3 ms·
Once, I learned that someone wrote a "security patch" for another project that embeds mine. They focused solely on the part where their fuzzer caused a crash, t
by amiga386 3y ago
Once, I learned that someone wrote a "security patch" for another project that embeds mine. They focused solely on the part where their fuzzer caused a crash, they wrote a patch that, in their mind, fixes exactly the problem they found. But the patch made no sense - it added a check mid-loop for something which was an invariant. The actual wrongness was in an entirely different file, it was passing invalid initial values, and checks needed to go there instead. I fixed the issue in my project correctly, and in the changelog I gave credit to the original person for both discovering the security flaw and providing a patch... that I didn't use.
In another situation, I was using an emulator and it didn't read a file correctly. I read its source code for the first time, I fixed it, in what I thought was the right way. I supplied the bug report and the patch. The maintainer thanked me and fixed it a different way - a way that wasn't obvious from their code, but was a better fit.
In another situation, I found a library that sticks out like a sore thumb and doesn't accept values that other libraries do (the standard they're all aiming for says the value is "implementation defined" so this is technically allowed but it annoys me). I raised a bug. I offered a patch. The maintainer had a bug up his ass about this particular value and told me he was changing nothing. Not much I can do about that.
In conclusion:
FOSS maintainers aren't endless fonts of personal validation for you. Some of them don't even want contributors. They already gave you the software for free, _and_ the legal means to fix it yourself. You can patch it, you can fork it. Your fork might be better than theirs!
They might accept your bug report. They might review your patch. They might accept your patch. They might mentor in you how their project works. They might devote all their time to contribution management and never have time to write their own project. Each of these takes their time and energy. They don't owe you any of that. Not every project is a popularity contest, not every project wants your help. This is all OK.
- NBJack 3y agoIt isn't sustainable, and it's a sign of bad leadership waiting for the proverbial (or literal) "hit by a truck" principle to show up. You are correct in that it is the maintainers's choice. No doubt about it. But now, a potential contributor who invested a significant amount of time in a problem clearly nobody else had solved up to that point, was snubbed. The work was capitalized on, used as a foundation for a solution, and not even a comment giving credit was given. This sends a terrible message not only to them, but to future contributors as well on a project that needs a new generation of talent to perpetuate it. This isn't just any OSS project; this is the Linux kernel, something millions if not billions rely on. Scale up this behavior, and it won't end well.
- sshine 3y ago> It isn't sustainable, and it's a sign of bad leadership It can be sustainable; not all FOSS projects need every possible contributor. Being a good leader is not a prerequisite, either. Direct cooperation isn’t even necessary! The fact that source code is available allows anyone to fork and compete with the original authors. On average, only mismanaged projects will get out-competed by their forks.
- wang_li 3y agoYou're making some poor comparisons to justify how things were done in this instance. What actually happened here is someone encountered a bug, they diagnosed the bug, they fixed the bug, they brought the bug up on a mailing list, they updated their fix, they submitted their fix. The maintainer changed 1 line of their fix from an #ifdef to a macro that has the same ultimate effect and then stuck their name on the fix. Beyond the morality of doing this, there is a practical consideration of copyright issues. OP did that as part of his job. OP and his employer have some sort of agreement of ownership of these 30 lines of code and the maintainer putting his name on it and putting it into the kernel could someday be a problem.