5 ms·

(Note: I'm the person that coined the term "Log4Shell") You may be surprised when I tell you what the Apache Software foundation's yearly budget is. You'd thin

(Note: I'm the person that coined the term "Log4Shell") You may be surprised when I tell you what the Apache Software foundation's yearly budget is. You'd think for software that is used by practically every Fortune 500 company and most governments, it would be something reasonable. Maybe a few hundred million dollars a year to pay for a reasonable full-time staff, right? It turns out... it's about $2 million a year. (Wikipedia[0]) This helps explain to me why the devs of Log4j directly uploaded the file "JNDIExploit.java" (the POC) to GitHub while they were patching. (Here is a full analysis about what happened[1].) They're not security people. They're volunteers working on this in addition to their full-time job. What kind of brave soul wants to trudge through and maintain log4j in their spare time for zero compensation? I appreciate the people that are capable of doing that, but I think they are rare! This whole entire vulnerability was eye opening for everybody and I have actually spent the last year building tooling on GitHub to help fix the problems that Log4Shell exposed. If you have 2 seconds to try that out or just Star the repo[2], it would be very helpful! 0: Log4j revenue https://en.wikipedia.org/wiki/The_Apache_Software_Foundation https://en.wikipedia.org/wiki/The_Apache_Software_Foundation 1: "How to Discuss and Fix Vulnerabilities in Open Source" https://www.lunasec.io/docs/blog/how-to-mitigate-open-source/ https://www.lunasec.io/docs/blog/how-to-mitigate-open-source... 2: GitHub project building better dependency patching tools https://github.com/lunasec-io/lunasec https://github.com/lunasec-io/lunasec

