Re: References Are Needed

On Sun, 15 Mar 2009, Laurent Bercot wrote:

> > Mark Johnson is a distributor of DJBDNS-based code, so this
> > discussion is indeed on-topic to the DJBDNS list.
> 
>  Talking about Mark Johnson's code is relevant.
>  Talking about his background is not.

You can't be serious.  We irreconcilably disagree. Many people who use
distributions of code, agree with me: The background of a the person in
charge of the distribution is relevant.

> > Code has quality and reputation. Quality and reputation require
> > references, background and biographical data. I can find none of
> > this on Mark Johnson
> 
>  If what you're interested in is the quality of the zinq-djbdns
> package, why don't you audit the code yourself instead of asking for
> references?

I have indeed started to look into it. Zinq-djbdns is reported to be
distributing a patch which is known to be bad and originate from
untrustworthy sources. The "Mark Johnson" identity seems to have
appeared on the scene at roughly about the same time the Vixie/Kaminsky
scam would probably have been conceived.  I asked a while back if anyone
knew "Mark Johnson". No one responded affirmatively. I asked again just
now. Still no affirmative answer.  So, I have asked the DJBDNS community
if anyone knew this "Mark Johnson" person whose first post on both the
Qmail list and the DJBDNS list involved repackaging DJBDNS software.  
Apparently, no one knows him.

Since no one acknowledges knowing of "Mark Johnson", Zinq-djbdns appears
to be distributed either by a sock puppet (for a discredited person
trying to hide their true identity) or maybe by an insubstantial junior
person whose trustworthiness and reputation can't be established.  
Possibly no one wants to admit knowing "Mark Johnson" because he has a
bad reputation that they know but don't want to report.  There is no
work history for "Mark Johnson", no work references, no personal
references, nor even a physical address.


> You would have to trust the references, too. Would you ask for
> references on references? Where is your chain of trust rooted?

You can't be serious.  Like most people, I stop when I find someone I
trust, a company I trust, at least a real person who doesn't have any
discrediting background--a kid starts with a clean slate, but not a
large line of credit.  People and Companies I trust can refer other
people that they trust.  If they refer bad people, I don't trust them
anymore.


> I would also argue that quality and reputation do not go hand-in-hand,
> far from it. DJB has a bad reputation among mainstream software
> developers, because most mainstream software developers do not
> understand DJB's design decisions. But would you pretend said design
> decisions are not justified?

Quality and reputation do go hand in hand because you cannot have one
without the other.  I've never heard of this "bad reputation" among
"mainstream software developers".  I don't know who these people are and
have never met them.  Judging by your views on reputation and
references, you seem to be pretty disconnected from the mainstream.  
Perhaps you have confused criticism of design decisions with reputation.  
Like literature, any design decision can be criticized because all such
decisions are compromises trading one thing for something else.


> my dog, Mark Johnson, DJB or Paul Vixie, you have the exact same
> guarantee, i.e. jack and sh*t.

You can't be serious.  It doesn't actually work that way in the real
world. Real people have duties and obligations. Real people can be held
accountable, financially or at least reputationally--that is, if they
have a reputation to begin with. Insubstantial or fake people (sock
puppets) can't be held responsible. So people naturally don't trust
them.


		--Dean


-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000