Discourse Is Not Going Closed Source

Posted by sams99 11 hours ago

Comments

Comment by dhruv3006 10 hours ago

> Open source creates a useful urgency: when your code is public, you assume it will be examined closely, so you invest earlier and more aggressively in finding and fixing issues before attackers do.

This should be the mentality of every company doing open source.Great points made.

Comment by necovek 10 hours ago

This should be a mentality of every company building products :)

Comment by TeMPOraL 7 hours ago

Indeed. All software products you can get your hands on are open source - compiled code is only little more difficult to read than source code, but not that much if you learn how.

Which is why ~all companies switches to offering software as a service, so this mindset doesn't apply :).

Comment by roenxi 1 hour ago

> but not that much if you learn how.

Yesterday I threw some ghidra output into an LLM with very little context and got what seemed to be a reasonable run down of the original back. We're probably knocking on the door of being able to throw a binary into an LLM and getting the original program back unless there is active obfuscation done.

It is a very exciting time for anyone who likes playing old, abandoned and buggy games :').

Comment by dhruv3006 9 hours ago

I guess open source makes you more accountable.

Comment by graemep 5 hours ago

I sometimes explain open source to people as auditable software.

Comment by tech_hutch 48 minutes ago

That's a good way to explain it.

Comment by somewhatgoated 3 hours ago

Also makes it harder to build a business around it.

With that combination no wonder most successful companies are closed source.

Comment by chrismorgan 10 hours ago

> I want to be fair to Cal.com here, because I don’t think they’re acting in bad faith. I just think the security argument is a convenient frame for decisions that are actually about something else. […] Framing a business decision as a security imperative does a disservice to the open-source ecosystem that helped Cal.com get to where they are.

That sure sounds like bad faith to me.

Comment by dirkc 7 hours ago

This rest of the article contrasts the with "I don’t think they’re acting in bad faith"

This bit stands out to me:

> You can’t take five years of community contributions, close the gate, and claim you’re grateful. I don’t think it works that way.

I think it's safe to say that Sam is not impressed with the the Cal.com decision and the way they framed it.

Comment by LoganDark 10 hours ago

Bad faith requires you to intend it badly, though, not just for it to be bad.

Comment by chrismorgan 9 hours ago

Framing a business decision as a security imperative sure sounds like intent to mislead to me.

Comment by LoganDark 9 hours ago

Misdirection is normal business practice. For example, Quadpay/Zipco recently made a change where instead of appraising your credit independently for each of their plans, they calculate a total amount you're allowed to have in flight at any given time, and share that across everything. In their FAQ, there is an entry for "Is my purchasing power going down?" and the answer is some bullshit like "Your purchasing power is unified for a simpler and more streamlined experience bla bla" which doesn't actually answer the question. It's meant to defuse questioners without actually revealing that yes, total purchasing power did go down when they decreased the number of buckets that multiplied their appraisal. You're no longer allowed to pay a larger sum of money over a longer period of time - you get one amount that you're allowed over any term, and that amount of lower than what you could've been approved for before. Regardless of whether that's a good or bad decision (good for people with bad impulse control, for example), they are dishonest about it through lawyerspeak, which is the most standard business practice there is. You could argue that plenty of standard business practices are bad faith but I would say the capitalist idea of private corporations in the first place is bad faith.

Comment by miki123211 4 hours ago

Related: I wish there was a TV show where they would ask simple yes/no questions to politicians and business leaders, but their mic would only be unmuted after they press a "yes" or "no" button.

Answering a yes/no question with a "we're doing everything we can to ensure a smooth experience for our customers" is spindoctoring 101.

Comment by embedding-shape 4 hours ago

But that's not how people generally hold their opinions or even should (I'd argue). You can ask me "Yes or no, should we kill people?" and I can't really give you hard "yes" or "no", there is nuance and context to consider, and probably most beliefs I hold, have some sort of nuance.

Unless you're also asking politicians to all become 100% dogmatic, I don't think that's a realistic suggestion.

Comment by loloquwowndueo 4 hours ago

They’d just press whatever and then start their verbal reply with “yes and no”

Comment by blipvert 2 hours ago

“Have you stopped beating your wife?”

Comment by actionfromafar 1 hour ago

Could you ask misleading questions? Answer yes or no.

Comment by 1 hour ago

Comment by spockz 8 hours ago

How far have we fallen to call misdirection a normal business practice. I agree that it is everywhere but it isn’t or at least shouldn’t be normal.