MuffinFlavored 4y ago
> What kind of brave soul wants to trudge through and maintain _____ for zero compensation? Can't this sentence be changed for almost any open source project?
- freeqaz 4y ago
  Absolutely, but if I had to rank Open Source projects by "enjoyment level to work on", I would rank a 10+ year old Java project primarily used by enterprise companies quite low on my list! Compare that to something like Bun.js[0] which is "sexy" and written in a "cool" programming language (Zig). Or Wasp[1] which is built with Haskell and is trying to define a new programming language designed to make common dev patterns less painful. Those projects are naturally going to soak up smart people that have extra energy to share because they hate their day job but need to pay their bills. (imo) Who is left that wants to bang their head against a legacy codebase like Log4j? Maybe somebody that feels there is "clout" to be had from it? (Spitballing here, I honestly don't know!) 0: https://github.com/oven-sh/bun https://github.com/oven-sh/bun 1: https://github.com/wasp-lang/wasp https://github.com/wasp-lang/wasp
  - pdntspa 4y ago
    I imagine that someone who is good at that style of Java might enjoy the challenge of working on it, particularly if they are already familiar with the codebase. There are a LOT of Java SWEs floating around...
    - dec0dedab0de 4y ago
      I bet a big chunk of them have contracts that prevent them from contributing to open source. Atleast without going through a painful vetting process that drains all the enjoyment from it.
      - lazide 4y ago
        Usually that does more than drain enjoyment, but tarpits it to the point it won’t happen - and is only to be a trap for employees so they think it’s an option.
  - di4na 4y ago
    As someone that has done and keep doing this in other niche... There are people that like to clean messes and make people life better from the shadows. These tend to be called engineers. You may be interested in https://www.fordfoundation.org/work/learning/research-reports/roads-and-bridges-the-unseen-labor-behind-our-digital-infrastructure/ https://www.fordfoundation.org/work/learning/research-report...
dub 4y ago
> What kind of brave soul wants to trudge through and maintain log4j in their spare time for zero compensation? It's not clear to me as an outsider what exactly the Apache foundation is doing for these projects. It feels like Apache is willing to accept code donations from anyone and is willing to attach the foundation's name to code that isn't widely used, actively maintained, or may just be abandonware. I have soooo much more confidence in CNCF projects. The conditions for graduating as a CNCF project include criteria like that your project must be in use by multiple real companies, have maintainers who are (paid) employees of multiple different companies, and get a professional security audit.
- c7DJTLrn 4y ago
  >It feels like Apache is willing to accept code donations from anyone and is willing to attach the foundation's name to code that isn't widely used, actively maintained, or may just be abandonware That's why I'm allergic to Apache software. A lot of it is overengineered, insecure, legacy abandonware.
- fh973 4y ago
  Apache is what CNCF will become when marketing budgets move on.
- rectang 4y ago
  > It feels like Apache is willing to accept code donations from anyone and is willing to attach the foundation's name to code that isn't widely used, actively maintained, or may just be abandonware. That’s incorrect. Projects need to report quarterly and need a Project Management Committee of at least three people, or they are retired. Retired projects may not make releases. (Source: past ASF board member, who used to review those reports each month.) There are a fair number of retired projects, and others that may become retired within the near-to-medium term. The ASF has been around for a while, and every software project has a life cycle. Those are still associated with the ASF brand because Google, whatcha gonna do? An explicit retirement policy overseen by a board is still superior to how the vast majority of open source projects approach end-of-life.
  - 4y ago
cmilton 4y ago
Why don't the billion dollar companies that bundle this into their own products make the necessary financial contributions? Hey Oracle.
- richbell 4y ago
  "How about we vindictively hold onto OpenOffice and then gift it as a white elephant to the Apache Software Foundation instead?" — Larry Ellison, probably
  - tialaramex 4y ago
    The ASF didn't have to say yes, and didn't have to allow "Apache OpenOffice" to decay for years afterwards without putting a stop to it. The current Apache OpenOffice "Vice President" ie the leader of its developers such as they are, is Jim Jagielski, who was also an Apache Director back when a previous "Vice President" suggested the project should be wound up altogether. ASF should have accepted, they did not.
- lazide 4y ago
  Because they can avoid doing so until…. I don’t know, ask next quarter eh?
AtlasBarfed 4y ago
If Linux, OSS, and the like is a firmament of modern society, AND IT IS, why would it be left to adhoc donations or the whims of corporate donations? There should be billions in funding of OSS from governments each year. Think that's ridiculous? Consider how much Microsoft makes in support payments from governments around the world. The US government has a 92 billion dollar software budget. I mean, look at this: https://www.reuters.com/article/us-usa-cyber-microsoft-exclusive/exclusive-microsoft-could-reap-more-than-150-million-in-new-u-s-cyber-spending-upsetting-some-lawmakers-idUSKBN2B713L https://www.reuters.com/article/us-usa-cyber-microsoft-exclu...
- lazide 4y ago
  Because they can.
- WJW 4y ago
  If it's that important, just make a new tax and stop dicking around with this "oh it would be so nice if companies would just donate out of the goodness of their hearts hint hint" nonsense. It's pretty clear that 99+% of for-profit companies have zero interest in paying for things that developers will (apparently) also develop for free. Society figured out a way of forcing people to pay for common goods a long time ago, and it's taxation.
tinus_hn 4y ago
So if they are all unpaid volunteer maintainers, what’s happening with that $2 million? It’s still a lot of money!
- speed_spread 4y ago
  Servers for documentation and release hosting, Servers for CI and testing will chew up
  - vbezhenar 4y ago
    Is it really needed today? GitHub can host documentation and releases. GitHub CI is free as well.
    - lazide 4y ago
      For small usage, and contributed as a marketing spend. If Apache tried to use it without doing it in the context of a formal deal or sponsorship, it wouldn’t last long. No such thing as a free lunch, or whatever.
- deleted 4y ago
  [deleted]
- rectang 4y ago
  See page 11: https://www.apache.org/foundation/docs/FY2021AnnualReport.pdf https://www.apache.org/foundation/docs/FY2021AnnualReport.pd... The core infrastructure team is paid, and that’s been the case since fairly early on — there’s too much work not suitable for a purely volunteer crew. Infra is half the budget.

MuffinFlavored 4y ago

> What kind of brave soul wants to trudge through and maintain _____ for zero compensation? Can't this sentence be changed for almost any open source project?

freeqaz 4y ago
Absolutely, but if I had to rank Open Source projects by "enjoyment level to work on", I would rank a 10+ year old Java project primarily used by enterprise companies quite low on my list! Compare that to something like Bun.js[0] which is "sexy" and written in a "cool" programming language (Zig). Or Wasp[1] which is built with Haskell and is trying to define a new programming language designed to make common dev patterns less painful. Those projects are naturally going to soak up smart people that have extra energy to share because they hate their day job but need to pay their bills. (imo) Who is left that wants to bang their head against a legacy codebase like Log4j? Maybe somebody that feels there is "clout" to be had from it? (Spitballing here, I honestly don't know!) 0: https://github.com/oven-sh/bun https://github.com/oven-sh/bun 1: https://github.com/wasp-lang/wasp https://github.com/wasp-lang/wasp
- pdntspa 4y ago
  I imagine that someone who is good at that style of Java might enjoy the challenge of working on it, particularly if they are already familiar with the codebase. There are a LOT of Java SWEs floating around...
  - dec0dedab0de 4y ago
    I bet a big chunk of them have contracts that prevent them from contributing to open source. Atleast without going through a painful vetting process that drains all the enjoyment from it.
    - lazide 4y ago
      Usually that does more than drain enjoyment, but tarpits it to the point it won’t happen - and is only to be a trap for employees so they think it’s an option.
- di4na 4y ago
  As someone that has done and keep doing this in other niche... There are people that like to clean messes and make people life better from the shadows. These tend to be called engineers. You may be interested in https://www.fordfoundation.org/work/learning/research-reports/roads-and-bridges-the-unseen-labor-behind-our-digital-infrastructure/ https://www.fordfoundation.org/work/learning/research-report...

