5 ms·
Ask HN: Is funding the actual problem holding back Open Source security?
TL;DR: Is there any data to suggest that funding an Open Source project materially benefits the users of that project? If you know of any, please share!
This is a question that has been on my mind ever since Log4Shell. I want to know if funding could have an impact on preventing major vulnerabilities or if the issue is something else (lack of guidance for projects, too many cooks, rampant dev ADHD, etc).
It seems like a lot of people are talking about this[0][1] and how funding Open Source would help, but I'm concerned that it's simply wishful thinking that money alone would solve the problem. Sometimes reality is cruel like that.
Is it possible that more funding would help prevent the next Log4Shell or Heartbleed? Maybe! Or are we simply touting a solution, without any data, and our hubris could actually end up hurting security further by just having companies "wash their hands" of responsibility? If FAANG/Fortune 500 throws money over the fence at developers, how much of that money will actually translate into improving the Open Source software?
I personally believe that funding would _help_ with the security of Open Source software. And it would also help with documentation, support, and a number of other "health problems", all of which would likely help with security. But I'm also concerned that this could backfire too in spectacular ways (increased library proliferation to get funding, people pocketing it for a vacation, hackers targeting popular, dormant libs to harvest money from them, etc).
I'm not aware of any actual research/data to provide evidence around improving Open Source security. That's why I wanted to ask y'all. Hacker News is a pretty small community and I wouldn't be surprised if somebody from OpenSSF[2] chimed in to help answer this, lol.
Beyond funding, there are also some projects that I've found like CHAOSS[3][4] that seem to be thinking about quantifying risk for Open Source dependencies and other problems like the "bus factor". It doesn't matter if you fund a project if the dev behind it MIA.
If this data doesn't exist, then it's something that I'll likely start investing my time into generating. (I'm working on some Open Source tooling for dealing with managing dependency security[5] that follows up the Log4Shell tooling we also built[6], which is why this has been on my mind a lot recently.)
Anyway, if you're interested in brainstorming about this further, please shoot me an email (on my profile). Cheers!
0: https://www.wsj.com/articles/protect-open-source-software-prevention-oss-public-use-cybersecurity-innovation-cyberattack-apache-log4j-11643316125
1: https://blog.google/technology/safety-security/making-open-source-software-safer-and-more-secure/
2: https://openssf.org/
3: https://chaoss.community/
4: https://chaoss.community/wp-content/uploads/2021/10/English-Release-2021-10-21.pdf
(Search for "Business Risk" or use the Nav to find the section about how they're attempting to measure the security of Open Source packages)
5: https://github.com/lunasec-io/lunasec/tree/master/lunatrace
(This is under active development and is something that is a week or two away from being polished enough for serious usage.)
6: https://github.com/lunasec-io/lunasec/tree/master/lunatrace/cli/cmd/log4shell
- ssivark 5y agoThe biggest problem facing open source is that most of the people making OSS, and the loudest of the people using it, want very different things.
- freeqaz 5y agoWhat are some examples, just to clarify? Do you mean how often Open Source is just about tinkering vs companies care more about quality/tests? Who would be the proper "audience" to manage Open Source projects, if not the creator? Do you think that is the role of non-profit organizations like Apache and CNCF? Or would they be better served by Red Hat-type businesses? I don't think there is a right answer here, but I'm curious what your perspective on this is.
- ssivark 5y agoThe difference is far more fundamental, and I cannot do justice to it in a drive-by comment; but in short: FOSS projects are typically grounded in the idea of a gift economy, while business users are grounded in a market economy. The motivations in these two frameworks are as different as chalk and cheese... you can't "incentivize" people to give the gifts you want -- then it wouldn't be a gift anymore, and you've irreparably changed the nature of the transaction. Further, unlike gifting inside relationships, the motivation of gift givers (FOSS creators) is not to please some specific receiver(s), but to share with the world what they can envision and create... with the chance that it might brighten some random person's day being a pleasant bonus. They might occasionally be amenable to feedback, but they are simply not in the business of servicing clients. So why would/should they care eg. about security? Some of them very well might; all I'm saying is that you shouldn't be surprised when they have their own priorities. If businesses seek the "accountability" of a software vendor, they can try to find a supporting entity to enter into a business relationship with. Or hire developers so they can solve bespoke problems in the preferred manner. They could even try to upstream patches (depending on how receptive the maintainers are), but the only thing they have a right to do is to fork the codebase (complying with the license) and maintain their own version to satisfy their needs. That's just how gifts work. If they manage that, they are of course most welcome to organize together with like-minded users and set up maintenance teams, foundations, etc to support the project. It's possible the license (eg: GPL) means that this entity needs to continue operating in the gift economy. Entities in the market economy need to figure out how to do that, if they wish to use OSS inputs as an advantage in the market setting.