3 ms·
the text of the tweet: > Log4j maintainers have been working sleeplessly on mitigation measures; fixes, docs, CVE, replies to inquiries, etc. Yet nothing is st
by pxc 5y ago
the text of the tweet:
> Log4j maintainers have been working sleeplessly on mitigation measures; fixes, docs, CVE, replies to inquiries, etc. Yet nothing is stopping people to bash us, for work we aren't paid for, for a feature we all dislike yet needed to keep due to backward compatibility concerns.
Why don't they 'resolve' the security issue by removing the feature and then set up a bug bounty for backporting fixes to the shitty feature? Then the companies that depend on it will actually be on the hook for once.
Too much collateral damage for downstream F/OSS? Too unseemly a move, in a moment of ‘crisis’?
- acidbaseextract 5y agoI don't know why you're getting downvoted. This seems like exactly the right move.
- eyegor 5y agoSo your proposed solution is for the open source maintainers to release a hotfix build and to put up their own money to host a bug bounty program so someone else can fix it?
- Aeolun 5y agoI think what they mean is: If you want this misfeature back, pay us $50k to do it properly.
- meribold 5y agoCan anyone recommend a service that allows people to back specific GitHub issues (pledge money) other than Bountysource?
- trevyn 5y agoYou don’t really need a service, you can just post in the issue “I will pay $X for a merged PR that closes this issue.”
- meribold 5y agoCommenting may work if the issue has one or two large backers that can independently be vetted to be trustworthy. But if there are several dozen small backers, having to track them all down after closing the issue seems less than ideal.