3 ms·

I once got a (probably scam) offer for adding a cryptominer to a library that I maintained at that time. And a more serious offer to add trackers to a popular >

by berkes 3y ago

I once got a (probably scam) offer for adding a cryptominer to a library that I maintained at that time. And a more serious offer to add trackers to a popular >1M installs app. Both cases I obviously ignored it. But it made me aware of a nasty attack vector: someone who's thanklessly building a wordpress-plugin, pip, npm, or whatever software, thanklessly dealing with issues, PRs, support, maintainence, often for no pay, suddenly gets offered three figure sums to add a few lines of "affiliate stuff" or such. There are many places in the world, or people in situations where this amount of money really makes a compelling case.

irdc 3y ago
“Given enough underfunded maintainers, all security is shallow.”[0] 0. https://en.wikipedia.org/wiki/Linus%27s_law https://en.wikipedia.org/wiki/Linus%27s_law
- lenerdenator 3y ago
  I wouldn't say "funding" is necessarily the problem. Most maintainers do it because they like doing it. Their main limiting factor is time. I can drop a million dollars an hour into a maintainer's lap; that doesn't mean they can dedicate every waking moment to a project. They still have human needs that money can't buy like sleep, family obligations, and health concerns. And that's making the assumption that the maintainer uses that million/hr to quit their job. No, the problem is a lack of trustworthy candidates for maintainership and a lack of time. There are components of a GNU userland that are now too complex for a single human to both maintain and enhance at the same time. We now need to target multiple distros (really, more than are necessary, strictly speaking) and ISAs. Most are written in systems programming languages like C that are more complex than the average software engineer in 2024 works with. We need consolidation, simplification, maintainer redundancy, and a trust/governance framework for packages.
  - mikrotikker 3y ago
    We need to utilise a specialised AI to scan through the code looking for bugs and security holes. Imagine if openai donated server time to this.
moritonal 3y ago
It's why I actually always encourage app devs to charge for their apps, even open source ones. It creates an exchange of value for the author to feel valued and detract from these vectors.
- deleted 3y ago
  [deleted]
- deleted 3y ago
  [deleted]
kijin 3y ago
This is what worries me more. It's easy to point a finger at a specific Bad Guy® and shout "He did it!" It's much harder to face the reality that any maintainer of any open-source project can slowly burn out to a point where they become accomplices in an attack, or at least turn a blind eye. The pool of open-source developers does not split cleanly into honest contributors and evil agents. The boundary is quite fluid -- more so in some circles than in others -- and there are always temptations to move from one side to the other and back again.
david_allison 3y ago
> suddenly gets offered three figure sums to add a few lines of "affiliate stuff" or such Back of the envelope calculation: you're looking at 2 orders of magnitude more money from "affiliate stuff" than you would be from generous user donations
- berkes 3y ago
  Well, yes. But it's also something you can do once. When (not if) it comes out, all credibility is lost. Whereas donations, regardless of how puny, are recurring and potentially forever.
strogonoff 3y ago
I believe the problem of thankless maintenance is best solved with two things: the thanks (yes, we are all human and want recognition and appreciation from fellow humans)[0], and a stable employment (work for a good large business while open-sourcing what’s possible)[1]. If you do OSS for profit, then it can become a question of where is more money; but if you work a reliable job with insurance, relationships and other implications then the stakes may be a bit different. Many of the biggest OSS projects today were started by people who had no money in mind whatsoever. Some had other jobs, others were students, etc. If we feel relatively secure, we are driven by our innate desire to tinker, create cool things and show it off. [0] Undermined by LLMs that are used to gobble up your code and suggest it to others commercially and without attribution. [1] Undermined by low employment protections (if you can expect to be fired at any time, you would be less loyal), and by LLMs (whatever you open-source now more directly benefits Microsoft or whatever).
- david_allison 3y ago
  3. More maintainers Days of 100+ notifications aren't easy. Things will slip through
  - strogonoff 3y ago
    Agreed, but especially in light of recent events it’d be important to know who they are, and that’s not always easy.
- aleph_minus_one 3y ago
  > and a stable employment (work for a good large business while open-sourcing what’s possible) Even if it was hypothetically possible to open-source basically everything that the team in which I work produces: The software that I work on is very specialized software that is used by the company's employees and customers for specialized purposes. Imagine some nice LoB application that is actually somewhat comfortable to use. It basically does "what the users need" and is thus deeply ingrained in some parts of the company's workflows. The only use someone outside the industry might have for it is "cosplaying being employed in this industry". A lot of software that is developed (in particular in companies that don't sell or rent software) is of this kind. Thus: the open-source scene does in my opinion not have any use for a huge amount of software that is actually developed and actively used.
acdha 3y ago
> There are many places in the world, or people in situations where this amount of money really makes a compelling case. It’s especially easy to imagine that using the classic intelligence agency playbook: monitor high-impact maintainers and look for leverage before making the approach (“hey, saw your post about the divorce settlement and that $%#@ cleaning you out. My affiliate marketing pays in bitcoin…”) just as they’ve done for ages.
xign 3y ago
That's definitely true. And a lot of times it could be a random open source project that is under the radar and rarely thought about. E.g. The Great Suspender Chrome extension which was sold to an unknown buyer which later turned it to malware: https://www.bleepingcomputer.com/news/security/the-great-suspender-chrome-extensions-fall-from-grace/ https://www.bleepingcomputer.com/news/security/the-great-sus...