Comment by Chaosvex 8 hours ago

Pertinent comment from earlier: https://news.ycombinator.com/item?id=47801845

Comment by soraminazuki 4 hours ago

Yeah, there's a difference between normal conduct and normalized conduct. It sure is a sign of the times that people are confused by this.

Comment by dspillett 4 hours ago

> Misdirection is normal business practice.

Being normal practice does not make something right.

Comment by thedevilslawyer 8 hours ago

Misdirection is misleading, and bad faith.

Comment by Gigachad 10 hours ago

The above statement is claiming it likely is intended as something bad though. A convenient coverup.

Comment by LoganDark 10 hours ago

Covering something up is not bad faith. PR firms do it all the time (though plenty more do things in bad faith too). If what you're covering up is an explicitly user-hostile decision then maybe that's bad faith if what you're trying to do is trick people. But if you're just lying for brownie points then that's not always bad faith, just dumb.

Comment by pseudalopex 9 hours ago

Hiding something to manipulate public perception is bad faith.

Comment by saghm 9 hours ago

I don't agree with your definition here. Good faith means trying to be correct but potentially not being by accident. Intentionally lying is bad faith and by definition trying to trick people; you know the truth is one thing, but you're saying something else to try to get them to believe it.

Comment by LoganDark 9 hours ago

What I'm saying is that even lying is only bad faith depending on the intent of the lie. That doesn't mean others can't be upset regardless of the lie's intent, but I wouldn't say all lies are bad faith.

Comment by pseudalopex 8 hours ago

> I wouldn't say all lies are bad faith.

No one said this.

Comment by swiftcoder 6 hours ago

> even lying is only bad faith depending on the intent of the lie

And the intent here is to intentionally mislead, so how is that not bad faith?

Comment by redsocksfan45 1 hour ago

[dead]

Comment by croes 9 hours ago

> dishonest or unacceptable behaviour:

https://dictionary.cambridge.org/dictionary/english/bad-fait...

> I just think the security argument is a convenient frame for decisions that are actually about something else.

That would mean they think it’s bad faith. Claiming to do something because of A but to really do it because of B is dishonest

Comment by glerk 7 hours ago

I've started to opensource my side projects (as long as the code is in a state that I'm not too ashamed of). Seeing how easily I can reverse engineer binaries, clone various applications, and just generally build stuff from scratch with AI assistance, I think there is no moat in hiding your source code. If you can use my code to build something better than me, I wish you the best of luck!

Comment by sieabahlpark 7 hours ago

[dead]

Comment by ramon156 5 hours ago

Instead of Microsoft snooping my code, now everyone can!

Comment by cowsup 3 hours ago

Great piece. I thought the same of Cal's announcement; it basically boiled down to "we're willing to shift our entire business to a security-through-obscurity approach." It won't be long until systems are sophisticated enough that they can target an application over the course of a weekend, and try thousands of exploits across each possible endpoint you offer, to see what happens, regardless of whether or not your source code is public.

Anyone who's launched anything on the web -- anything at all -- and looked at the logs will see all sorts of endpoints being requested for /wp-admin/ or random WordPress plugins, even if their site has never, and will never, run WordPress. Imagine this at scale, with every possible attack method imaginable, blindly hitting everything on the web. That's where I think we're headed, and closed source won't fix that.

Comment by eaf7e281 2 hours ago

> If your code is open source, your security team can scan it, your contributors can scan it, and independent researchers can scan it too.

Literally! If everyone can access the same system as Claude's Mythos, one solution is to have more people trying to identify your issue before the hackers have the chance to do it.

Comment by negura 5 hours ago

too bad. i wish they would go closedsource so that maybe everyone would stop using it. it's dogshit for countless reasons. including:

- refuses to even load on browser engines older than 2 years. for a webforum that's absolutely appaling. there's a barebones non-JS version. but it only loads for individual threads (not the forum homepage or anything else), so they must be linked to directly (e.g from a websearch engine)

- every single page navigation triggers the circle animation which blocks the view for up to 3 seconds. how is this not an obvious regression on webforum software that has existed for decades?

