Lemmy is exactly that for a lot of people, the developers are quite controversial.

Obviously most users are not installing the software from those developers on their personal machines, but serving a federated instance certainly involves doing so.

I know you do.

Well, you're here, aren't you?

I presumably already do. Am I expected to know every single maintainer of every single piece of software I boot up? That is a LOT of homework to run an application.

Genuinely can't tell if this a real question or some weird reductio ad absurdum thing on the not separating art from the artist trend in modern society.

Depends on the software. I'd not trust a vpn that was made in an authoritarian state. I'll play a game made in one.

As for the developer if they are more famous for their political views than the software I'd probably not install it.

Yes because it can be verified by others even if you don't understand

Really depends on the level of disagreement. If its total idiocy like maga or monarchist or something I would likely stay away. If they don't think ubi is a good idea I can get passed that.

Who's out here trying to figure out the political or other beliefs of developers? I've got around 50 docker containers running on my server, there's no way I'm going through people's profiles to see if they're morally aligned with me.

it depends on what the software is doing i guess

You use so much open source software--often indirectly--that it's almost impossible to avoid every asshole with an opinion.

That said, there is one dev where I disagreed with his actions so much that I actively avoid his stuff. It's not really political, but he's one of those devs who can do incredible work on his own, but has the social skills of a moldy sandwich. You may have used his work in the past indirectly, as his event library (libev) used to be the basis for Node.js. (The Node.js devs moved elsewhere many years ago due to technical issues such as Windows compatibility).

Anyways, he had a Perl event library known as AnyEvent. It has a bit of a weird, inside-out interface compared to most other event libs, but it works really well once you get the hang of it. The problem that came up was that he didn't like the way a certain extension module used AnyEvent. He threw a tantrum and had AnyEvent detect if that extension was loaded, and die() with a big error message about his personal opinion on the matter. This broke perfectly functioning systems when they upgraded AnyEvent.

That's when I stopped using his stuff and urged my coworkers to do the same. Can't risk that time bomb going off. Wasn't a small matter, either, as he also wrote the most common way to parse JSON on Perl.

I would probably trust but depending on the issue, I might just refuse to run it on my machines on principle. Just like how I wouldn't want to hang one of Hitler's paintings on my living room wall no matter how good it might be.

If it has lots of independent eyes on the code and provides a service I need and can't find a superior solution to, sure, as I will not be needing any services that disagree with my political opinions and as long as I'm not financially supporting said developer.

Depends heavily on application (access required, sensitivity of data handled, etc) and nature of disagreement as it pertains to trustworthiness.

Example A: I use Lemmy even though I disagree politically with the original devs because the design appears sound and it doesn’t require access to sensitive data.

Example B: I won’t use anything from the Proton Foundation because the founders’ personal comportment and political leanings have led me to suspect that they intend to sell user data.

I already do, I disagree with a lot of foss devs

Most of the time : Yes

But it depends on a lot of things :

Is there any viable alternatives ? What's the nature of the disagreement ? Is there a possibility of a fork emerging ? Etc...

I hate google but I can't replace Android studio at work or ask my employer to stop releasing updates on google play. If the disagreement is about project governance, I would support forking, see CoMaps or Forgejo. I will avoid projects for a variety of reason, two good examples are Manjaro and Hyperland, I avoid the former because of their collaboration politics and the later because they are plain bigots.

Politics can encompass a lot of thing and open source is a very political subject.

Sure. Brave and GrapheneOS are two that I trust but have misgivings about their project heads.

no.

IMO conservatives are untrustworthy and can't identify fact from fiction.

would you run software from a dev who has a problem discerning reality? do you think a schizophrenic person writes stable maintainable code?

mental health is an important part of gaining trust in your product. ironic that they continue to trust and support a geriatric nazi-wannabe, but goes to show how compromised conservatives are when it comes to their decision making skills.

if it is open source and sources I trust approve of it, sure

Depends on the context but generally I will. Like I don't love the lead of GrapheneOS but I still use there project. But I strongly disagree with Protons ethics and many other issues so I avoid them. Really it's a question of how much I want to care and how much I disagree with them.

it depends entirely on the context, what the software is, alternatives... etc

No. If I disagree with someone politically it's likely because they want me and anyone like me dead. Those people are dead to me.

I choose not to do business with anyone who's too vocal about their political disagreements. I'm paying you for your services not your opinion so shut up!

https://en.wikipedia.org/wiki/ReiserFS

Reiser was convicted of the first-degree murder of his wife, Nina Reiser

jdupes: it's great software. The author left GitHub not because of Microsoft, but because he refused to implement 2fa on his account, which GitHub made mandatory.

There's such different views on life that I don't think its possible to get software designed close to what you or I believe in.

