Even great programmers can be terribly misguided [LWN.net]

Even great programmers can be terribly misguided

Posted Jun 3, 2026 13:37 UTC (Wed) by alex (subscriber, #1355)
In reply to: Even great programmers can be terribly misguided by bignose
Parent article: Tridgell: rsync and outrage

It's a classic FLOSS problem but there was a succession plan and the previous maintainer retired and handed the reigns back to Tridgell. While there are now people on the brigaded issue trackers offering to take over maintainership I doubt it would be responsible to hand the project over to some random github handle without seeing the quality of their work.

There were a lot of commentators who were sure the reason for the regression was LLM usage but precious few willing to do the work to identify the offending commit or redo the CVE fixes on an "LLM free" branch of the code.

to post comments

Even great programmers can be terribly misguided

Posted Jun 3, 2026 19:47 UTC (Wed) by raven667 (subscriber, #5198) [Link]

> It's a classic FLOSS problem but there was a succession plan and the previous maintainer retired and handed the reigns back to Tridgell.

This is the part where I think the most issues are, when big companies ship volunteer-created code (that they found on the Internet) for commercial purposes, then they need to be responsible for the long-term maintenance and security of that code, and can't just defer to the original volunteer maintainer as an accountability sink. "No warranty express or implied for any purpose" is not really ethical for widely-deployed software but no one person can/should be held accountable for all the ways something like rsync is being used, so you can't just forward all CVEs to Tridgell and say "job done", he _can't_ fundamentally accept that responsibility, its too much.

I think it'd be healthy for orgs which ship FOSS to others if they planned on forking and having some vendor consortium to handle maintenance, like Linux Foundation, that might hire the original maintainer, but can also develop a team capable of handling the responsibility incurred when shipping code in products to other people. The idea that major software projects should be organized around individual BDFLs seems crazy to me now that FOSS is such a part of modern infrastructure.

I think there might be some resistance from FOSS maintainers though, a lot of people are attached to the prestige that comes with creating a successful project (eg "my code is interplanetary because it's on the Mars Rover"), but we don't organize other human infrastructure projects around individual engineers, we don't design airplanes or bridges that way, and while small projects the equivalent of building your own garden shed don't require a lot of rules, because the potential harm is low, the more people affected the more responsibility for safety exists and the less its fair to have borne by individuals and should instead be borne by organizations, institutions, culture, etc.