4 ms·
I found this article and discussion to be a bit deeper: https://news.ycombinator.com/item?id=28539185 https://news.ycombinator.com/item?id=28539185 I'm not rea
by mr_tristan 5y ago
I found this article and discussion to be a bit deeper: https://news.ycombinator.com/item?id=28539185 https://news.ycombinator.com/item?id=28539185
I'm not really convinced security issues in open source libraries is a funding problem. Sure, sometimes money might help, but it might also just be used to add unnecessary features. I really see a management problem.
Additionally, how many projects have you worked on that does any analysis of it's dependencies? I've found it to be rare. I can count on one hand the number of developers I've met that bothered to learn commands to list their dependencies. Most have no idea that there exists tooling to say, "hey, there's something new".
Seems like we need just better understanding and prioritization of "ecosystem health". And it probably starts with just more users paying attention to what they're using. Maybe it's publishing clearer MTTR statistics, or better security updates, or all of the above. But it seems like we should all start with shoring up our own processes and workflows, instead of just saying "just find someone to give money to".
- MrDresden 5y ago>I'm not really convinced security issues in open source libraries is a funding problem. Sure, sometimes money might help, but it might also just be used to add unnecessary features. I really see a management problem. The article points this out as a management issue as well, but in regards to the response, not as the cause of the exploit. With a funded dev team, the response to fixing the bug would come more promptly. The issue here is that the FOSS decelopers who are doing this work for free are now expected to make this their highest priority. This kind of linchpin software SHOULD be properly funded by the companies and entities that use them.