6 ms·

Free software hijacked Philip Hazel's life

323 points by fanf2 2y ago

lisper 2y ago
Someone should write an article like this about Edit Weitz. https://github.com/edicl https://github.com/edicl
throwaway89201 2y ago
> Now, he is ready to hand off PCRE2 as well, if a successor can be found. My dear friend Jia Tan – although I hear they go by a different name now – might be interested in taking over maintenance of PCRE.
- bee_rider 2y ago
  > I asked Hazel, given the recent XZ backdoor attempt, how he intended to vet any prospective PCRE2 maintainers. He replied that it was a good question "to which I have no answer. I will have to see who (if anyone) makes an offer". He’s clearly aware of the problem, so there’s that at least. It is a tricky one.
- mistrial9 2y ago
  so this "clever" drive-by comment is the extent of dealing with the actual systemic situation.. while every person reading this is benefiting from the software, and some not reading this are trading stocks on surveillance software. "go buy some stock" is the next useful comment on this? FU basically?
arp242 2y ago
Connecting qualified would-be maintainers with projects looking for a maintainer is a tricky problem. Who here even knew PCRE2 was looking for a new maintainer? I took over some fairly widely used Go projects, but only after they were archived. I had no idea they were looking for someone to maintain it. There's a bit of a catch-22 here: - If a project is already well-maintained then no one really needs to contribute anything. - If a project is poorly maintained due to lack of interest or time, then this will also discourage contributions – the first think I check before contributing is whether previous PRs are actually getting merged. For larger projects where there's always something to do, like Exim, this usually isn't a big issue. But for smaller more narrowly scoped projects like PCRE2 this is more of an issue. I'm not surprised he's having a harder time with PCRE2.
- fanf2 2y ago
  There’s a PCRE2 issue that Philip created last week, and which I submitted here, but it didn’t get much traction. https://news.ycombinator.com/item?id=40657607 https://news.ycombinator.com/item?id=40657607 This LWN article is helping to spread the word. (I worked with Philip before he retired.)
  - arp242 2y ago
    Yeah, that's exactly the kind of stuff very few people are going to see. Even this HN post here is seen by relatively few people. Also, about 90% of the people respond will fall through. I'm sure people say "yes" with the best of intentions, but saying "yes" in a wave of enthusiasm is easy, and then spending a lot of hours on it ... not so much. My favourite example is someone who said "yes, I'll help maintain", was added to the GitHub repo, made a new issue with a long plan on how to deal with the many open issues, and ... was never seen again. Never actually dealt with any of the open issues. I'm sure this was done with the best of intentions (and their profile said they're a student, so I don't want to judge harshly), but this was a rather marked example that made me laugh.
- apitman 2y ago
  I worry about new maintainers who feel the need to leave some sort of a mark on projects by adding unnecessary features and dependencies. I get it, true maintenance of a stable project, where you only fix bugs and security issues, is not glamorous. It's a tired meme but we really do need some concept of "finished" in our field, along with the necessary incentive structures to enable people to do the needed maintenance on finished software in perpetuity.
  - dingnuts 2y ago
    isn't the whole point of intellectual property law to align incentives? it's no coincidence that corporations that own proprietary code don't have this problem. has anybody considered that maybe Richard Stallman was wrong? maybe it ISN'T a good idea to volunteer your time to write libraries that corporations will use to make billions, while begging for donations. maybe, sometimes, libre licensing is a mistake specifically because it leaves maintainers with no reasonable avenue for compensation
deleted 2y ago
[deleted]
dehrmann 2y ago
This is an interesting problem open source might start facing. There are a lot (I assume) of mature, critical libraries with a single owner. These libraries started their life around 30 years ago, and the maintainers are ready to move on. Taking on maintenance isn't very exciting since all the fun work's been done, but the open source world needs it.
- acdha 2y ago
  That’s what I was thinking, too. There are some fun aspects but there’s also a lot of stress: if you fix a bug, what are the odds that someone added a dependency on that behavior in one of the thousands of dependencies which accumulated over the decades? Yes, tests are great but I’d still bet that your inbox would get more grumping than thanks until we can unbreak open source culture.
  - tresclow 2y ago
    https://xkcd.com/1172/ https://xkcd.com/1172/ Are we sure this whole discussion can't be reduced to just links to xkcd strips?
