Emelia 👸🏻
So @pixelfed@pixelfed.social still hasn't fully acknowledged nor fixed the security vulnerability from earlier this year, despite multiple people asking for updates over the past ~6 months.
Consider this friendly public encouragement to finish the fix and publish the security advisory
Sean Tilley@thisismissem@hachyderm.io Hey @dansup@mastodon.social, you need to fix this, dude.
dansup@deadsuperhero@social.wedistribute.org @thisismissem@hachyderm.io the fix was shipped months ago, thanks for spreading misinformation!
Emelia 👸🏻@dansup@mastodon.social @deadsuperhero@social.wedistribute.org so you shipped followers collection synchronisation? And you published the CVE? Because to my knowledge you haven't done either.
Emelia 👸🏻@dansup@mastodon.social @deadsuperhero@social.wedistribute.org unless I'm missing something? https://github.com/search?q=repo%3Apixelfed%2Fpixelfed%20Collection-Synchronization&type=code
Emelia 👸🏻@dansup@mastodon.social @deadsuperhero@social.wedistribute.org no published vulnerability report for it either:
Chad :mstdn:@thisismissem@hachyderm.io @dansup@mastodon.social @deadsuperhero@social.wedistribute.org why are we pulling our forks and daggers? Are we not together in building the fediverse together?
I'm not sure why this needs to be put on blast in public.
You do amazing work. This is pretty aggressive considering the context.
Emelia 👸🏻@chad@mstdn.ca @dansup@mastodon.social @deadsuperhero@social.wedistribute.org it's been at least six months of waiting for that CVE to be published, but instead it hasn't happened. This is bad security posture.
The last answer I'd had months ago from Dan was "I'll publish it when I implement followers collection sync to fully fix the issue", and there's been a lot of people privately asking for updates for months.
Chad :mstdn:@thisismissem@hachyderm.io @dansup@mastodon.social @deadsuperhero@social.wedistribute.org sorry, I have a hard time seeing this as "friendly public encouragement".
Dan is but one human, pushing four(?) full stack softwares. There's no where near enough devs in the fediverse and this is a prime example. I know in his heart of hearts he's doing everything he can as one human.
Emelia 👸🏻@chad@mstdn.ca @dansup@mastodon.social @deadsuperhero@social.wedistribute.org and that's kinda the problem isn't it? Doing multiple large things isn't sustainable, and it means that stuff like this drags on. If he wants to focus on loops, great, find someone to lead pixelfed, but trying to be the leader of multiple projects but not actually doing the things a leader should be doing isn't good for the fediverse.
One person alone shouldn't be attempting to build everything for the fediverse, others might build things if they think there's space for them to build, but instead Dan says he's going to do XYZ repeatedly and then fails to deliver.
Focus is a good thing, especially when the complexity we have is involved, and it's not like people haven't been trying to get answers on this. Posting publicly wasn't my first choice months ago.
Emelia 👸🏻@chad@mstdn.ca @dansup@mastodon.social @deadsuperhero@social.wedistribute.org trying to do everything often leads to doing all things poorly.
The blossoming fedi software is all ones where the folks are actually focused on just that project, whether that's the mastodon team with mastodon, rimu's team with piefed, julian and nodebb, bonfire and bonfire social.
Meanwhile Dan somehow things he can build a TikTok and a Instagram and a WhatsApp competitor all at once with fairly minimal team — he's the outlier here, and I don't think this behaviour should necessarily be encouraged because it is giving poor results and underdelivering to people.
Chad :mstdn:@thisismissem@hachyderm.io @dansup@mastodon.social @deadsuperhero@social.wedistribute.org so who else that has the talent, time, and treasure is going to step up and do it?
Emelia 👸🏻@chad@mstdn.ca @dansup@mastodon.social @deadsuperhero@social.wedistribute.org plenty of people, there's countless projects across the fedi for all sorts of things, dan doesn't need to be a one man army.
He could, if he wanted to, find a new lead developer for pixelfed if his interests are in loops now.
