• 53 Posts
  • 539 Comments
Joined 2 years ago
cake
Cake day: June 11th, 2023

help-circle






  • At the end, pointing to their Bugzilla issue tracker

    I’ve always found Bugzilla incredibly inaccessible. It’s so overloaded, so complicated, so noisy with unrelated and irrelevant things. It always baffled me how projects use it and keep using it, and especially projects like Thunderbird and Mozilla, for such a long time.

    I regularly use bug trackers, to report, comment, or work on. When I see Bugzilla, in most cases, I give up/leave right away.

    Consequently, I find it ironic that they point to Bugzilla at the end.


    That being said, I think this video is a good intro to accessibility, common issues, and study findings.


    How do you guys view Bugzilla as an issue tracker, bug tracker, and work task tracker?








  • If you want to talk about possible risks to your supply chain, a single maintainer that’s grossly underpaid and overworked. That’s the risk. The country they are from is irrelevant.

    Total nonsense.

    A good open-source maintainer won’t act maliciously, even when underfunded, until they are forced to.

    A FOSS project that is underfunded has its own problems. But if it becomes unmaintained, you can take over or react. The other risks are assessable.

    Russia is an oppressive regime that continuously attacks other parties through hybrid warfare. Who knows what environment and pressures the maintainer is under? The more important the project is, the more value it has as an attack surface.

    How can they think and publicize “nah, underfunded is more important”? And even going further than that, claiming the country is irrelevant?



  • If you want to talk about possible risks to your supply chain, a single maintainer that’s grossly underpaid and overworked. That’s the risk. The country they are from is irrelevant.

    Total nonsense.

    A good open-source maintainer won’t act maliciously, even when underfunded, until they are forced to.

    A FOSS project that is underfunded has its own problems. But if it becomes unmaintained, you can take over or react. The other risks are assessable.

    Russia is an oppressive regime that continuously attacks other parties through hybrid warfare. Who knows what environment and pressures the maintainer is under? The more important the project is, the more value it has as an attack surface.

    How can they think and publicize “nah, underfunded is more important”? And even going further than that, claiming the country is irrelevant?


  • I deliberately chose KeePass with no Webbrowser extension and no cloud service that other password managers and password manager services provide to reduce risks.

    Webbrowsers are very interconnected tech with non-obvious relations and risks. Having my webbrowser access my password database feels inherently irritating.

    Webbrowser’s own password managers with optional sync have the benefit of auto-fill only being offered for the correct domain names. But I’d never store my critical passwords in them.

    Having to launch a separate password manager, enter a long master key, and then copy-paste/trigger-auto-type the content from it is cumbersome, but the only way to add a reasonable robust separation.