> Unfortunately, the public tender process encourages awarding contracts to these giants that repeatedly fail to deliver on even basic opsec and still believe in security-by-obscurity

So what you think would be the solution ? From what I see (both public tender or not), I would claim that "any large IT project/company will suffer from security issues", so not sure what is the added value to single out a process (the tender) or a region (Europe) if there is no obvious alternative.

I have (the start of a) solution, but it's a boring one:

You have to have people who care about this stuff.

If you don't care, the rest does not matter. It does not matter if, when and how you outsource if you don't care about the outcome. You can't just pay someone a salary, nor a consulting bill, check the box and say you've done your part.

And the other way around: These huge consulting conglomerates would get very few jobs if purchasers cared about the details, and not just that all the boxes are checked.

I don't think that's a particularly novel idea, the question is how do you get people who care in an organization that has hundreds of thousands of employees (the public sector)?

You may not like the trivial answer: The same way as we do everything else. How do we get people to show up for work? How do we get people to respect data security boundaries? None of these are questions of technology. The answer is culture. We need to create a strong shared culture of caring, by hiring people that care and putting them in an environment where caring is appreciated.

Split giant projects into small ones, award it to better smaller companies, require interoperability via API that is clearly documented and ask for around the clock security monitoring and patching. The last things being the same thing you do at any decent private company.

IBM or Accenture or whoever don't need to be the only ones winning tenders.

The total number of people working on the project might remain similar no matter if it's one company or many smaller companies. Writing clear documentation and API, well thought from the start is harder the larger the project.

Maybe there would be a benefit from having less layers of management, but multiple small companies or one big could have the same structure.

A smsller company would have a flatter structer and less management.

Waiting for my coffee now, I had a thought: what if you have more than one company providing the same service and for a project “lifetime” of say 5 years, the money is split procentually by what company attracts the more users and you make it so that for the services offered through this you can only use one company, but you can switch at anytime.

Absolutely. One of the root causes for these terrible tender processes is a fear of in-housing competence and skill for systems.

It's the same reason major govt. IT orgs keep pushing for closed source (recently the Swedish Tax Authority was in the media for _pushing for Office 365_ as necessary for operations), out-sourced designs, big firm purchases over FOSS or real standards.

You need people that care (and they exist, even in the gigantic state orgs.) in positions to make good decisions. Right now, everything is up in the hands of nebulously defined managerial staff with none-to-doubtful technical competence.

Another recent case: the Swedish digital exams platform flopped at a rough cost of a billion SEK. Can't sustain 150K concurrent users, despite paying a "large company". Like, come on.

Germany has iirc liability for the entire chain (engineers to upper management) in case of data breaches. I remember having to sign for that when I did a project in Germany. Would that help? I would not mind if the CEO/CTO of Odido would spend a couple of years in a federal pound them in the ass prison if it is found out the leak was due to malpractice.

Irak war seemed to me reasonably "in plain sight". And there were other blunders as well. What I find amazing though is that more people passionately believe very strange reasons.

30 years ago people were like "meh, sure we don't get something, I bet there are hidden interest that I don't know about". Nowadays they are like "oh, yeah we attack country X because they have aliens that attack us telepathically, I know that for sure and if you don't agree you are an alien too!".

Technology can change things but people that profit today from something will oppose a change.

Case in point: switching from oil to renewables - which can lower dependency to external actors a lot as solar panels and windmills have life span of years, so even if the producers suddenly refuses to sell more, one has some time to find an alternative - was done slower than it could have because of "discussions".

Since 20 years I almost feel the discussion "climate change or not" is fueled by people that want dependency on oil, such that we don't talk about the issue of a couple of big producer points of failure (USA, Russia, Gulf countries). Not sure if oil companies are smart enough to finance green groups (to which I agree generally but is besides the point), such that the public discourse stays in a conflict area (climate) rather than a simple one (independence), but if they are that would be meta-evil.

It depends a lot on how accessible those services are. I tried to host some git repos 5 years ago and it was a hassle (needed mostly private git and reviews nothing fancy). I tried again this year and using forgejo was extremely easy. I don't remember exactly what problems I had before, so maybe I got better at finding things, but this time felt more polished. Containers, reasonable defaults, good tutorial on how to start, took in total less than one hour. I did in the meantime an upgrade and that was really 5 minutes (check change-log, apply it and go)

Of course, lots of work was done in the background to reach this point, but I think it is possible. Will I make the effort to make that happen for a social network? No, because I am not using them that much.

