Re: Coordination between developers in the Python project

[Terry Reedy]

On 11/1/2012 4:49 PM, Tengy Td wrote:
> Hello,
>
>
> I am a French student and I am currently realizing my final thesis in
> the field of Free/libre open source software.

If you really are what you claim, you should give more details to make
that plausible: university, college/dept, course of study, and post from
a university account, not an address at one of the current favorite
sites for con artists.

> It would be a great help for me if you could answer a short online
> survey (it should take approximately 5 minutes).

If you want the survey emailed to you, you should include it. If it is
hosted on a legitimate survey site, you should give a direct link.

> The link to the survey is:http://bit.ly/SzVrJe

Careful people do not open anonymous links from stangers. That file
could literally be anything, including a malware injection page.

> I would like to remind you that the participation is absolutely
> anonymous and voluntary, and you can quit it at any time. Your answers
> will be strictly confidential and will be used only for research purpose
> (no commercial use of any information you provided).

Even if you mean that for yourself, you cannot guarantee any of that.
For all you know, bit.ly records the ip address of each click.

--
Terry Jan Reedy

[Chris Angelico]

On Tue, Nov 6, 2012 at 6:09 AM, Terry Reedy <tjr...@udel.edu> wrote:
>> I would like to remind you that the participation is absolutely
>> anonymous and voluntary, and you can quit it at any time. Your answers
>> will be strictly confidential and will be used only for research purpose
>> (no commercial use of any information you provided).
>
>
> Even if you mean that for yourself, you cannot guarantee any of that. For
> all you know, bit.ly records the ip address of each click.

Maybe so, but bit.ly won't get your survey answers, so it's still
anonymous in that sense.

But I agree with your other concerns, which is why I did not click the
link (and didn't even bother to respond till now).

ChrisA

[Ian Kelly]

On Mon, Nov 5, 2012 at 12:09 PM, Terry Reedy <tjr...@udel.edu> wrote:
>
>> The link to the survey is:http://bit.ly/SzVrJe
>
>
> Careful people do not open anonymous links from stangers. That file could
> literally be anything, including a malware injection page.

In this case, the link leads to a Google Docs form, which is easy to
verify with a URL unshortening service.

[Chris Angelico]

By "URL unshortening service" you mean a simple HTTP request to
bit.ly:80, right? :) Though I admit there aren't many easy and
convenient ways to do that without immediately following the 301
redirect.

ChrisA

[Chris Angelico]

On Fri, Nov 2, 2012 at 7:49 AM, Tengy Td <duret....@gmail.com> wrote:
> It would be a great help for me if you could answer a short online survey
> (it should take approximately 5 minutes).
>

> This survey is designed to reach a better understanding of the cooperation
> and coordination between developers in Free/libre open source projects.
>
> There is no right or wrong answers, therefore, feel free to answer
> spontaneously and to skip the questions you feel you do not want to answer.

Okay, now that I have a chance to actually look at your survey, I have
some more useful comments to make :)

Most surveys don't care about people's exact ages. Unless yours is an
unusual exception, it'd be more manageable to ask for ranges, eg:

How old are you?
* Under 18
* 18-25
* 26-35
* 36-45
* 46-55
* 56-65
* Over 65

Also, there's a bit of a gap in your Education drop-down. I had to
leave it blank, as I never finished high school. Or does that not
matter to your survey?

ChrisA

[Steven D'Aprano]

On Mon, 05 Nov 2012 14:09:08 -0500, Terry Reedy wrote:

> On 11/1/2012 4:49 PM, Tengy Td wrote:
>> Hello,
>>
>>
>> I am a French student and I am currently realizing my final thesis in
>> the field of Free/libre open source software.
>
> If you really are what you claim, you should give more details to make
> that plausible: university, college/dept, course of study, and post from
> a university account, not an address at one of the current favorite
> sites for con artists.
>
>> It would be a great help for me if you could answer a short online
>> survey (it should take approximately 5 minutes).
>
> If you want the survey emailed to you, you should include it. If it is
> hosted on a legitimate survey site, you should give a direct link.