by berkes 3y ago

irdc 3y ago

“Given enough underfunded maintainers, all security is shallow.”[0] 0. https://en.wikipedia.org/wiki/Linus%27s_law https://en.wikipedia.org/wiki/Linus%27s_law

lenerdenator 3y ago
I wouldn't say "funding" is necessarily the problem. Most maintainers do it because they like doing it. Their main limiting factor is time. I can drop a million dollars an hour into a maintainer's lap; that doesn't mean they can dedicate every waking moment to a project. They still have human needs that money can't buy like sleep, family obligations, and health concerns. And that's making the assumption that the maintainer uses that million/hr to quit their job. No, the problem is a lack of trustworthy candidates for maintainership and a lack of time. There are components of a GNU userland that are now too complex for a single human to both maintain and enhance at the same time. We now need to target multiple distros (really, more than are necessary, strictly speaking) and ISAs. Most are written in systems programming languages like C that are more complex than the average software engineer in 2024 works with. We need consolidation, simplification, maintainer redundancy, and a trust/governance framework for packages.
- mikrotikker 3y ago
  We need to utilise a specialised AI to scan through the code looking for bugs and security holes. Imagine if openai donated server time to this.

moritonal 3y ago

It's why I actually always encourage app devs to charge for their apps, even open source ones. It creates an exchange of value for the author to feel valued and detract from these vectors.

deleted 3y ago
[deleted]
deleted 3y ago
[deleted]

kijin 3y ago

This is what worries me more. It's easy to point a finger at a specific Bad Guy® and shout "He did it!" It's much harder to face the reality that any maintainer of any open-source project can slowly burn out to a point where they become accomplices in an attack, or at least turn a blind eye. The pool of open-source developers does not split cleanly into honest contributors and evil agents. The boundary is quite fluid -- more so in some circles than in others -- and there are always temptations to move from one side to the other and back again.

david_allison 3y ago

> suddenly gets offered three figure sums to add a few lines of "affiliate stuff" or such Back of the envelope calculation: you're looking at 2 orders of magnitude more money from "affiliate stuff" than you would be from generous user donations

berkes 3y ago
Well, yes. But it's also something you can do once. When (not if) it comes out, all credibility is lost. Whereas donations, regardless of how puny, are recurring and potentially forever.

strogonoff 3y ago

I believe the problem of thankless maintenance is best solved with two things: the thanks (yes, we are all human and want recognition and appreciation from fellow humans)[0], and a stable employment (work for a good large business while open-sourcing what’s possible)[1]. If you do OSS for profit, then it can become a question of where is more money; but if you work a reliable job with insurance, relationships and other implications then the stakes may be a bit different. Many of the biggest OSS projects today were started by people who had no money in mind whatsoever. Some had other jobs, others were students, etc. If we feel relatively secure, we are driven by our innate desire to tinker, create cool things and show it off. [0] Undermined by LLMs that are used to gobble up your code and suggest it to others commercially and without attribution. [1] Undermined by low employment protections (if you can expect to be fired at any time, you would be less loyal), and by LLMs (whatever you open-source now more directly benefits Microsoft or whatever).

david_allison 3y ago
3. More maintainers Days of 100+ notifications aren't easy. Things will slip through
- strogonoff 3y ago
  Agreed, but especially in light of recent events it’d be important to know who they are, and that’s not always easy.
aleph_minus_one 3y ago
> and a stable employment (work for a good large business while open-sourcing what’s possible) Even if it was hypothetically possible to open-source basically everything that the team in which I work produces: The software that I work on is very specialized software that is used by the company's employees and customers for specialized purposes. Imagine some nice LoB application that is actually somewhat comfortable to use. It basically does "what the users need" and is thus deeply ingrained in some parts of the company's workflows. The only use someone outside the industry might have for it is "cosplaying being employed in this industry". A lot of software that is developed (in particular in companies that don't sell or rent software) is of this kind. Thus: the open-source scene does in my opinion not have any use for a huge amount of software that is actually developed and actively used.

acdha 3y ago

> There are many places in the world, or people in situations where this amount of money really makes a compelling case. It’s especially easy to imagine that using the classic intelligence agency playbook: monitor high-impact maintainers and look for leverage before making the approach (“hey, saw your post about the divorce settlement and that $%#@ cleaning you out. My affiliate marketing pays in bitcoin…”) just as they’ve done for ages.

xign 3y ago

That's definitely true. And a lot of times it could be a random open source project that is under the radar and rarely thought about. E.g. The Great Suspender Chrome extension which was sold to an unknown buyer which later turned it to malware: https://www.bleepingcomputer.com/news/security/the-great-suspender-chrome-extensions-fall-from-grace/ https://www.bleepingcomputer.com/news/security/the-great-sus...