5 ms·

I'm not sure why people keep misidentifying the problem as "lack of funding". Lasse Collin was doing fine as a maintainer up until Jia Tan showed up. He was psy

by chjj 3y ago

I'm not sure why people keep misidentifying the problem as "lack of funding". Lasse Collin was doing fine as a maintainer up until Jia Tan showed up. He was psy-op'd into believing there was a crowd of angry people eagerly awaiting a new release when there wasn't. No real person was unhappy with the way he'd been maintaining xz.

Cthulhu_ 3y ago
Funding aside, single individuals being responsible for software is not a good thing, see bus factor.
- rebolek 3y ago
  Fortunately there was Jia Tan to help him. /s
- Gormo 3y ago
  In fact, there was no issue with Lasse Collin maintaining xz as a single individual, and creating a false impression to the contrary was the primary tactic used by the antagonist to gain access to the project.
transportgo 3y ago
But if he was paid he might not have given up control
- udev4096 3y ago
  He never mentioned about any financial problems, it was more about his mental health
  - mwcampbell 3y ago
    And would mental health issues have kept him from working on xz if that had been part of his day job?
    - yunohn 3y ago
      I’ve been in similar burnout situations, and the difference between work and side projects did not matter to my mental health. The money was not an issue, it was headspace and fatigue.
- chjj 3y ago
  Okay, sure, but rather than trying to solve a problem by throwing money at it (or worse, trying to solve it with government intervention), maybe it's better to think of other mitigations. For example, maybe developers need to be made aware of potential psyops by attackers (the publicity surrounding this issue probably made some progress on that front).
diggan 3y ago
I'm not saying money would absolutely fix the issue, but I could also see it helping. If Collin was approached by a government that said "Hey, the thing you're maintaining is important, if you want, we'll fund 2 additional full-time maintainers that can contribute based on your guidance", maybe Collin would be in a better position to ensure the Jia Tan contributions were genuine and proper.
- chjj 3y ago
  There's probably a number of things that could improve the situation. Mindlessly throwing money and government at a problem almost never improves things. Which government bureaucracy decides how much Lasse Collin should be paid? Based on what metrics? This is a giant can of worms.
- rebolek 3y ago
  If I was the maintainer and was approached by government telling me, "hey, here are two folks who're going to be two new full-time maintainers and we're funding them" I certainly would be worried.
  - diggan 3y ago
    Similarly, if the government approached me and said "Here, embed this black-box binary into your build process", I'd be worried too. But luckily, no one suggested this, nor what you wrote about :)
irdc 3y ago
Getting help for mental health issues is a whole lot easier if you have the money.
- lenerdenator 3y ago
  IIRC the xz package was maintained by an individual in a place with at least some socialized healthcare, but correct me if I'm wrong (I'm not trying to be snarky here, please do).
- dboreham 3y ago
  Perhaps socialized medicine is the solution.
  - Gormo 3y ago
    Socialized or politicized?

by chjj 3y ago

Cthulhu_ 3y ago

Funding aside, single individuals being responsible for software is not a good thing, see bus factor.

rebolek 3y ago
Fortunately there was Jia Tan to help him. /s
Gormo 3y ago
In fact, there was no issue with Lasse Collin maintaining xz as a single individual, and creating a false impression to the contrary was the primary tactic used by the antagonist to gain access to the project.

transportgo 3y ago

But if he was paid he might not have given up control

udev4096 3y ago
He never mentioned about any financial problems, it was more about his mental health
- mwcampbell 3y ago
  And would mental health issues have kept him from working on xz if that had been part of his day job?
  - yunohn 3y ago
    I’ve been in similar burnout situations, and the difference between work and side projects did not matter to my mental health. The money was not an issue, it was headspace and fatigue.
chjj 3y ago
Okay, sure, but rather than trying to solve a problem by throwing money at it (or worse, trying to solve it with government intervention), maybe it's better to think of other mitigations. For example, maybe developers need to be made aware of potential psyops by attackers (the publicity surrounding this issue probably made some progress on that front).

diggan 3y ago

I'm not saying money would absolutely fix the issue, but I could also see it helping. If Collin was approached by a government that said "Hey, the thing you're maintaining is important, if you want, we'll fund 2 additional full-time maintainers that can contribute based on your guidance", maybe Collin would be in a better position to ensure the Jia Tan contributions were genuine and proper.

chjj 3y ago
There's probably a number of things that could improve the situation. Mindlessly throwing money and government at a problem almost never improves things. Which government bureaucracy decides how much Lasse Collin should be paid? Based on what metrics? This is a giant can of worms.
rebolek 3y ago
If I was the maintainer and was approached by government telling me, "hey, here are two folks who're going to be two new full-time maintainers and we're funding them" I certainly would be worried.
- diggan 3y ago
  Similarly, if the government approached me and said "Here, embed this black-box binary into your build process", I'd be worried too. But luckily, no one suggested this, nor what you wrote about :)

irdc 3y ago

Getting help for mental health issues is a whole lot easier if you have the money.

lenerdenator 3y ago
IIRC the xz package was maintained by an individual in a place with at least some socialized healthcare, but correct me if I'm wrong (I'm not trying to be snarky here, please do).
dboreham 3y ago
Perhaps socialized medicine is the solution.
- Gormo 3y ago
  Socialized or politicized?