level anyway. I could have used a more hyperbolic example than a practical one (have you read all the PHP source for the version you're on? Have you read all your PECL libraries? Those ones are okay but OSS in PHP is not? Why? Just because it's harder to read C, right?). Pretending we do review everything is disingenuous -- but we should do what we can. Review doesn't have to be reading lines of code, but it could be ensuring it comes from popular and trusted sources (part of my earlier comment).

It should be noted that your example was not bad source, so rigorously reviewing source code would not have helped. It was an unpublish event which was unexpected but is now differently handled by the package managers + registries.

... yes, I am responding to a comment critical of the usage of composer, requesting for it to be published as individual, self-contained files.

That correlation is very frustrating -- people should take this more seriously, but those who discover things are punished... should be pretty obvious why security is way it is, right?

Why would we combine Whole Foods and Trader Joe's? Whew, at least it's not bigger than Target and Walgreens combined though! It is however about 40% the size of Kroger... so there is that.

Well this is the whole point of privacy, right? Individuals or teams may have a perspective, but the business ultimately wins.