7 ms·

"If this one guy got hit by a bus, the software would fall apart."

26 points by rgrieselhuber 3y ago

pavel_lishin 3y ago
> SQLite is maintained by... 3 guys. ... And they don't accept public patches or fixes. > "SQLite is open-source, meaning that you can make as many copies of it as you want and do whatever you want with those copies, without limitation. But SQLite is not open-contribution." This doesn't feel like a great example; it seems like if those 3 guys got hit by 3 buses, the source being available means that someone could fork it. (Assuming the license allows it.) At worst, folks could compile it for their own use.
- rgrieselhuber 3y ago
  Agreed. The TZ example is a lot stronger. That said, the overall point -- that the stance of these mega corps that rely on these projects do very little to ensure their longevity -- is well made.
  - benfortuna 3y ago
    If you follow the tz mailing list you will see their are many willing volunteers that would step up if needed. So I don't think even this is a good example..
- readthenotes1 3y ago
  I once gave the "cross train so you don't have a bus number of one" speech to a bunch of managers. Got some push back from one middle manager who said the complex driving their business line was understood by someone had been there by 20 years and was getting rebuilt in a year or two and there's no point in wasting anyone's time meanwhile. I saw them a few months later where I got a free lunch as an apology. The only man who understood the complex code died of a heart attack while trying to prepare the next release. No one had a clue where to start making the required changes. And you know what? That's not my only story of someone dying and no one being able to figure out the code that only they understood.
MichaelMug 3y ago
SQLite is a key technology in Apple’s CoreData. I would think there are experts on Apple payroll that could pick up the slack?
readyplayernull 3y ago
Well just think what HN's whole community, the support portal of the Internet, would be without Dang.
- kaycey2022 3y ago
  I will finally be able to speak my mind to you people with no consequence
  - bestouff 3y ago
    Would that be good though ? I prefer a place where people think twice instead of "speaking their mind" on an impulse.
  - Brian_K_White 3y ago
    You already have twitter for that. I'm not on twitter but not my problem.
deleted 3y ago
[deleted]
magicalhippo 3y ago
A detailed analysis of what would happen if Linus Torvalds got hit by a bus was conducted[1] as far back as in 2000. Unsurprisingly the result showed this would most likely have had a devastating impact on the development of Linux. [1]: https://www.crummy.com/writing/segfault.org/Bus.html https://www.crummy.com/writing/segfault.org/Bus.html
neglesaks 3y ago
Tell the major projects' core developers to wear michelin suits in public from now on.
natmaka 3y ago
The proverbial "bus factor": https://en.wikipedia.org/wiki/Bus_factor https://en.wikipedia.org/wiki/Bus_factor
jitl 3y ago
sqlite already had an active community fork started by Turso called libsql. They are fixing longstanding API gaps the upstream team isn’t interested in supporting. For example, they added a native write-ahead log API, so you can plug directly into the WAL for streaming replication. This is possible-ish with upstream sqlite + LiteFs but litefs has to implement a whole FUSE file system and can’t run on Mac for that reason. It’s more risky to run libsql because new features mean new bugs, but it seems worth it to me. Libsql: https://github.com/tursodatabase/libsql https://github.com/tursodatabase/libsql
hazbot 3y ago
But it's also the beauty that a few people can create so much value. And how many of these projects couldn't be picked up and urgently patched if the proverbial bus does come along? Like it wouldn't be pretty, but would it be possible?
rini17 3y ago
They really assume entangling hobbyists into corporate/academic politics/bureaucracy would improve anything? Because these inevitably follow the money. Be careful of what you wish for. Or how else should I read the conclusion?
ozfive 3y ago
> What happens when that person gets bored with the project... or decides to do something malicious (as in the case with a recent backdoor in the XZ compression tool)... The maintainer of the xz compression tool didn't do anything malicious. This statement is incorrect and damaging.
kaycey2022 3y ago
Dumb luck only lasts for so long? Who says it has lasted? What is not to say that there are dozens of backdoors hiding in popularly used software?
bigprof 3y ago
A solo maintainer getting hit by a bus can be mitigated by forking the repo by other interested contributors. A more malicious scenario raised by OP is a solo maintainer with little to no funding getting enticed by a nation state actor to add a backdoor, a supply chain attack proven to be very feasible by the recent XZ library incidence.

