3 ms·

Practically speaking, I'm going to assert that there is no team of developers, let alone single developers, who are capable of taking on both the burden of thei

Practically speaking, I'm going to assert that there is no team of developers, let alone single developers, who are capable of taking on both the burden of their own software and the software that they import. I simply can not imagine even a whole fortune 500 company supporting their own business logic written on top of Spring, which includes log4j and a whole host of other open source dependencies. And what's the commercial alternative? I'm personally not aware of one. Also, the liability thing is a grey area - it works for the US (mostly, Tornado cash is currently testing these waters) - since there are open issues with developers of "questionable" software traveling to some countries. Heck, even the US has pulled some OSS developers aside at customs because of their work on OSS projects.

411111111111111 4y ago
Wouldn't you have to start with the JVM? Or possibly with the Linux kernel?
- l33t233372 4y ago
  Not necessarily. If you _purchase_ software that includes the guarantees that you desire. (e.g. of correctness, fitness for purpose, and support), then you don’t have to maintain the entire stack yourself.
  - nradov 4y ago
    Even if you purchase the software from a commercial vendor that doesn't mean that the vendor will indemnify you for damages caused by their failures, or that they have sufficient financial resources to pay for such damages (counterparty risk).
  - conductr 4y ago
    At that point, just buy insurance
- AceJohnny2 4y ago
  What about the hardware? Who will take on liability for Row Hammer[1] vulnerabilities? What about Meltdown [2] or Spectre? [1] https://en.wikipedia.org/wiki/Row_hammer https://en.wikipedia.org/wiki/Row_hammer [2] https://en.wikipedia.org/wiki/Meltdown_(security_vulnerability) https://en.wikipedia.org/wiki/Meltdown_(security_vulnerabili...
  - Dylan16807 4y ago
    Rowhammer when it first came out, or rowhammer today? I'd say any memory made in the last five years that doesn't properly implement Target Row Refresh should put liability on the manufacturer.
Qerub 4y ago
> I simply can not imagine even a whole fortune 500 company supporting their own business logic written on top of Spring, which includes log4j and a whole host of other open source dependencies. > And what's the commercial alternative? I'm personally not aware of one. There's commercial support for Spring: https://spring.io/support https://spring.io/support https://tanzu.vmware.com/support/oss https://tanzu.vmware.com/support/oss

411111111111111 4y ago

Wouldn't you have to start with the JVM? Or possibly with the Linux kernel?

l33t233372 4y ago
Not necessarily. If you _purchase_ software that includes the guarantees that you desire. (e.g. of correctness, fitness for purpose, and support), then you don’t have to maintain the entire stack yourself.
- nradov 4y ago
  Even if you purchase the software from a commercial vendor that doesn't mean that the vendor will indemnify you for damages caused by their failures, or that they have sufficient financial resources to pay for such damages (counterparty risk).
- conductr 4y ago
  At that point, just buy insurance
AceJohnny2 4y ago
What about the hardware? Who will take on liability for Row Hammer[1] vulnerabilities? What about Meltdown [2] or Spectre? [1] https://en.wikipedia.org/wiki/Row_hammer https://en.wikipedia.org/wiki/Row_hammer [2] https://en.wikipedia.org/wiki/Meltdown_(security_vulnerability) https://en.wikipedia.org/wiki/Meltdown_(security_vulnerabili...
- Dylan16807 4y ago
  Rowhammer when it first came out, or rowhammer today? I'd say any memory made in the last five years that doesn't properly implement Target Row Refresh should put liability on the manufacturer.

Qerub 4y ago

> I simply can not imagine even a whole fortune 500 company supporting their own business logic written on top of Spring, which includes log4j and a whole host of other open source dependencies. > And what's the commercial alternative? I'm personally not aware of one. There's commercial support for Spring: https://spring.io/support https://spring.io/support https://tanzu.vmware.com/support/oss https://tanzu.vmware.com/support/oss