- various nonsensical functionality suggests an incoherent code base. like the input element for the searchbox disappearing if the browser window loses focus. if you switch tabs midway for whatever reason, you need to reopen the searchbox every time you get back. and you can't use an external editor to fill in the input. because as soon as you've focused the editor, the element that the editor hooked into no longer exists

- search results are crammed in a narrow responsive list with 5 entries. you need to press 'More' to see the rest of the results as yet another responsive list. you never know how many results there are in total. only that there are more than ones that loaded so far

- long threads are never rendered fully. only as incomplete chunks. so it doesn't work to set positional markers in the scroll buffer to jump back and forth. as soon as you scroll past the boundaries of the currently loaded chunk, the old content gets destroyed and replaced. it feels like having alzheimer's

- you can reply to any specific post in a thread and there will be a visual indicator about which post you replied to. except if you reply to the most recent post in a thread. so someones who reads a post has no way of knowing in advance whether it is being addressed to the post just above it, or to the thread as a whole

i hate discourse so much. i'll never understand why it got so much adoption by FOSS communities. it must be the virtue signalling

Comment by Cthulhu_ 4 hours ago

These are various reasons why I also opted to not use it when it was finally time to retire vBulletin 3. We never did adopt vB 4 or 5, because while I'm sure the code was "better" from a software engineering perspective (using classes/OOP etc), it was also noticably slower, and the original developers had either been ousted or sold out.

The original vB developers built Xenforo, which is still in the spirit of vB 3 but with some modern amenities like live updates and the like.

I also found Discourse to be... challenging to self-host.

Comment by karussell 4 hours ago

> I also found Discourse to be... challenging to self-host.

Made a completely different experience. Every once in a while you have to run a command. Over the last 10-12 years there were I think 2 problems where this did not work out of the box.

Comment by LorenDB 1 hour ago

You forgot one of the worst parts: the Discobot that tries to make you run through a tutorial every. single. time. you sign up for a Discourse forum.

Comment by 2 hours ago

Comment by eaf7e281 2 hours ago

I'm not sure where this heat comes from, but what constitutes a "good" forum in your opinion? I would love to check it out.

Comment by baud147258 2 hours ago

while I've just been on forums that have been using xenoforo, I found it a better experience than those running Discourse

Comment by LorenDB 1 hour ago

+1 for xenForo. IMO it has a much nicer UX than Discourse, if only because it uses a more traditional approach.

Comment by bsenftner 3 hours ago

I hate most of all the information black hole that is discord. I am member of several communities, where difficult issues are being solved using complex new software releases, but if you do not sit and watch the stream for the specific things you want, forget about finding anything useful you want.

Discord is bottomless sea of the same question being asked over and over and over, and the original question poster never seeing their replies. If there was not a notification when your own messages are replied, Discord would be 100% worthless.

Comment by nixosbestos 2 hours ago

> must be the virtue signalling

I wish you folks could understand how clownish you sound.

Comment by shevy-java 8 hours ago

"over a decade ago, the repository has been licensed under GPLv2. And that’s not changing"

Well - people can continue the GPLv2 fork anyway. So ultimately what Cal.com would do here does not matter; that's the beauty of GPL in general. It is a strict licence. I think GPLv2 was the better decision for the Linux kernel than, say, BSD/MIT.

> That code is exposed to constant scrutiny from attackers, defenders, researchers, cloud vendors, and maintainers across the globe. It is attacked relentlessly, but it is also hardened relentlessly.

It is clear that there is a business decision with regards to Cal.com jumping away from discourse, but the claim that open source is automatically better than closed source, when it comes to security, is also strange. Remember xz utils backdoor? Now, people noticed this eventually. Ok. How many placed trojans exist that people are unaware about? Perhaps there are more sophisticated backdoors. Perhaps AI is also used to help disguise them. I don't think that merely because something is open source, means it is automatically good or better with regards to security. Can you trust software? In California there are recent censorship bills to restrict 3D printing further, allegedly to curb on plastic guns (but in reality sponsored by lobbyists from the industry). Can a 3D printer print out a 3D printer that is not restricted? Is the state sniffing after people via laws not also a restriction? I guess it is possible to ensure a clean open hardware and open software system acting in tandem. But you kind of have to show that this is the case. See this old discussion about Trust, on reddit: https://old.reddit.com/r/programming/comments/1m4mwn/a_simpl...

Comment by unsungNovelty 5 hours ago

> I think GPLv2 was the better decision for the Linux kernel than, say, BSD/MIT.

