4 ms·
The market value of an open source library is the price you’d have to pay to replace it. How much would it cost Google to hash out a minimum viable rewrite of
by gorgoiler 5y ago
The market value of an open source library is the price you’d have to pay to replace it.
How much would it cost Google to hash out a minimum viable rewrite of log4j2? Probably not much.
Why don’t they? Because the cost of just using log4j2 is 0… until it isn’t.
The externalities of the damage caused were never priced into that zero dollar price. I think about this every single time I depend on a third party library. Free now, but potentially pay very dearly later.
- seoaeu 5y ago> How much would it cost Google to hash out a minimum viable rewrite of log4j2? Probably not much. Building software is expensive. Based on a quick glance at the repository, it would probably cost $1+ million in developer salaries to replace it. To a company the scale of Google that isn't a lot of money, but they're benefiting a lot more than they let on
- jsnell 5y agoWhy do you think they're using log4j to any significant extent? I'd be a bit surprised if they ever did rather than rolling their own, because for something this simple the cost of writing your own is far cheaper than dealing with a dependency. We're not talking about Linux or Clang here... In particular, from https://github.com/google/flogger#yet-another-logging-api https://github.com/google/flogger#yet-another-logging-api: > Flogger is now the sole recommended Java logging API within Google.
- mbrodersen 5y ago> The market value of an open source library is the price you’d have to pay to replace it. Nope not at all. As long as somebody is willing to provide the code for $0 then the market value is $0. It is basic economics. The value of something is whatever you can get somebody to pay for it.
- gorgoiler 5y agoAhem, consider a hypothetical situation where the $0 version has an RCE :)