    - dehrmann 2y ago
      Picard and Dathon… at El-Adrel
  - kelnos 2y ago
    > unbreak open source culture. This aspect isn't really specific to open source culture, it's human nature. People want free stuff. People feel entitled to free stuff. People feel entitled to the uncompensated labor of others.
    - acdha 2y ago
      No, but the part where people don’t make a distinction between how they view paid support contracts and open source is. “Uncompensated labor of others” covers everything from sneaking into a concert to reading an entire book at the bookstore to pirating a movie/game to buying an academic license for something you use at work to harassing an open source maintainer into adding a change you want. Since I only wanted to talk about the last one, I used wording specific to that.
rurban 2y ago
Zoltan Herczeg, the jit maintainer is capable enough, and he is doing most of the work anyway.
- jonstewart 2y ago
  Zoltan’s work on the jit is incredible. PCRE went from “venerable old warhorse” to “making a case that backtracking can still be fast” when the jit landed.
  - lproven 2y ago
    If I may interject for a moment, the software you are calling "jit" is actually pronounced Git…
moomin 2y ago
My instant reaction to this was “Wait, is that PH10?”. Read the article, and of course it is. Even in the 90s he was a famous hacker around the Computer Lab. (The username, for those not familiar with Cambridge Lore, indicates he was the first PH to be given an ID using the scheme applicable in the mid-eighties. Someone will no doubt reply with a more precise timeline.)
- mnw21cam 2y ago
  I met him briefly when I was at Cambridge in the late 90s. I can't remember why I did, but I do remember that he was an absolute legend back then.
II2II 2y ago
> What particularly amazes me more than the CPU power is the amount of storage that I carry in my pocket. Even though the histories of computers seem to focus upon computational power, it seems as though the most challenging aspect in the development of computers is inexpensive memory. I was going to say fast and inexpensive memory, then I realized that we haven't really achieved that goal. A lot of early computers depended upon the notoriously difficult to manufacture core memory. Then there are things like drum memories, which sacrifice density in order to use stationary read/write heads. And even though these forms of memory share a lot in common with hard drives, they were actually used as the main memories on some computers. Earlier memories are even crazier, like mercury delay lines (complex, sequential access only, and a health hazard). Even later semiconductor memories endured a long period of explosive growth before reaching useful costs and densities. (Early minis and workstations often had large boards containing only memory. Early personal computers kept costs down by shipping with single-digit kilobytes of memory.)
- nextaccountic 2y ago
  I find annoying that to this day there's computers sold with only 8GB of RAM I wouldn't bother too much if software (and specially web pages) weren't getting bloated continuously It's like there's a great stagnation in the amount of memory increase after each generation, but the software devs didn't get the memo
  - zappb 2y ago
    Software dev machines continue to increase in memory. I’ve seen some using 96 GB in laptops!
    - nextaccountic 2y ago
      Ok that's a fair point. I've seen 128GB too but in desktop That's the ultimate "works on my machine"
brendadavis22 2y ago
[flagged]
musicale 2y ago
"Here at Craptech, we love open source. We love that people will spend decades of their lives working for our company, for free."
kemitchell 2y ago
I'd take this as a moment to celebrate a guy who's done a lot of great work without having his name bathed in limelight. Not a prompt to wring hands about succession or security bobbles in other people's projects. I don't think it's somehow also Philip's burden to find or vet or train a successor. The code is out there. His license terms are unobjectionable. If and when Philip stops work, let someone else who cares pick it up. Perhaps under new and different names. The links between the names Philip chose and Philip himself as the person behind the work will have been broken, anyway. Follow-on forks won't take away from Philip's legacy one bit. They might even help raise attention that new groups or individuals worthy of gratitude have stepped up.
RcouF1uZ4gsC 2y ago
> To date, he said he had received "no communications whatsoever" about taking over the project. Perhaps, once the word gets out more widely, a qualified maintainer will step forward to take PCRE2 into the future. I think more and more open source projects will be targeted by intelligence services. Open source maintainer is a stressful, thankless job which pays peanuts compared to what you could get for the skills and time. Driven, talented individual who feels they are sacrificing for the good of society and are not being properly appreciated is the stereotype for a person who can be turned.
