3 ms·
There's a long tail of stuff that isn't paid indeed but I don't think this is confirmation bias. I maintain a few things myself actually. The thing is, I'm not
by jillesvangurp 2y ago
There's a long tail of stuff that isn't paid indeed but I don't think this is confirmation bias. I maintain a few things myself actually. The thing is, I'm not actually expecting to get paid.I think you are underestimating just how many OSS developers have steady jobs and over estimating the urgency of the issue. I don't think the crisis you are outlining actually exists. But I'm sure there are individuals who'd like to get paid more for whatever they are doing.
- jorvi 2y agoI mean, the XZ backdoor happened because the main developer was overworked and burned out[0]. Stuff like this happens all over the OSS sphere, its just that its usually on less-critical projects. AFAIK, Heartbleed also sat unnoticed in OpenSSL for years because it was no one's full-time job to care. If you were paying someone to full-time maintain XZ or Heartbleed, or whatever, it would have their singular attention. [0]https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.html https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.h... > I haven't lost interest but my ability to care has been fairly limited mostly due to longterm mental health issues but also due to some other things. Recently I've worked off-list a bit with Jia Tan on XZ Utils and perhaps he will have a bigger role in the future, we'll see.
- jillesvangurp 2y agoNow that sounds like confirmation bias.
- bigfatkitten 2y agoOpenSSL's problems were caused mostly by their codebase being awful. As Microsoft has been demonstrating for decades, there is no direct correlation between budget and quality.