Technically things become simpler (in the sense that you can do it "at home" and if you add LLM-s to answer you when you don't know some obscure option it is even easier), but identifying well the use-case, deciding defaults, writing documentation, juggling trade-offs will remain as hard as before.

Note/edit: something being possible does not mean one should do it, so I think it will depend on everybody's priorities and skills. I wish though good luck to anybody trying...

Out of curiosity, how do you handle backups?

(To my great disappointment, a lot of "how to self-host" guides just omit that step, and quietly assume that disks don't go bad...)

Not the poster, but: use ZFS or LVM + XFS on your machine, do a snapshot, use restic or kopia to back it up to cheap object storage in the cloud, such as R2. If it's too technical, run syncthing and mirror it to a USB-connected external disk, preferably a couple of meters away from your machine.

A poor haphazard backup is better than no backup.

> A poor haphazard backup is better than no backup.

but is it better than cloud provider?

Cloud provider can lock you out without recourse and you'll lose your data.

Local backups can fail, be destroyed (for example a failed PSU kills both your PC and any attached devices), or be deleted by malware

How complex do you need to have your local backup to achieve cloud providers' reliability?

The best backup is a proper 3-2-1, with regular testing of integrity, and regular restoration from a backup as an exercise. But most people cannot be bothered to care quite so much.

So, keeping a half-assed backup copy on a spouse's machine in a different room is still better than not keeping any copy at all. It will not protect from every disaster, but it will protect against some.

My own backups progressed from manual rsync to syncthing to syncthing for every machine in the house + restic backups (which saved my bacon more than once).

> It's negatively impacting people and servers that have no interest in having anything adult on them.

So who should police that? I am in certain communities that try to be stricter on moderation (which I love!) but it's hard work, lots of people trying to be at the edge of rules (with normal things like swearing, insults, etc.).

Whoever labels adult only and does not care is not wishing to put the effort to police that it actually is not.

Personally I do generally mind much more annoying, aggressive, stupid posters (in various channels), than the fact that I am not allowed to post some stupid adult-looking meme.

> So who should police that?

I don't have the right answers. I don't know that there _is_ a right answer.

> Whoever labels adult only and does not care is not wishing to put the effort to police that it actually is not.

Or they're unwilling to risk the consequences of making a mistake.

> the fact that I am not allowed to post some stupid adult-looking meme.

But, in my example, you don't lose the ability to post some stupid adult-looking meme. You lose the ability to post ANY meme. Because the risk of someone posting something over the line is that the entire server is suddenly adult only. And for something like a game server, that's can be a catastrophic change; it can destroy the community.

Is being able post memes that important? No, probably not. But giving up the entire ability to do something fun, that doesn't cause any real harm, because someone might do something stupid... and the response to that will be a full nuclear destruction of your community. Yeah, that part sucks.

Years ago is different to now. Many places in Russia or China, Dubai etc is very livable. Even lots of people are going about their lives normally in Dubai - these days.

China is definitely not so shit like portrayed by western media. At the same time London is also not run by Islamic Extremists as portrayed by perhaps the top media station in USA.

> Sad part is that probably the poor (everywhere) are the on

totally true.

Having also lived in a communist country, I agree that 35 years ago the difference was huge.

Unfortunately, since around 2000 the differences have become less and less every year, so what has remained now is a very small fraction of what was a quarter of century ago.

The socialist economies from the past were just the extreme form of capitalist economies, where monopolies controlled every market. The western economies are quickly approaching this stage.

Extreme surveillance of everybody was how the communist elites preserved their power, but the surveillance was actually illegal, because the constitution "guaranteed" the secret of communications, e.g. of mail and telephone. While the secret police or equivalent organizations did not care about what is legal or not, they were nonetheless forced to keep appearances and do their work covertly. They also did not have enough resources to process in a centralized form all the data collected by surveillance.

Now, in the western countries surveillance has been legalized, so the governmental agencies no longer bother to hide their activities. They also now have the means to spy on an unlimited number of people among hundreds of millions or even billions, so surveillance is already worse than it was in the communist countries, even if the consequences of being spied are not yet so severe (hopefully).

> Now, in the western countries surveillance has been legalized, so the governmental agencies no longer bother to hide their activities.