dub 4y ago

> What kind of brave soul wants to trudge through and maintain log4j in their spare time for zero compensation? It's not clear to me as an outsider what exactly the Apache foundation is doing for these projects. It feels like Apache is willing to accept code donations from anyone and is willing to attach the foundation's name to code that isn't widely used, actively maintained, or may just be abandonware. I have soooo much more confidence in CNCF projects. The conditions for graduating as a CNCF project include criteria like that your project must be in use by multiple real companies, have maintainers who are (paid) employees of multiple different companies, and get a professional security audit.

c7DJTLrn 4y ago
>It feels like Apache is willing to accept code donations from anyone and is willing to attach the foundation's name to code that isn't widely used, actively maintained, or may just be abandonware That's why I'm allergic to Apache software. A lot of it is overengineered, insecure, legacy abandonware.
fh973 4y ago
Apache is what CNCF will become when marketing budgets move on.
rectang 4y ago
> It feels like Apache is willing to accept code donations from anyone and is willing to attach the foundation's name to code that isn't widely used, actively maintained, or may just be abandonware. That’s incorrect. Projects need to report quarterly and need a Project Management Committee of at least three people, or they are retired. Retired projects may not make releases. (Source: past ASF board member, who used to review those reports each month.) There are a fair number of retired projects, and others that may become retired within the near-to-medium term. The ASF has been around for a while, and every software project has a life cycle. Those are still associated with the ASF brand because Google, whatcha gonna do? An explicit retirement policy overseen by a board is still superior to how the vast majority of open source projects approach end-of-life.
- 4y ago

cmilton 4y ago

Why don't the billion dollar companies that bundle this into their own products make the necessary financial contributions? Hey Oracle.

richbell 4y ago
"How about we vindictively hold onto OpenOffice and then gift it as a white elephant to the Apache Software Foundation instead?" — Larry Ellison, probably
- tialaramex 4y ago
  The ASF didn't have to say yes, and didn't have to allow "Apache OpenOffice" to decay for years afterwards without putting a stop to it. The current Apache OpenOffice "Vice President" ie the leader of its developers such as they are, is Jim Jagielski, who was also an Apache Director back when a previous "Vice President" suggested the project should be wound up altogether. ASF should have accepted, they did not.
lazide 4y ago
Because they can avoid doing so until…. I don’t know, ask next quarter eh?

AtlasBarfed 4y ago

If Linux, OSS, and the like is a firmament of modern society, AND IT IS, why would it be left to adhoc donations or the whims of corporate donations? There should be billions in funding of OSS from governments each year. Think that's ridiculous? Consider how much Microsoft makes in support payments from governments around the world. The US government has a 92 billion dollar software budget. I mean, look at this: https://www.reuters.com/article/us-usa-cyber-microsoft-exclusive/exclusive-microsoft-could-reap-more-than-150-million-in-new-u-s-cyber-spending-upsetting-some-lawmakers-idUSKBN2B713L https://www.reuters.com/article/us-usa-cyber-microsoft-exclu...

lazide 4y ago
Because they can.
WJW 4y ago
If it's that important, just make a new tax and stop dicking around with this "oh it would be so nice if companies would just donate out of the goodness of their hearts hint hint" nonsense. It's pretty clear that 99+% of for-profit companies have zero interest in paying for things that developers will (apparently) also develop for free. Society figured out a way of forcing people to pay for common goods a long time ago, and it's taxation.

tinus_hn 4y ago

So if they are all unpaid volunteer maintainers, what’s happening with that $2 million? It’s still a lot of money!

speed_spread 4y ago
Servers for documentation and release hosting, Servers for CI and testing will chew up
- vbezhenar 4y ago
  Is it really needed today? GitHub can host documentation and releases. GitHub CI is free as well.
  - lazide 4y ago
    For small usage, and contributed as a marketing spend. If Apache tried to use it without doing it in the context of a formal deal or sponsorship, it wouldn’t last long. No such thing as a free lunch, or whatever.
deleted 4y ago
[deleted]
rectang 4y ago
See page 11: https://www.apache.org/foundation/docs/FY2021AnnualReport.pdf https://www.apache.org/foundation/docs/FY2021AnnualReport.pd... The core infrastructure team is paid, and that’s been the case since fairly early on — there’s too much work not suitable for a purely volunteer crew. Infra is half the budget.