- ghaff 2y ago
  >Open source maintainer is a stressful, thankless job which pays peanuts compared to what you could get for the skills and time. Well, it needs to be something of interest to a company that will pay someone to be a maintainer as part of their day job. Or it needs to be something that someone has built a business around--but, as you suggest, their job is now a lot more than just being a maintainer and, in many cases, they make a lot less than just taking a job at a company.
- bityard 2y ago
  I'll agree with thankless. But I'm confused about "pays peanuts," because unless you get hired by a company paying you to work on open source software, or have somehow cracked the code to acquiring extremely generous patrons (donations), I would say being an open source maintainer typically pays nothing at all. Which is fine for a lot of us who consider it a hobby and would never _want_ to be paid for it. I also have to believe that if it's a true open source project (meaning, without commercial aspirations), then any stress must be self-induced. FLOSS authors don't owe anyone features, bug fixes, or explanations. And any that are delivered are totally voluntary.
  - bee_rider 2y ago
    I totally agree with this but haven’t actually maintained any open source projects. Have you? For me at least, it is easy to say the, I’m quite sure, objectively correct thing. Open source hobby projects have no obligation to anybody, just release code for fun, and anybody who expects more is the problem and should be ignored. But there are lots of reports of burnout and stress. So I think there must be strong social pressure that people fall to, despite not having any legal or ethical obligations. I mean for most of time, all of pre-history, humans got by with informal social structures and a feeling of wanting to provide their friends continued help, despite a lack of a real state or legal framework, and mostly informal ethics. So it isn’t that surprising that people feel like they have a real obligation to users when they’ve been working on a project for a while, right? Helping others is a human instinct.
zexbha 2y ago
This was great to read. I had never heard of Philip Hazel until today. Although I appreciate the work that he's done in maintaining PCRE, I hope that I am never in the position where I am still working on a project at that age.
- JeremyNT 2y ago
  > I hope that I am never in the position where I am still working on a project at that age. "Hijacked" - used in the title here but not in any of the actual quotes - implies that Phillip is some sort of captive of his projects' success, but I'm not sure that's true. After all, he stepped away from Exim (an incredibly notable project) many years ago, so it's not as if he is incapable of walking away when the time is right. So, presumably, he has only worked so long on these projects because he finds meaning and/or enjoyment from doing so. I can only hope if/when I reach the age of 80 I'll have something meaningful like this I could contribute to!
  - jzb 2y ago
    I borrowed the title from a talk he did in 1999, but didn't find a way (mea culpa) to work that naturally into the story. I do believe that, yes, he has enjoyed the work and "hijack" is employed tongue-in-cheek.
  - jxramos 2y ago
    Yah I kept searching for a highjack connection thinking he got hit by malware or something like that. Never found it so I think you’re right.
- neilv 2y ago
  What would you be doing instead at 80, if not working on a project?
  - SapporoChris 2y ago
    Depends
throw0101c 2y ago
Not mention of the music software: > Hazel is also known for his typesetting software, in particular "Philip's Music Writer",[5][6] as well as programs to turn a simple markup into a subset of DocBook XML for use in the Exim manual, and to produce PostScript from this XML. * https://en.wikipedia.org/wiki/Philip_Hazel https://en.wikipedia.org/wiki/Philip_Hazel * https://en.wikipedia.org/wiki/Philip%27s_Music_Writer https://en.wikipedia.org/wiki/Philip%27s_Music_Writer
neilv 2y ago
I'm not sure this is correct, but I made a quick guess at which is the most representative Debian package for PCRE, and got this order of magnitude of direct and indirect dependencies for it: $ apt-cache --recurse rdepends libpcre2-8-0 | tr -d ' |' | sort | uniq | wc -l 52160
- adolph 2y ago
  Looks like another example for Explain XKCD: https://www.explainxkcd.com/wiki/index.php/2347:_Dependency https://www.explainxkcd.com/wiki/index.php/2347:_Dependency https://xkcd.com/2347/ https://xkcd.com/2347/
  - socksy 2y ago
    And thus a good candidate for funding from https://www.sovereigntechfund.de/ https://www.sovereigntechfund.de/ , should there be some trustworthy individual or group that could maintain it (I always felt like while this project is admirable, it should be regarded as a point of national security for nation states to maintain core infrastructure in-house)
gmuslera 2y ago
https://xkcd.com/2347/ https://xkcd.com/2347/