Hiding or not 20 years ago the west was trying to surveil it's population as much as they could as well, see the Snowden/NSA scandal.

> even if the consequences of being spied are not yet so severe

Spot on. I would go even further and argue that "communist countries" used to rule through "fear of the state", while west ruled through (among others) "fear of others" (used to be communist, now becomes migrants or other religious groups).

For me the surveillance is not ideal, but the worst is the average education level of a population. Without any surveillance, if my neighbor will suddenly believe I am a witch and burn me at stake (it did happen in the west!) I will not feel good because I was not surveilled.

Very reasonable stance. I see reviewing and accepting a PR is a question of trust - you trust the submitter to have done the most he can for the PR to be correct and useful.

Something might be required now as some people might think that just asking an LLM is "the most he can done", but it's not about using AI it's about being aware and responsible about using it.

Important though we generally assume few bad actors.

But like the XZ attack, we kind of have to assume that advanced perissitant threats are a reality for FOSS too.

I can envisage a Sybil attack where several seemingly disaparate contributors are actually one actor building a backdoor.

Right now we have a disparity in that many contributors can use LLMs but the recieving projects aren't able to review them as effectively with LLMs.

LLM generated content often (perhaps by definition) seems acceptable to LLMs. This is the critical issue.

If we had means of effectively assessing PRs objectively that would make this moot.

I wonder if those is a whole new class of issue. Is judging a PR harder than making one? It seems so right now

> Is judging a PR harder than making one?

Depends on the assumptions. If you assume good intent of the submitter and you spend time to explain what he should improve, why something is not good, etc, than it's a lot of effort. If you assume bad intent, you can just reject with something like "too large review from unproven user, please contribute something smaller first".

Yes, we might need to take things a bit slower, and build relations to the people you collaborate with in order to have some trust (this can also be attacked, but this was already possible).

On judging vs. making, also someone has to take time away from development to do code review. If the code being reviewed is written by someone who is involved and interested then at least there's a benefit to training and consensus building in discussing the code and the project in the review phase. The time and energy of developers who are qualified to review is quite possibly the bottleneck on development speed too so wasting review time will slow down development.

For AI generated code if previous PRs aren't loaded into context then there's no lasting benefit from the time taken to review and it's blank slate each time. I think ultimately it can be solved with workflow changes (i.e. AI written code should be attributed to the AI in VCS, the full trace and manual edits should be visible for review, all human input prompts to the AI should be browsable during review without having scroll 10k lines of AI reasoning.)

> LLM generated content often (perhaps by definition) seems acceptable to LLMs.

In my experience (albeit with non-coding questions), ChatGPT 5.2 is often quite eager to critique snippets of its own replies from previous conversations. And reasoning models can definitely find flaws in LLM-written code.

> I see reviewing and accepting a PR is a question of trust

I think that's backwards, at least as far as accepting a PR. Better that all code is reviewed as if it is probably a carefully thought out Trojan horse from a dedicated enemy until proven otherwise.

I think this is actually a healthy stance. If you want to maintain patches against a project, just maintain a fork the project and if I want to pull in your changes I will. No direct submissions accepted is not the worst policy I think

That's the key part in all this. Reviewing PR needs to be a rock solid process that can catch errors. Human or AI generated.

I think framing it as a trust question is exactly right

Depends where you take the train to London, it is a much nicer experience anyhow than going to airports and people should consider that as well (ignoring climate stuff)!

On the price, the very annoying thing is that fuel for planes is not taxed! Changing this would require quite some effort (falls under some specific laws, that are old and nobody wants to touch, etc.) but I think everybody should just ask "honest tax on fuels!" as this will make less people say (or thin) "but climate change is a hoax". Planes are just unfair competition to other transport due to taxes!

I agree re: fuel taxes, but it’s a complete nonstarter: passengers would be voting against their wallets, and airlines would lobby against it since it’s a vote against their business model.

Still worth trying, IMO.

An alternate approach that would be seen as consumer and business-friendly would be subsidizing companies with a certain level of fuel efficiency per passenger mile, targeted above current levels.

That's an optimistic view. Maybe they really are 10x slower on any task without a LLM.

Probably a wiser approach is to consider different times require different measures (in general!).

I did not study in detail if copyright "has always been nonsense", but I do agree that nowadays some of the copyright regulations are nonsense (for example the very long duration of life + 70 years)