Emelia 👸🏻@chad@mstdn.ca @dansup@mastodon.social @deadsuperhero@social.wedistribute.org plenty of people, there's countless projects across the fedi for all sorts of things, dan doesn't need to be a one man army.
He could, if he wanted to, find a new lead developer for pixelfed if his interests are in loops now.
Chad :mstdn:@thisismissem@hachyderm.io @dansup@mastodon.social @deadsuperhero@social.wedistribute.org why would he need a new lead dev if he's perfectly capable of being in that role?
Where are others offering PRs?
Chad :mstdn:@thisismissem@hachyderm.io @dansup@mastodon.social @deadsuperhero@social.wedistribute.org why would he need a new lead dev if he's perfectly capable of being in that role?
Where are others offering PRs?
Emelia 👸🏻@chad@mstdn.ca @dansup@mastodon.social @deadsuperhero@social.wedistribute.org If he's not actually doing the leading then that's a problem. Where are the people doing PRs? He chased them all off, I can think of at least 3 people that wanted to contribute actively to his projects and he pissed them off by being completely unpredictable to work with.
Emelia 👸🏻@chad@mstdn.ca @dansup@mastodon.social @deadsuperhero@social.wedistribute.org If he's not actually doing the leading then that's a problem. Where are the people doing PRs? He chased them all off, I can think of at least 3 people that wanted to contribute actively to his projects and he pissed them off by being completely unpredictable to work with.
hiphopheaven@thisismissem@hachyderm.io @chad@mstdn.ca @dansup@mastodon.social @deadsuperhero@social.wedistribute.org why do they not create an alternative? This ia suppose to be the power of open source you can fork projects and create new wonderful things
hiphopheaven@thisismissem@hachyderm.io @chad@mstdn.ca @dansup@mastodon.social @deadsuperhero@social.wedistribute.org why do they not create an alternative? This ia suppose to be the power of open source you can fork projects and create new wonderful things
Chad :mstdn:@hiphopheaven@mastodon.social @thisismissem@hachyderm.io @dansup@mastodon.social @deadsuperhero@social.wedistribute.org there's no one stopping anyone from forking Dan's projects.
Chad :mstdn:@hiphopheaven@mastodon.social @thisismissem@hachyderm.io @dansup@mastodon.social @deadsuperhero@social.wedistribute.org there's no one stopping anyone from forking Dan's projects.
Emelia 👸🏻@chad@mstdn.ca @hiphopheaven@mastodon.social @dansup@mastodon.social @deadsuperhero@social.wedistribute.org it's hard when he'll actively fight against you, iirc, he got extremely mad when pixelfed-glitch was started, and threatened a trademark lawsuit. That probably killed that person's energy to work on it.
He also went after the developer of Vernissage a while back too, when they decided to do their own thing away from pixelfed.
Meanwhile he raises 100k for pixelfed, but it seems like all the energy is going into his other projects.
Emelia 👸🏻@chad@mstdn.ca @hiphopheaven@mastodon.social @dansup@mastodon.social @deadsuperhero@social.wedistribute.org it's hard when he'll actively fight against you, iirc, he got extremely mad when pixelfed-glitch was started, and threatened a trademark lawsuit. That probably killed that person's energy to work on it.
He also went after the developer of Vernissage a while back too, when they decided to do their own thing away from pixelfed.
Meanwhile he raises 100k for pixelfed, but it seems like all the energy is going into his other projects.
Chad :mstdn:@thisismissem@hachyderm.io @hiphopheaven@mastodon.social @dansup@mastodon.social @deadsuperhero@social.wedistribute.org I’m ceasing comment until Dan has a chance to comment because this is becoming a smear or opportunity to air grievances.
So far, I’m wholly disappointed to see corners of the fediverse so unwilling to work amicably with one another.
Chad :mstdn:@thisismissem@hachyderm.io @hiphopheaven@mastodon.social @dansup@mastodon.social @deadsuperhero@social.wedistribute.org I’m ceasing comment until Dan has a chance to comment because this is becoming a smear or opportunity to air grievances.
So far, I’m wholly disappointed to see corners of the fediverse so unwilling to work amicably with one another.