323 points by fanf2 2y ago

Someone should write an article like this about Edit Weitz. https://github.com/edicl https://github.com/edicl

> Now, he is ready to hand off PCRE2 as well, if a successor can be found. My dear friend Jia Tan – although I hear they go by a different name now – might be interested in taking over maintenance of PCRE.

bee_rider 2y ago
> I asked Hazel, given the recent XZ backdoor attempt, how he intended to vet any prospective PCRE2 maintainers. He replied that it was a good question "to which I have no answer. I will have to see who (if anyone) makes an offer". He’s clearly aware of the problem, so there’s that at least. It is a tricky one.
mistrial9 2y ago
so this "clever" drive-by comment is the extent of dealing with the actual systemic situation.. while every person reading this is benefiting from the software, and some not reading this are trading stocks on surveillance software. "go buy some stock" is the next useful comment on this? FU basically?

arp242 2y ago

Connecting qualified would-be maintainers with projects looking for a maintainer is a tricky problem. Who here even knew PCRE2 was looking for a new maintainer? I took over some fairly widely used Go projects, but only after they were archived. I had no idea they were looking for someone to maintain it. There's a bit of a catch-22 here: - If a project is already well-maintained then no one really needs to contribute anything. - If a project is poorly maintained due to lack of interest or time, then this will also discourage contributions – the first think I check before contributing is whether previous PRs are actually getting merged. For larger projects where there's always something to do, like Exim, this usually isn't a big issue. But for smaller more narrowly scoped projects like PCRE2 this is more of an issue. I'm not surprised he's having a harder time with PCRE2.

fanf2 2y ago
There’s a PCRE2 issue that Philip created last week, and which I submitted here, but it didn’t get much traction. https://news.ycombinator.com/item?id=40657607 https://news.ycombinator.com/item?id=40657607 This LWN article is helping to spread the word. (I worked with Philip before he retired.)
- arp242 2y ago
  Yeah, that's exactly the kind of stuff very few people are going to see. Even this HN post here is seen by relatively few people. Also, about 90% of the people respond will fall through. I'm sure people say "yes" with the best of intentions, but saying "yes" in a wave of enthusiasm is easy, and then spending a lot of hours on it ... not so much. My favourite example is someone who said "yes, I'll help maintain", was added to the GitHub repo, made a new issue with a long plan on how to deal with the many open issues, and ... was never seen again. Never actually dealt with any of the open issues. I'm sure this was done with the best of intentions (and their profile said they're a student, so I don't want to judge harshly), but this was a rather marked example that made me laugh.
apitman 2y ago
I worry about new maintainers who feel the need to leave some sort of a mark on projects by adding unnecessary features and dependencies. I get it, true maintenance of a stable project, where you only fix bugs and security issues, is not glamorous. It's a tired meme but we really do need some concept of "finished" in our field, along with the necessary incentive structures to enable people to do the needed maintenance on finished software in perpetuity.
- dingnuts 2y ago
  isn't the whole point of intellectual property law to align incentives? it's no coincidence that corporations that own proprietary code don't have this problem. has anybody considered that maybe Richard Stallman was wrong? maybe it ISN'T a good idea to volunteer your time to write libraries that corporations will use to make billions, while begging for donations. maybe, sometimes, libre licensing is a mistake specifically because it leaves maintainers with no reasonable avenue for compensation

deleted 2y ago

[deleted]

dehrmann 2y ago

This is an interesting problem open source might start facing. There are a lot (I assume) of mature, critical libraries with a single owner. These libraries started their life around 30 years ago, and the maintainers are ready to move on. Taking on maintenance isn't very exciting since all the fun work's been done, but the open source world needs it.

