4 ms·

> The uncomfortable truth is these libraries need scratch rewrites with better authors. If that's true, do you think that having money might possibly be helpfu

by samhw 5y ago

> The uncomfortable truth is these libraries need scratch rewrites with better authors. If that's true, do you think that having money might possibly be helpful to that effort?

ksaj 5y ago
One of the maintainers in question holds two jobs to live. Having money might allow him more time to test and retest and update the software more expediently.
- samhw 5y ago
  Sorry, I was posing that question semi-sarcastically. I agree it's blindingly obvious to any sensible person that money would help immensely. However, sadly, there are apparently plenty of people who are just about sensible enough to be able to get out of bed and navigate to this site, but not sensible enough to understand much else.
dwaite 5y ago
That wouldn’t be funding log4j2 though (from the ‘better authors’ part). That would most likely be an internal effort (devs you trust) published as a new open source logging framework in a sea of existing ones.
staticassertion 5y ago
Honestly, absolutely not, and I think money would be harmful. Lots of software doesn't need a lot of work. It can be simple. When people get paid to solve problems there's an incentive to add more code, to add new domains, etc. Use the standard java logger and move on, it's that easy.
- tekknik 5y ago
  Where’s my incentive to work the weekend supporting a project after a long week of supporting my production code? If we want solid and secure OSS, we gotta pay someone!
  - staticassertion 5y ago
    Presumably it's the same incentive that pushed you to write it the first time. If you don't want to work on it anymore that's OK too. Open source libraries are generally not held to particularly stringent requirements by the vast majority of people - perhaps accepting an obvious patch in a critical situation, at most. You obviously can pay people. They're called employees. The thing about employees is that your money translates to business value, which is much broader than a single library. This means that when a single library is done the developer doesn't have to think "ok but what's next for this library" and start adding more code. They can stop and move on to other tasks. Paying for a single library is nice. I support multiple open source developers because I appreciate their work. I recommend everyone does so. I don't at all believe it's going to help security though.

by samhw 5y ago

> The uncomfortable truth is these libraries need scratch rewrites with better authors. If that's true, do you think that having money might possibly be helpful to that effort?

ksaj 5y ago

One of the maintainers in question holds two jobs to live. Having money might allow him more time to test and retest and update the software more expediently.

samhw 5y ago
Sorry, I was posing that question semi-sarcastically. I agree it's blindingly obvious to any sensible person that money would help immensely. However, sadly, there are apparently plenty of people who are just about sensible enough to be able to get out of bed and navigate to this site, but not sensible enough to understand much else.

dwaite 5y ago

That wouldn’t be funding log4j2 though (from the ‘better authors’ part). That would most likely be an internal effort (devs you trust) published as a new open source logging framework in a sea of existing ones.

staticassertion 5y ago

Honestly, absolutely not, and I think money would be harmful. Lots of software doesn't need a lot of work. It can be simple. When people get paid to solve problems there's an incentive to add more code, to add new domains, etc. Use the standard java logger and move on, it's that easy.

tekknik 5y ago
Where’s my incentive to work the weekend supporting a project after a long week of supporting my production code? If we want solid and secure OSS, we gotta pay someone!
- staticassertion 5y ago
  Presumably it's the same incentive that pushed you to write it the first time. If you don't want to work on it anymore that's OK too. Open source libraries are generally not held to particularly stringent requirements by the vast majority of people - perhaps accepting an obvious patch in a critical situation, at most. You obviously can pay people. They're called employees. The thing about employees is that your money translates to business value, which is much broader than a single library. This means that when a single library is done the developer doesn't have to think "ok but what's next for this library" and start adding more code. They can stop and move on to other tasks. Paying for a single library is nice. I support multiple open source developers because I appreciate their work. I recommend everyone does so. I don't at all believe it's going to help security though.