5 ms·

I'm here wondering why big tech companies that have Too Much to Lose didn't already massively fund a project that freaking sshd depended on it (through systemd)

I'm here wondering why big tech companies that have Too Much to Lose didn't already massively fund a project that freaking sshd depended on it (through systemd). Like how does it hurt Google to assign 100 people to review and investigate commits of some project as basic and fundamental as a compression tool

junon 3y ago
sshd didn't depend on it, to be fair. Not officially at least.
WesolyKubeczek 3y ago
Poke at any large company at all, and you'll find that their in-house critical fundamental infrastructure thing is chronically underfunded, understaffed, bug-ridden, everyone is worried but no budget is ever approved.
- ghaff 3y ago
  Within a given part of an organization, just about everyone thinks they're underresourced and understaffed.
01HNNWZ0MV43FF 3y ago
Very shrimple https://en.wikipedia.org/wiki/Tragedy_of_the_commons https://en.wikipedia.org/wiki/Tragedy_of_the_commons
dlandau 3y ago
That's exactly what they do, though: https://cloud.google.com/assured-open-source-software/docs https://cloud.google.com/assured-open-source-software/docs
- arp242 3y ago
  Google also does code reviews for some commonly used projects (or maybe that's part of the same thing? I don't know). I went through that last year with one of my Go libraries. The idea is good, but the entire process is so bureaucracy-heavy and time-consuming that I found it both frustrating and entertaining in equal parts; like something out of Brazil (the film, not the country). So many emails, so many video meetings, so many people involved, so much talking. And all for looking at a 4,500 line Go library. "Here's the code; just clone and look at it, and let me know if you find something"... It's not like you need my permission to do any of this *shrug*.
  - dlandau 3y ago
    Brazil the country is also known for onerous bureaucracy
galangalalgol 3y ago
MS funded people and pipelines to analyze it. Jia Tan convinced them to disable the fuzzing that was designed specifically to find malicious behavior, using social engineering, and one MS engineer did find it.
- mkj 3y ago
  What were the MS analysis projects? The fuzzing was google-sponsored.
  - galangalalgol 3y ago
    You are correct. The article I read led me to conflate the Azure engineer's valgrind triggered activity with oss-fuzz. Which is as you say a google effort.

junon 3y ago

sshd didn't depend on it, to be fair. Not officially at least.

WesolyKubeczek 3y ago

Poke at any large company at all, and you'll find that their in-house critical fundamental infrastructure thing is chronically underfunded, understaffed, bug-ridden, everyone is worried but no budget is ever approved.

ghaff 3y ago
Within a given part of an organization, just about everyone thinks they're underresourced and understaffed.

01HNNWZ0MV43FF 3y ago

Very shrimple https://en.wikipedia.org/wiki/Tragedy_of_the_commons https://en.wikipedia.org/wiki/Tragedy_of_the_commons

dlandau 3y ago

That's exactly what they do, though: https://cloud.google.com/assured-open-source-software/docs https://cloud.google.com/assured-open-source-software/docs

arp242 3y ago
Google also does code reviews for some commonly used projects (or maybe that's part of the same thing? I don't know). I went through that last year with one of my Go libraries. The idea is good, but the entire process is so bureaucracy-heavy and time-consuming that I found it both frustrating and entertaining in equal parts; like something out of Brazil (the film, not the country). So many emails, so many video meetings, so many people involved, so much talking. And all for looking at a 4,500 line Go library. "Here's the code; just clone and look at it, and let me know if you find something"... It's not like you need my permission to do any of this *shrug*.
- dlandau 3y ago
  Brazil the country is also known for onerous bureaucracy

galangalalgol 3y ago

MS funded people and pipelines to analyze it. Jia Tan convinced them to disable the fuzzing that was designed specifically to find malicious behavior, using social engineering, and one MS engineer did find it.

mkj 3y ago
What were the MS analysis projects? The fuzzing was google-sponsored.
- galangalalgol 3y ago
  You are correct. The article I read led me to conflate the Azure engineer's valgrind triggered activity with oss-fuzz. Which is as you say a google effort.