acdha 2y ago
That’s what I was thinking, too. There are some fun aspects but there’s also a lot of stress: if you fix a bug, what are the odds that someone added a dependency on that behavior in one of the thousands of dependencies which accumulated over the decades? Yes, tests are great but I’d still bet that your inbox would get more grumping than thanks until we can unbreak open source culture.
- tresclow 2y ago
  https://xkcd.com/1172/ https://xkcd.com/1172/ Are we sure this whole discussion can't be reduced to just links to xkcd strips?
  - dehrmann 2y ago
    Picard and Dathon… at El-Adrel
- kelnos 2y ago
  > unbreak open source culture. This aspect isn't really specific to open source culture, it's human nature. People want free stuff. People feel entitled to free stuff. People feel entitled to the uncompensated labor of others.
  - acdha 2y ago
    No, but the part where people don’t make a distinction between how they view paid support contracts and open source is. “Uncompensated labor of others” covers everything from sneaking into a concert to reading an entire book at the bookstore to pirating a movie/game to buying an academic license for something you use at work to harassing an open source maintainer into adding a change you want. Since I only wanted to talk about the last one, I used wording specific to that.

rurban 2y ago

Zoltan Herczeg, the jit maintainer is capable enough, and he is doing most of the work anyway.

jonstewart 2y ago
Zoltan’s work on the jit is incredible. PCRE went from “venerable old warhorse” to “making a case that backtracking can still be fast” when the jit landed.
- lproven 2y ago
  If I may interject for a moment, the software you are calling "jit" is actually pronounced Git…

moomin 2y ago

My instant reaction to this was “Wait, is that PH10?”. Read the article, and of course it is. Even in the 90s he was a famous hacker around the Computer Lab. (The username, for those not familiar with Cambridge Lore, indicates he was the first PH to be given an ID using the scheme applicable in the mid-eighties. Someone will no doubt reply with a more precise timeline.)

mnw21cam 2y ago
I met him briefly when I was at Cambridge in the late 90s. I can't remember why I did, but I do remember that he was an absolute legend back then.

II2II 2y ago

> What particularly amazes me more than the CPU power is the amount of storage that I carry in my pocket. Even though the histories of computers seem to focus upon computational power, it seems as though the most challenging aspect in the development of computers is inexpensive memory. I was going to say fast and inexpensive memory, then I realized that we haven't really achieved that goal. A lot of early computers depended upon the notoriously difficult to manufacture core memory. Then there are things like drum memories, which sacrifice density in order to use stationary read/write heads. And even though these forms of memory share a lot in common with hard drives, they were actually used as the main memories on some computers. Earlier memories are even crazier, like mercury delay lines (complex, sequential access only, and a health hazard). Even later semiconductor memories endured a long period of explosive growth before reaching useful costs and densities. (Early minis and workstations often had large boards containing only memory. Early personal computers kept costs down by shipping with single-digit kilobytes of memory.)

nextaccountic 2y ago
I find annoying that to this day there's computers sold with only 8GB of RAM I wouldn't bother too much if software (and specially web pages) weren't getting bloated continuously It's like there's a great stagnation in the amount of memory increase after each generation, but the software devs didn't get the memo
- zappb 2y ago
  Software dev machines continue to increase in memory. I’ve seen some using 96 GB in laptops!
  - nextaccountic 2y ago
    Ok that's a fair point. I've seen 128GB too but in desktop That's the ultimate "works on my machine"

brendadavis22 2y ago

[flagged]

musicale 2y ago

"Here at Craptech, we love open source. We love that people will spend decades of their lives working for our company, for free."

kemitchell 2y ago

I'd take this as a moment to celebrate a guy who's done a lot of great work without having his name bathed in limelight. Not a prompt to wring hands about succession or security bobbles in other people's projects. I don't think it's somehow also Philip's burden to find or vet or train a successor. The code is out there. His license terms are unobjectionable. If and when Philip stops work, let someone else who cares pick it up. Perhaps under new and different names. The links between the names Philip chose and Philip himself as the person behind the work will have been broken, anyway. Follow-on forks won't take away from Philip's legacy one bit. They might even help raise attention that new groups or individuals worthy of gratitude have stepped up.

