/kbin meta

5 readers

2 users here now

Magazine dedicated to discussions about the kbin itself. Provide feedback, ask questions, suggest improvements, and engage in conversations related to the platform organization, policies, features, and community dynamics. ---- * Roadmap 2023 * m/kbinDevlog * m/kbinDesign

founded 1 year ago

Do the "Ernest needs to add more maintainers to KBin!" comments remind anyone else of the xz social engineering malarkey? (kbin.social)

submitted 7 months ago by [email protected] to c/[email protected]

47 comments fedilink hide all child comments

Comments such as:

letting more people help with Kbin development.
...
Why not getting some help? I know that Ernest already said he has a problem trusting people, but

Why has Ernest insisted on being the only developer to work on this? This creates a potential “single point of failure” situation.

I understand the desire to keep kbin a solo project in order to maintain control over it, but if this is going to see any success in the long term, then there needs to be a team.

come up in almost all threads about KBin's performance. At the time I just read them as nincompoops being whiners.

In hindsight does remind one a bit of similar social pressure leveled against Lasse Collin, does it not?

Not saying people are trying to backdoor this place or anything. The similarity just seemed worth pointing out.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 3 points 7 months ago (1 children)

I don't know what this xz thing is about, first time hearing it. But people saying he should get more help are trying to help him, not having malicious plans like installing backdoors or whatever.

I do think people should ask less for more maintainers — the project is already opensource, so it's up to maintainers to join, not him to seek them out. But he should still get some help with managing the instance. Pauses in development are fine imo, but the instance shouldn't be swarmed with spam and account deletion requests lost in limbo just because ernest got sick or something, which can happen with the best work life balances.

[–] [email protected] 7 points 7 months ago* (last edited 7 months ago) (1 children)

I don't know what this xz thing is about, first time hearing it.

Someone pressured the maintainer of a compression tool used in a bunch of open source software to hand over the keys by citing burnout and offering to "help" then spent ~3 years slowly adding tiny changes that combined to form a backdoor in SSH that nearly compromised the entire internet or something.

It was only barely caught by accident because it made some thing some guy was doing that wasn't even related a fraction of a second slower.

Been all over the FOSSiverse for days, and the social engineering that was used on the xz maintainer reminded me personally of similar pressure certain people have applied to Ernest in most threads about kbin performance I have seen.

[–] [email protected] 11 points 7 months ago

The reason it worked is because sometimes burnout is a real problem, and getting extra help is a real solution. The fact that this was exploited in one situation doesn't mean that all of a sudden there isn't any real burnout or genuine offers to help any more.

A project can sometimes benefit from help even if there is no burnout. People have limits.