5 ms·

Author here. You do realise that the main source of dangerous vulnerability is low level infrastructure that do not come from these package managers ? The puri

• asdfghjhgfderty 4y ago
  nonsense. autoconf didn't have a core developer. But it had many distro package managers. there's nobody adding code/fixing bugs, but there are plenty people reading and looking at diffs before packaging it in distros. then the js libs have neither core maintainers nor anybody at npm corp that cares about security or reading anything. the top comment is correct to care about those before system libraries.
  • kelnos 4y ago
    I don't agree. When there's a problem in OpenSSL, OpenSSH, or libc, nearly every company with an online presence has as freak-out and rushes to patch. When there's a vulnerability or malware found in a python or npm package, 75% of the tech world does a quick audit (or not), shrugs, and goes on with their day.
  • gsich 4y ago
    Why the weak words? "reading", "looking" is not "understanding".
    • pbhjpbhj 4y ago
      IANADev, but surely if they were going as deep as understanding patches they'd practically be a project maintainer rather than a package maintainer. Expecting package maintainers to have even reviewed diffs seems like high expectations. I wouldn't expect them to do more than the actual packaging. Weak words seem appropriate. I've hacked together a couple of packages for personal use but didn't even go so far at to look what language the code was in. I'm assuming a lot of packages from ppa-s are produced in an automated way with no code review, and depending on your distro that might also be true of some principal libraries.
• WarOnPrivacy 4y ago
  > when the source of the problem is the fact that NTP, OpenSSL, OpenSSH, the BGP daemon, the libc you run on, etc are all maintained and "fixed" and evolved by people that can barely pay for their food, even less for basic tests ? My take: I suspect that (perhaps a majority) of us here have a distant and abstract understanding of long-term poverty (eg:hunger on the table for years at a stretch). I'd offer that even the memory of real poverty doesn't equate with presently living in a long state of active poverty. Translating across that gap is hard. note: I'm not socially critiquing HN here. I am opining that survivor bias may be in play, however.
• numpad0 4y ago
  > NTP, OpenSSL, OpenSSH, the BGP daemon, the libc ... by people that can barely pay for their food I think those used to be national or telco lab projects in 60s-80s. The values created are hard to exploit and to capitalize. Perhaps it's a policy problem.
  • lantry 4y ago
    Yeah, I think that's the most viable solution to this problem. The US federal govt should fund software projects that are widely used. It's good for our national security, and it facilitates economic growth. This could either be grants to maintainers, grants to software nonprofits like linux foundation, or some kind of national software lab that employs people to maintain and audit open source software (or ideally, all of the above)
    • bombolo 4y ago
      They would not pay non-USA citizens, and the NSA would be asking for backdoors.
  • Animats 4y ago
    OpenSSL was at various times prior to 2014 maintained by a gamer guild, and by nobody.
• csomar 4y ago
  > are all maintained and "fixed" and evolved by people that can barely pay for their food, even less for basic tests ? I suspect many people working on OSS are getting paid, if not handsomely, then enough to survive.
  • hartator 4y ago
    I would be surprised if they even get a thank you per 1,000 users.
  • di4na 4y ago
    I advise you to go read the Road and Bridges report i linked in the blogpost. As of today, the reality is not at all. As I mentioned elsewhere there are zero maintainer of autoconf since 2012, even less one well paid. Log4j devs took unpaid time off to fix it. OpenSSL dev lived for years with less than 10k per year.
    • SSLy 4y ago
      > there are zero maintainer of autoconf since 2012, Paul's work doesn't count?