5 ms·

We've been adding features for 30+ years to open source software, they become so complex only very few people understand them anymore. Recently I looked into jf

by dvh 2y ago

We've been adding features for 30+ years to open source software, they become so complex only very few people understand them anymore. Recently I looked into jfet level 2 implementation in ngspice, expecting familiar equations, but through series of small changes and maybe some DRY too, the code is almost unrecognizable. When graybeards finally retire, there will be lots of shrugs.

zer00eyz 2y ago
Your average American could quit working for 5 million dollars. They could live comfortably for the rest of their lives off that money, if well invested (read EFT for sp500) 5 million bucks is change for you average government. "Amazon made billions on my project and if I turn a blind eye to this I can retire, fuck them..." Sponsorship, for good or bad makes a lot of decisions simple.
- imachine1980_ 2y ago
  [flagged]
  - SgtBastard 2y ago
    Friend, I read the comment that you’re replying to that if hostile governments wanted to backdoor our software supply-chains, it wouldn’t cost that much to corrupt an open source maintainer. Whereas, if it was the norm for well used OS projects to be sponsored, it’s far less likely to be tempted by relatively small bribes.
- NonDairyMatt 2y ago
  Probably wouldn't even need 5 Million. According the the PBS article about the 2 US Navy sailors arrested for spying around august of last year one of them was apparently only bribed $10k-15K for the year [1]. I was pretty shocked at first but it made sense that with the financial stress many face in today's market a 10K bribe would go along way and have a high return on investment especially if the potential payoff for a backdoor or zero-day is in the millions [2] [1] https://www.pbs.org/newshour/politics/2-u-s-navy-sailors-arrested-on-charges-tied-to-national-security-and-china https://www.pbs.org/newshour/politics/2-u-s-navy-sailors-arr... [2] https://en.wikipedia.org/wiki/Market_for_zero-day_exploits https://en.wikipedia.org/wiki/Market_for_zero-day_exploits
  - BobbyTables2 2y ago
    Even politicians are cheap these days. It astonishes me that for less than the price of a nice car, what people seem to be able to do.
    - eesmith 2y ago
      After Abscam in the late 1970s/early 1980s, one of the quote going expressed surprise not that politicians could be bought, but that they were so cheap. I cannot find that quote now.
  - shiroiushi 2y ago
    >2 US Navy sailors arrested for spying around august of last year one of them was apparently only bribed $10k-15K for the year This is exactly why investigations for security clearances focus mostly on a person's financial situation: someone who has a lot of debt and shows a pattern of poor financial management, i.e. someone who'd jump at a chance to make an extra measly $10k, is the kind of person they want to avoid giving a high security clearance to, because of incidents exactly like this. It's a common misconception that clearance holders who sell secrets make a lot of money doing so, and this just isn't the case: it's comparatively small amounts like this. For someone who's deep in debt and desperate, it doesn't take much to buy them.
- kbenson 2y ago
  Money isn't the motivator I worry about. Money requires people to make rational decisions about what they think they can get away with. Threatening someone's family? Who wouldn't be willing to turn their access to a project into a hack that has some possible theoretical future harm to protect their child? Sure, the circumstances to being able to leverage someone like this are rare, but the population which is susceptible is much larger than those willing to do somethibg similar for just money.
armini 2y ago
I've been working on thanks.dev for over two years now & reading this report is disappointing to say the least. Why not spend the time to explain the value XZ Utils created for all the commercial users & what companies can do to better supporting maintainers with hundreds of issues experiencing burnout from their unpaid work? OpenSSF should instead promote FOSS programs like https://frontendmasters.com/blog/how-were-supporting-open-source-maintainers/ https://frontendmasters.com/blog/how-were-supporting-open-so... & how they help their open source community stay active. Working in open source is a social contract & corporates need to be better citizens if they want to reduce their risk profile.
- bruce511 2y ago
  On first reading your comment makes a lot of sense, and is certainly logical for maximizing the common good. But unfortunately, companies simply don't work the way you are proposing. The short reason is this "good citizenship is indistinguishable from corruption. Therefore good company governance leans away from both." The somewhat longer answer is that while a "company" might have a lot of money, or might make a lot of money leveraging some common good, it is not (usually) one person's money. The bigger the company the harder it gets to actually -spend- the money. There are procurement departments, various sign-offs and so on. First and foremost it helps if there is a tangible (defendable) reason to spend the money. Yes, companies "give" money away. Usually under the guise of marketing. It's easy to donate money to the local cancer center. It's harder to explain the marketing value of supporting random open source projects. For tech companies it's -somewhat- easier, but even then it's simpler to donate time rather than money. I've said it a lot lately, but OSS development has to "commercialize" if it wants to be commercial. That means first understanding "what companies pay for" and designing products to fit that. Or target individuals with excess cash of their own that they're willing to just "pass along".
  - int_19h 2y ago
    "What companies pay for" is anything they cannot get for free. If the value of an OSS project is mostly in its code, then any license that allows it to be used commercially will mean lots of free-riding.