26 points by rgrieselhuber 3y ago

> SQLite is maintained by... 3 guys. ... And they don't accept public patches or fixes. > "SQLite is open-source, meaning that you can make as many copies of it as you want and do whatever you want with those copies, without limitation. But SQLite is not open-contribution." This doesn't feel like a great example; it seems like if those 3 guys got hit by 3 buses, the source being available means that someone could fork it. (Assuming the license allows it.) At worst, folks could compile it for their own use.

rgrieselhuber 3y ago
Agreed. The TZ example is a lot stronger. That said, the overall point -- that the stance of these mega corps that rely on these projects do very little to ensure their longevity -- is well made.
- benfortuna 3y ago
  If you follow the tz mailing list you will see their are many willing volunteers that would step up if needed. So I don't think even this is a good example..
readthenotes1 3y ago
I once gave the "cross train so you don't have a bus number of one" speech to a bunch of managers. Got some push back from one middle manager who said the complex driving their business line was understood by someone had been there by 20 years and was getting rebuilt in a year or two and there's no point in wasting anyone's time meanwhile. I saw them a few months later where I got a free lunch as an apology. The only man who understood the complex code died of a heart attack while trying to prepare the next release. No one had a clue where to start making the required changes. And you know what? That's not my only story of someone dying and no one being able to figure out the code that only they understood.

MichaelMug 3y ago

SQLite is a key technology in Apple’s CoreData. I would think there are experts on Apple payroll that could pick up the slack?

readyplayernull 3y ago

Well just think what HN's whole community, the support portal of the Internet, would be without Dang.

kaycey2022 3y ago
I will finally be able to speak my mind to you people with no consequence
- bestouff 3y ago
  Would that be good though ? I prefer a place where people think twice instead of "speaking their mind" on an impulse.
- Brian_K_White 3y ago
  You already have twitter for that. I'm not on twitter but not my problem.

deleted 3y ago

[deleted]

magicalhippo 3y ago

A detailed analysis of what would happen if Linus Torvalds got hit by a bus was conducted[1] as far back as in 2000. Unsurprisingly the result showed this would most likely have had a devastating impact on the development of Linux. [1]: https://www.crummy.com/writing/segfault.org/Bus.html https://www.crummy.com/writing/segfault.org/Bus.html

neglesaks 3y ago

Tell the major projects' core developers to wear michelin suits in public from now on.

natmaka 3y ago

The proverbial "bus factor": https://en.wikipedia.org/wiki/Bus_factor https://en.wikipedia.org/wiki/Bus_factor

jitl 3y ago

sqlite already had an active community fork started by Turso called libsql. They are fixing longstanding API gaps the upstream team isn’t interested in supporting. For example, they added a native write-ahead log API, so you can plug directly into the WAL for streaming replication. This is possible-ish with upstream sqlite + LiteFs but litefs has to implement a whole FUSE file system and can’t run on Mac for that reason. It’s more risky to run libsql because new features mean new bugs, but it seems worth it to me. Libsql: https://github.com/tursodatabase/libsql https://github.com/tursodatabase/libsql

hazbot 3y ago

But it's also the beauty that a few people can create so much value. And how many of these projects couldn't be picked up and urgently patched if the proverbial bus does come along? Like it wouldn't be pretty, but would it be possible?

rini17 3y ago

They really assume entangling hobbyists into corporate/academic politics/bureaucracy would improve anything? Because these inevitably follow the money. Be careful of what you wish for. Or how else should I read the conclusion?

ozfive 3y ago

> What happens when that person gets bored with the project... or decides to do something malicious (as in the case with a recent backdoor in the XZ compression tool)... The maintainer of the xz compression tool didn't do anything malicious. This statement is incorrect and damaging.

kaycey2022 3y ago

Dumb luck only lasts for so long? Who says it has lasted? What is not to say that there are dozens of backdoors hiding in popularly used software?

bigprof 3y ago

A solo maintainer getting hit by a bus can be mitigated by forking the repo by other interested contributors. A more malicious scenario raised by OP is a solo maintainer with little to no funding getting enticed by a nation state actor to add a backdoor, a supply chain attack proven to be very feasible by the recent XZ library incidence.