Devuan, April Fools, and self-destruction

Lol, duuude.

Thanks for the laughing time for those of us, who didn't wish the Devuan project any luck from the beginning.

> I suggested that Devuan business users should consult their own attorneys as to their own liability if they continued to use Devuan after Devuan refused to audit or rebuild their compromised servers.

I'm sure they're at least entitled to their money back.

Disclaimer: I'm not a Devuan user or developer, and I don't follow their mailing lists, so my oppinion is merely based on sencond hand information, basically what's available on this site.

That said, I think this was blown way out of proportion. A joke is a joke, it's what April's Fools is about. Pretending that a joke can cover some kind of security problem just shows distrust for the developers. When this is the case, nothing Devuan could do will make for this inherent lack of trust. All the talk about "compromised" servers just shows that lack of trust, unless you have any other indication that there was an attack.

To sum up, if you don't trust the developers, don't use their software. And if you cannot tolerate a bad joke, don't go near human beings.

> As Devuan consists of little more than a few changes to a few Debian packages we were able to switch in a few hours with about as much effort as it takes to roll out an average day's security updates.

Which raises the question -- For an end-user, what exactly is Devuan's value proposition over Debian?

...And as a follow-up, how much of that value (and trust in Devuan's collective professionalism) remains after this juvenile stunt?

Don't you think you're overreacting a little because you fell for a pretty obvious April Fools joke?

I mean, "we're the hackers using green monochrome text monitors and have taken over the web to replace it with gopher, as it was always meant to be"? On April 1st?

- love to have tried to access any of this via gopher -

Well, if you are going off of user liability issues, your best bet is to switch to Microsoft products, as you are likely to be able to get an indemnification agreement. Commercial Linux distributions tend to limit their liability to software they wrote, and not all the FOSS that they merely packaged. With Debian, is there even anyone to sue? Is your liability any less if a distributor has a security breach they don't discover which causes you a loss as opposed to someone saying they had a breach followed by a nevermind? And, once you have that liability, do you have anyone with assets to subsequently sue?

Rather than asking a lawyer, asking your insurance broker is probably a better solution, as they are in the business of assessing risk and pricing it. If you can't get insurance, they will tell you why, and what you can do to be insurable. Alternatively, if you can't afford insurance, but have no substantial assets, it probably doesn't matter, as no one will sue an entity where there's no pot of gold at the end of the rainbow. The lawyers are more likely to say your liability is limitless, and so will your legal expense costs. A lawyer will never say there is no risk, as that opens them up to liability, and they don't want the cost of their Errors and Omissions insurance policy to go up.

> I suggested that Devuan business users should consult their own attorneys as to their own liability if they continued to use Devuan after Devuan refused to audit or rebuild their compromised servers.

Please note: April 1 is over.

Please don't publish your bad jokes here on lwn.net. They're not funny.