On 2/1/2025 7:27 PM, Michael Niedermayer wrote:
> Hi James
> 
> On Sat, Feb 01, 2025 at 10:30:21AM -0300, James Almer wrote:
>> On 1/31/2025 9:49 PM, Michael Niedermayer wrote:
> [...]
>>>
>>>
>>>> has worked. Changing it now because one person was unhappy with a CC (That
>>>
>>> This is a false statement. Iam not suggesting a change to the GA because of one CC
>>> iam suggesting a change because it is vulnerable to an attack.
>>>
>>> (The CC isnt even fixed by this, i think the concept of a CC elected out of a
>>> community thats full of mutual hate is a bad idea)
>>>
>>> But back to the topic, what do you suggest to fix the vulerability in the GA ?
>>> Or you dont care?
>>
>> Why do you say there's a vulnerability in the GA?
> 
> The FAQ describes how to exploit it. And i belive others independantly found
> this issue as well.
> 
> 
>> Has it been exploited for
> 
> Given the nature of this vulerability, its very hard to detect it being exploited
> 
> 
>> this to be an issue?
> 
> While active eploitation, certainly makes an issue worse. In general and
> especially when exploitation is not detectable, this is something we cannot wait for
> 
> 
>> Did someone to your knowledge buy a developer to write
>> 20 commits and get them into the GA?
> 
> Lets be carefull here with the words. But the awnser is "yes"
> Many developers have been paid to write commits. employees, contractors, students
> 
> Do i know of someone being asked after that to vote in a specific way ?
> No, how could i know other peoples private communication
> 
> Have people asked me how/if they should vote ?
> Yes, some people did ask.
> 
> In general "few time" outside contributors being payed to do some work dont
> care about the votes, they come, do some work and leave.
> I would expect the random subscriber of 2000 on ffmpeg-devel to care more
> as they follow the list for a long term they care more about the consequences

But what are the chances they'd get into the GA? Few-times outside 
contributors rarely submit more than a couple patches to implement the 
work they were paid for to do. Hardly 20 commits.
And we could always stop asking people to split their patches into 
several different smaller patches (cosmetics, refactoring, etc) to 
reduce the chances of one time contributors from meeting the GA 
requirements.

Looking at the current GA, do you see anyone in it who wrote code for 
their employer, met the requirements, and stopped being active after 
their work was upstreamed?

> 
> 
>> Otherwise, you're making a big deal out
>> of an hypothetical, and that's really damaging to the project.
>>
> 
>> I don't know if you realize, but you're being incredibly disrespectful with
>> almost everyone who has contributed anything in the last decade, treating
>> them as moles trying to bring down the project instead of contributing to
>> its success.
> 
> I would appreciate if you keep this emotional drama out. We need to look
> with a clear head at this. Noone is disrespectful to people using ssh if
> ssh is vulnerable.

It's not emotional drama, it's a fact. By your own admission you 
consider the GA, composed of almost every currently active developer, 
untrustworthy, vulnerable and in need to be scrapped or repurposed, with 
nothing to back that distrust other than hypotheticals about being an 
attack vector. Is that not being disrespectful to the people in it?

A potential "attack" to the GA can be worked around, as exemplified 
above. To request a complete redo of the system, arguments and actual 
events with considerable weight are needed. Otherwise, as i mentioned 
before, it will be perceived as someone asking for changes because they 
are unsatisfied.