by dvh 2y ago

zer00eyz 2y ago

Your average American could quit working for 5 million dollars. They could live comfortably for the rest of their lives off that money, if well invested (read EFT for sp500) 5 million bucks is change for you average government. "Amazon made billions on my project and if I turn a blind eye to this I can retire, fuck them..." Sponsorship, for good or bad makes a lot of decisions simple.

imachine1980_ 2y ago
[flagged]
- SgtBastard 2y ago
  Friend, I read the comment that you’re replying to that if hostile governments wanted to backdoor our software supply-chains, it wouldn’t cost that much to corrupt an open source maintainer. Whereas, if it was the norm for well used OS projects to be sponsored, it’s far less likely to be tempted by relatively small bribes.
NonDairyMatt 2y ago
Probably wouldn't even need 5 Million. According the the PBS article about the 2 US Navy sailors arrested for spying around august of last year one of them was apparently only bribed $10k-15K for the year [1]. I was pretty shocked at first but it made sense that with the financial stress many face in today's market a 10K bribe would go along way and have a high return on investment especially if the potential payoff for a backdoor or zero-day is in the millions [2] [1] https://www.pbs.org/newshour/politics/2-u-s-navy-sailors-arrested-on-charges-tied-to-national-security-and-china https://www.pbs.org/newshour/politics/2-u-s-navy-sailors-arr... [2] https://en.wikipedia.org/wiki/Market_for_zero-day_exploits https://en.wikipedia.org/wiki/Market_for_zero-day_exploits
- BobbyTables2 2y ago
  Even politicians are cheap these days. It astonishes me that for less than the price of a nice car, what people seem to be able to do.
  - eesmith 2y ago
    After Abscam in the late 1970s/early 1980s, one of the quote going expressed surprise not that politicians could be bought, but that they were so cheap. I cannot find that quote now.
- shiroiushi 2y ago
  >2 US Navy sailors arrested for spying around august of last year one of them was apparently only bribed $10k-15K for the year This is exactly why investigations for security clearances focus mostly on a person's financial situation: someone who has a lot of debt and shows a pattern of poor financial management, i.e. someone who'd jump at a chance to make an extra measly $10k, is the kind of person they want to avoid giving a high security clearance to, because of incidents exactly like this. It's a common misconception that clearance holders who sell secrets make a lot of money doing so, and this just isn't the case: it's comparatively small amounts like this. For someone who's deep in debt and desperate, it doesn't take much to buy them.
kbenson 2y ago
Money isn't the motivator I worry about. Money requires people to make rational decisions about what they think they can get away with. Threatening someone's family? Who wouldn't be willing to turn their access to a project into a hack that has some possible theoretical future harm to protect their child? Sure, the circumstances to being able to leverage someone like this are rare, but the population which is susceptible is much larger than those willing to do somethibg similar for just money.

armini 2y ago

I've been working on thanks.dev for over two years now & reading this report is disappointing to say the least. Why not spend the time to explain the value XZ Utils created for all the commercial users & what companies can do to better supporting maintainers with hundreds of issues experiencing burnout from their unpaid work? OpenSSF should instead promote FOSS programs like https://frontendmasters.com/blog/how-were-supporting-open-source-maintainers/ https://frontendmasters.com/blog/how-were-supporting-open-so... & how they help their open source community stay active. Working in open source is a social contract & corporates need to be better citizens if they want to reduce their risk profile.

bruce511 2y ago
On first reading your comment makes a lot of sense, and is certainly logical for maximizing the common good. But unfortunately, companies simply don't work the way you are proposing. The short reason is this "good citizenship is indistinguishable from corruption. Therefore good company governance leans away from both." The somewhat longer answer is that while a "company" might have a lot of money, or might make a lot of money leveraging some common good, it is not (usually) one person's money. The bigger the company the harder it gets to actually -spend- the money. There are procurement departments, various sign-offs and so on. First and foremost it helps if there is a tangible (defendable) reason to spend the money. Yes, companies "give" money away. Usually under the guise of marketing. It's easy to donate money to the local cancer center. It's harder to explain the marketing value of supporting random open source projects. For tech companies it's -somewhat- easier, but even then it's simpler to donate time rather than money. I've said it a lot lately, but OSS development has to "commercialize" if it wants to be commercial. That means first understanding "what companies pay for" and designing products to fit that. Or target individuals with excess cash of their own that they're willing to just "pass along".
- int_19h 2y ago
  "What companies pay for" is anything they cannot get for free. If the value of an OSS project is mostly in its code, then any license that allows it to be used commercially will mean lots of free-riding.