RcouF1uZ4gsC 2y ago

> To date, he said he had received "no communications whatsoever" about taking over the project. Perhaps, once the word gets out more widely, a qualified maintainer will step forward to take PCRE2 into the future. I think more and more open source projects will be targeted by intelligence services. Open source maintainer is a stressful, thankless job which pays peanuts compared to what you could get for the skills and time. Driven, talented individual who feels they are sacrificing for the good of society and are not being properly appreciated is the stereotype for a person who can be turned.

ghaff 2y ago
>Open source maintainer is a stressful, thankless job which pays peanuts compared to what you could get for the skills and time. Well, it needs to be something of interest to a company that will pay someone to be a maintainer as part of their day job. Or it needs to be something that someone has built a business around--but, as you suggest, their job is now a lot more than just being a maintainer and, in many cases, they make a lot less than just taking a job at a company.
bityard 2y ago
I'll agree with thankless. But I'm confused about "pays peanuts," because unless you get hired by a company paying you to work on open source software, or have somehow cracked the code to acquiring extremely generous patrons (donations), I would say being an open source maintainer typically pays nothing at all. Which is fine for a lot of us who consider it a hobby and would never _want_ to be paid for it. I also have to believe that if it's a true open source project (meaning, without commercial aspirations), then any stress must be self-induced. FLOSS authors don't owe anyone features, bug fixes, or explanations. And any that are delivered are totally voluntary.
- bee_rider 2y ago
  I totally agree with this but haven’t actually maintained any open source projects. Have you? For me at least, it is easy to say the, I’m quite sure, objectively correct thing. Open source hobby projects have no obligation to anybody, just release code for fun, and anybody who expects more is the problem and should be ignored. But there are lots of reports of burnout and stress. So I think there must be strong social pressure that people fall to, despite not having any legal or ethical obligations. I mean for most of time, all of pre-history, humans got by with informal social structures and a feeling of wanting to provide their friends continued help, despite a lack of a real state or legal framework, and mostly informal ethics. So it isn’t that surprising that people feel like they have a real obligation to users when they’ve been working on a project for a while, right? Helping others is a human instinct.

zexbha 2y ago

This was great to read. I had never heard of Philip Hazel until today. Although I appreciate the work that he's done in maintaining PCRE, I hope that I am never in the position where I am still working on a project at that age.

JeremyNT 2y ago
> I hope that I am never in the position where I am still working on a project at that age. "Hijacked" - used in the title here but not in any of the actual quotes - implies that Phillip is some sort of captive of his projects' success, but I'm not sure that's true. After all, he stepped away from Exim (an incredibly notable project) many years ago, so it's not as if he is incapable of walking away when the time is right. So, presumably, he has only worked so long on these projects because he finds meaning and/or enjoyment from doing so. I can only hope if/when I reach the age of 80 I'll have something meaningful like this I could contribute to!
- jzb 2y ago
  I borrowed the title from a talk he did in 1999, but didn't find a way (mea culpa) to work that naturally into the story. I do believe that, yes, he has enjoyed the work and "hijack" is employed tongue-in-cheek.
- jxramos 2y ago
  Yah I kept searching for a highjack connection thinking he got hit by malware or something like that. Never found it so I think you’re right.
neilv 2y ago
What would you be doing instead at 80, if not working on a project?
- SapporoChris 2y ago
  Depends

throw0101c 2y ago

Not mention of the music software: > Hazel is also known for his typesetting software, in particular "Philip's Music Writer",[5][6] as well as programs to turn a simple markup into a subset of DocBook XML for use in the Exim manual, and to produce PostScript from this XML. * https://en.wikipedia.org/wiki/Philip_Hazel https://en.wikipedia.org/wiki/Philip_Hazel * https://en.wikipedia.org/wiki/Philip%27s_Music_Writer https://en.wikipedia.org/wiki/Philip%27s_Music_Writer

neilv 2y ago

I'm not sure this is correct, but I made a quick guess at which is the most representative Debian package for PCRE, and got this order of magnitude of direct and indirect dependencies for it: $ apt-cache --recurse rdepends libpcre2-8-0 | tr -d ' |' | sort | uniq | wc -l 52160

adolph 2y ago
Looks like another example for Explain XKCD: https://www.explainxkcd.com/wiki/index.php/2347:_Dependency https://www.explainxkcd.com/wiki/index.php/2347:_Dependency https://xkcd.com/2347/ https://xkcd.com/2347/
- socksy 2y ago
  And thus a good candidate for funding from https://www.sovereigntechfund.de/ https://www.sovereigntechfund.de/ , should there be some trustworthy individual or group that could maintain it (I always felt like while this project is admirable, it should be regarded as a point of national security for nation states to maintain core infrastructure in-house)

gmuslera 2y ago

https://xkcd.com/2347/ https://xkcd.com/2347/