Keyoxide proof:

openpgp4fpr:E0C3497126B72CA47975FC322953BB8C16043B43
  • 0 Posts
  • 5 Comments
Joined 3 months ago
cake
Cake day: October 7th, 2024

help-circle

  • On the one hand, one Raspberry Pi would not really suffice. As @theherk@lemmy.world argued, you would need legitimate email addresses, which would require either circumventing the antibot measures of providers like Google or setting up your own network of domains and email servers. Besides that, GitHub would (hopefully) notice the barrage of API requests from the same network. To avoid that and make your API requests seem legitimate, you would need infrastructure to spread your requests in time and across networks. You would either build and maintain that infrastructure yourself –which would be expensive for a single star-boosting operation– or, well, pay for the service. That’s why these things exist.

    On the other hand, although bad programmers might use these services to star-boost their otherwise mediocre code, as you suggest, there are other –at least conceivable, if not yet proven– use cases, such as:

    • the promotion of less secure software as part of supply chain attacks, with organizations sticking to vulnerable libraries or frameworks in the erroneous belief that they are more popular and better maintained than alternatives, for example;
    • typosquatting; and
    • plain malware distribution.


  • If I understand them correctly, @geography082@lemm.ee’s point is not that it is wrong to monetize FOSS, but rather that companies increasingly develop open source projects for some time, benefiting from unpaid work in the form of contributions and, perhaps most importantly, starving other projects from both such contributions and funding, only to cynically change the license once they establish a position in their respective ecosystem and lock in enough customers. The last significant instance that I remember is Redis’ case, but there seem to be ever more.