If the source is open, the code is viewable. So yes I think I can trust, at least the code.

Also there's a saying "trust but verify". So actually check to see if the binaries your getting actually behave the way you think.

Yes, since not liking or disagreeing with someone isn't the same thing as likelihood they are pushing malicious code. If something is open source that's a really good sign, because they could also push closed source code and be more likely to get away with it that way. More points if it clearly has other eyes on it; even if I am not checking over the code myself, someone probably is for a lot of projects.

It's like "separate art from artist" except even more so because software tends to be even more quantifiable as its own independent thing than art is.

One my neighbors is a highly skilled craftsman. I dont use that label loosley. I'm a very competent DIYer but his work is in a class above mine. He built a metal railing around his deck and it is immaculate. Clearly constructed by someone with years of welding experience and a keen eye for detail.

We don't really talk politics but I know for a fact that there are at least a few things we disagree on.

That said, I would absolutely hire him to fabricate something for me if I needed it. I really doubt he does his day job because of his political beliefs. I assume he takes a lot of pride in his work and would do the same quality job for me as he would for anyone.

It's a serious error to constantly try to distill people down to their politics. That's a divisive tactic intended to devalue and dismiss "the other side." Whoever that happens to be at the moment. Don't misunderstand what I'm saying. Politics are important and the way our governments and societies operate affects all of us. But, people are complex and multi-faceted beings with a wide variety of experiences that shape who we are. Our lives are highly contextual and consequently, so are our dealings with others.

Only if they specifically seem fascist, because that's the one political group that likes to know everything you do and censor any dissenting opinion.

I'd see it as a seal of quality if the developer is a crank.

I mean... I used reiserFS for years and that guy killed his wife, I'm not too keen on that.

I guess its fine as long as its not actively malicious code, its not like I'm letting them into my brain.

On that though, I find it unlikely someone who differs from me politically would have the same priorities, and as such their projects are much less likely to show up on my radar.

Edit: spelling correction, Autocorrupt, ykwim?

Would you drive on a road made by nazis? Your life literally depends on the quality of the road, but where does political ideology come in to this equation?

With software though, different things are at stake, but how will ideology affect the quality? I think it does have a effect on features and how the project is run, but isn’t quality a mostly separate area?

Is the political disagreement around surveillance or something related?

Yes.

Whether you'd boycott it is another thing.

Not when it comes to anything important like work or other sensitive data.

open source is safe.

even non-technical people can learn how to look at issues on Github (or wherever the code is kept).

it's like restaurant reviews: if there are dozens of people saying they got malicious food, then you have reason to be careful, even if you don't understand why the food is malicious.

caveat: if the code is open source but no one has had time to review it, it's potentially dangerous even if there are no issues yet. it takes time for people to review the code. and there should be multiple reviewers; there's always the chance that a single malicious developer has created multiple github users. Time is on your side here.

for me, it generally boils down to "show me the work, then i decide".

some works are more influenced by politics like art pieces and written works. some, like architecture, plumbing and network stacks, much less so.

in this case, even if you don't know code but can be a good appraiser of political taint then you can decide on your own what to endorse or not.

I can't really apply "you don't understand the code yourself" because I do.

So I do check the code if it's something critical, but otherwise don't bother. For example the Lemmy server I'm running I didn't really check much because it can't really do any harm to me.

But if I was running Lemmy somewhere on my home network, I'd either isolate it or thoroughly check it (but probably just isolate it from the rest of the network and put it in a VM, nobody's got the time to read other people's source code).

Since you're asking specifically for "on my machine" I usually put stuff I don't fully trust in a VM.

I've installed thousands of programs on my systems over the past 30 years. Closed source, open source, you name it. Never had a single problem.

Trusting software is such an overblown hangup that people have. Even if it bites me in the ass someday, so what? I'll roll back, reformat, do whatever I have to do. It'll have been worth it.

No. Fuck that guy.

I trust the Lemmy developers enough to use their platform hosted on external servers despite them being Marxist clowns, but I wouldn't self host without a thorough code review.

And I'm seriously just waiting for a decent piefed app in order to ditch the platform altogether. So far voyager is the most functionally complete one, but doesn't look very appealing.

If there's no alternative that has the feature set that software has, the alternatives are ultimately worse, and/or I cannot find a fork from another less egregious dev, then it's like I'd have any other choice if I need the software. If I don't need the software, good chance I might just stop using it and just uninstall.

It's why back when I heard that the people in charge of Audacity, back a few years ago, had potential plans on adding telemetry, I stopped using it all together. Of course I kinda moved back because, as far as I know, all the forks are basically dead and the team went back on those plans due to community uproar. Now I just keep it unable to connect via firewall to be safe.

'Open source' is a deliberately ambiguous phrase, engineered to derail libre software.