I'm pretty sure that "legitimate" survey sites don't vet the moral
character of their users. Just because a link comes from
"www.legitimatesurveys.com" doesn't mean it is safe or desirable.


https://docs.google.com/spreadsheet/viewform?
formkey=dDE4YzYxZ1lDN0dpdFFheGJZM3prdVE6MA

Is that legitimate enough?

>> The link to the survey is:http://bit.ly/SzVrJe
>
> Careful people do not open anonymous links from stangers. That file
> could literally be anything, including a malware injection page.

Yes dad.

While it is good and proper to exhibit a certain level of caution on the
internet, it is important to keep the dangers in perspective and not go
overboard. You just implicitly accusing somebody of likely being a
criminal who lures others to a malware site based on little more evidence
than the fact that he has a gmail email address and linked to bit.ly. I
think that has edging right up to the line between showing proper
caution, and rudeness and paranoia.

"Legitimate" sites are not safe either. With the proliferation of
Javascript, Flash, third-party advertisers, etc., just about any http
page on the Internet could in principle contain malware. And not just by
accident: Google has been caught illegally installing tracking cookies
then lying about it, Sony installed a root-kit on users' computers
(although not over the Internet) and Facebook is engaged in a neverending
privacy and security war against its users.

Nevertheless most pages are safe. Hundreds of millions of people browse
the web without being infected, protected by a combination of:

- firewall
- OS security features (such as not running everything as the
Administrator or root user)
- anti-virus and anti-spyware software

etc.

Let me be frank here: if this link was malware, there would be *far* more
cost-effective ways to spread it than by appealing to FOSS developers to
fill in a survey. A fake link promoted with "Check out this blog post by
Linus Torvalds where he smacks down Richard Stallman" ought to do it.

>> I would like to remind you that the participation is absolutely
>> anonymous and voluntary, and you can quit it at any time. Your answers
>> will be strictly confidential and will be used only for research
>> purpose (no commercial use of any information you provided).
>
> Even if you mean that for yourself, you cannot guarantee any of that.
> For all you know, bit.ly records the ip address of each click.

You use gmane to post here. How do you know that they aren't recording
your IP address? If they are, what are they going to do with it? What
nefarious use do you think people are going to do with your IP address?



--
Steven

[Ian Kelly]

On Mon, Nov 5, 2012 at 3:01 PM, Chris Angelico <ros...@gmail.com> wrote:
> On Tue, Nov 6, 2012 at 8:49 AM, Ian Kelly <ian.g...@gmail.com> wrote:
>> On Mon, Nov 5, 2012 at 12:09 PM, Terry Reedy <tjr...@udel.edu> wrote:
>>>

>>>> The link to the survey is:http://bit.ly/SzVrJe
>>>
>>>
>>> Careful people do not open anonymous links from stangers. That file could
>>> literally be anything, including a malware injection page.
>>

>> In this case, the link leads to a Google Docs form, which is easy to
>> verify with a URL unshortening service.
>
> By "URL unshortening service" you mean a simple HTTP request to
> bit.ly:80, right? :) Though I admit there aren't many easy and
> convenient ways to do that without immediately following the 301
> redirect.

That's one way to do it. Although I find it a bit easier to just use
something like unshorten.com, which is the first Google hit for "url
unshortener". Assuming that you trust that site to not be hosting
malware itself. :-)

[Chris Angelico]

A few years ago, I found myself bugged by URLs getting broken across
multiple lines when shared across a MUD communication channel
(80-character lines, with a header on each line, so there'd be between
65 and 75 usable characters per line), so I wrote a feature into my
MUD client that would auto-shorten long URLs by passing them to
tinyurl.com, and also "render" them on the other side - if it started
http://tinyurl.com/ then the client would, on request, query tinyurl
and snag the returned URL back into the display.

For some reason it never occurred to me to do it any way other than
direct socket operations in C.

ChrisA

[Gregory Ewing]

Ian Kelly wrote:
> Although I find it a bit easier to just use
> something like unshorten.com, which is the first Google hit for "url
> unshortener". Assuming that you trust that site to not be hosting
> malware itself. :-)

Ah yes, beware the Hungarian unshortening service that redirects
every request to a random porn page. They will plead incompetence,
of course.

--
Greg