I differ here. The reason why the corporations run Linux Foundation which pays Linus is cos of this license. Otherwise, they would take what they want and not interfere like they do with FreeBSD and OpenBSD. BSD/MIT leads to better compliance.

The only reason it stays this way is cos Linus owns the trademark. Wait until Linus steps down. Most likely a someone who aligns more with corporates will take charge and you'll see changes then.

If interested - https://www.unsungnovelty.org/posts/05/2023/open-source-proj...

Comment by fsflover 7 hours ago

> the claim that open source is automatically better than closed source, when it comes to security, is also strange. Remember xz utils backdoor?

The XZ attack is an extremely rare event coming likely from a state actor, which actually proves that FLOSS is a big target not easy to attack without huge effort. It was also caught not least thanks to the open nature of the repository. Also, AFAIK it wasn't even a change in the repo itself.

In short, using FLOSS is the way to ensure security. Whenever you touch proprietary staff, be careful and use compartmentalization.

Comment by Orygin 3 hours ago

Yeah I found this comment to be weird. At least the XZ backdoor was found before it went live anywhere. How many companies were hit by the Solarwind supply chain attacks?

Comment by Chaosvex 8 hours ago

That's quite the thread. It seems like a good chunk of posters didn't even begin to grasp the point.

Comment by TeMPOraL 7 hours ago

We're talking about SaaS businesses anyway. Open Source doesn't really matter there - you never actually know what's running on their servers.

Comment by fsflover 7 hours ago

Unless this is AGPL.

Comment by maxloh 5 hours ago

Nope. You can never verify they run the same code from their repo. You cannot physically access their system after all.

Comment by fsflover 4 hours ago

Illegal actions are often hard to prove, and yet laws somehow work in general. Same here with obeying the license.

Comment by chrismorgan 10 hours ago

> Large parts of it are delivered straight into the user’s browser on every request: JavaScript, …

Ooh, now I want to try convincing people to return from JS-heavy single-page apps to multi-page apps using normal HTML forms and minimal JS only to enhance what already works without it—in the name of security.

(C’mon, let a bloke dream.)

Comment by ironmagma 10 hours ago

There are a lot of things to hate in the Web3 world. Lack of back button form resubmission or redirect loops is a strange thing to dislike though.

Comment by kelsey98765431 9 hours ago

The web has grown so hostile lately that javascript is honestly not safe or useful anymore. the only thing it's used for is serving ads and trackers and paywalls, if i can't read a website with no script enabled it's not meant for me and im just not reading it.

Comment by bruce511 9 hours ago

I concur that most web sites could use less JavaScript. And a lot of (but not all) cosmetic uses for JavaScript can be done in CSS.

Of course for web apps (as distinct from web sites) most of what we do would be impossible without JavaScript. Infinite scrolling, maps (moving and zooming), field validation on entry, asynchronous page updates, web sockets, all require JavaScript.

Of course JavaScript is abused. But it's clearly safe and useful when used well.

Comment by sebbadk 8 hours ago

Infinite scrolling is JavaScript abuse. Pagination is much better for letting people keep track of their progress and time.

Comment by LorenDB 1 hour ago

> web apps

See, that's where we went wrong. IMO the web is for web sites. Co-opting the browser for full applications has led to the significant degradement of modern software. If we must have a "write once, run anywhere" approach for modern development, can we at least use WASM bytecode and build a dedicated runtime that doesn't use the browser for GUI output?

Comment by LoganDark 10 hours ago

This article raises a lot of good points that strengthen the argument against keeping models away just because they're "too powerful". I remain disappointed to see AI corporations gloating about how powerful their private models are that they're not going to provide to anyone except a special whitelist. That's more likely to give attackers a way in without any possibility for defense, not the other way around.

Comment by NitpickLawyer 10 hours ago

I think the "too powerful" is a convenient half-truth that also helps with marketing, and more importantly keeps the model from being distilled in the short term. They'll release it "to the masses" after KYC or after they already have the next gen for "trusted partners".

Comment by LoganDark 10 hours ago

I feel bad for Anthropic because they thought Persona was an acceptable KYC provider. It probably was a genuine mistake. I might have to leave them over that, if they think it's fun to ask me to give Peter Thiel my ID to persist indefinitely on Persona's servers!!!

Comment by drambledon 3 hours ago

Their own software has become so bloated that now they're pivoting to bandwagon marketing. Soon some corporate enshittification platform will buy them.