8 ms·
Libxml2's "no security embargoes" policy
- zppln 1y agoVery sad read. Much of the multi-billion dollar project I work on is built on top of libxml2 and my company doesn't have a clue. Fuck, even most of my colleagues working with XML every day don't even know it because they only interface indirectly with it via lxml.
- mschuster91 1y ago> Fuck, even most of my colleagues working with XML every day don't even know it because they only interface indirectly with it via lxml. Relevant XKCD: https://xkcd.com/2347/ https://xkcd.com/2347/
- burnt-resistor 1y agoWell, they need to pony up around $150k or so to keep it alive rather than freeloading off the work of others.
- sneak 1y agoIt’s not freeloading to accept a gift given freely.
- KingMob 1y agoYet in real life gifting, we expect reciprocity and have norms. (E.g., if little Johnny doesn't bring a present to Sally's birthday party, he never gets invited back.) Asymmetrical gifting is only acceptable with a power imbalance; if the boss gives an employee a gift, it need not be reciprocated. FOSS actually turns this on its head, since unpaid volunteers are giving billionaires like Bezos gifts. Worse, people argue in favor of it.
- atemerev 1y agoIt is not freeloading, but correspondingly you cannot demand anything from a gifter. Not even "could you please look at it". They might. Or they may ignore you. Or they may delete their repo and go away to the wild. Up to them.
- meepmorp 1y agoI've never once expected someone to repair a gift they gave me because I found a flaw in it. That's when it becomes freeloading.
- ethan_smith 1y agoCompanies should implement dependency audits that identify critical open source components and allocate appropriate support resources proportional to their business impact.
- DeepYogurt 1y agoIt'd be great if some of these open source security initiatives could dial up the quality of reports. I've seen so so many reports for some totally unreachable code and get a cve for causing a crash. Maintainers will argue that user input is filtered elsewhere and the "vuln" isn't real, but mitre don't care.
- mschuster91 1y ago> I've seen so so many reports for some totally unreachable code and get a cve for causing a crash. There have been a lot of cases where something once deemed "unreachable" eventually was reachable, sometimes years later, after a refactoring and now there was an issue.
- DeepYogurt 1y agoAt what rate though? Is it worth burning out devs we as a community rely upon because maybe someday 0.000001% of these bugs might have real impact? I think we need to ask more of these "security researchers". Either provide a real world attack vector or start patching these bugs along with the reports.
- bigfatkitten 1y ago“PoC or GTFO” is an entirely reasonable response.
- marcusb 1y agoAlso a wonderful zine!
- duped 1y ago"PR or payment to fix or GTFO" is also a reasonable response
- codedokode 1y agoI wouldn't bother to write PoC because it is a waste of time and it is faster to fix the potential bug rather than figure out what conditions are necessary to turn it into a vulnerability. I think that we all should stop writing PoCs for bugs and spend the lifetime for something more useful.
- kibwen 1y ago> Ariadne Conill, a long-time open-source contributor, observed that corporations using open source had responded with ""regulatory capture of the commons"" instead of contributing to the software they depend on. I'm only half-joking when I say that one of the premier selling points of GPL over MIT in this day and age is that it explicitly deters these freeloading multibillion-dollar companies from depending on your software and making demands of your time.
- xxpor 1y agoWhy bother open sourcing if you're not interested in getting people to use it?
- itsanaccount 1y agoyou seem to have mistaken corporations for people.
- kortilla 1y agoYou seem to think corporations aren’t made of people
- dsr_ 1y agoSheds are made of wood, but they aren't trees.
- eikenberry 1y agoGroups of people are not the same as the people that make them up. They think differently and have different motivations.
- codedokode 1y agoCorporations are made of rich stock owners.
- bigfatkitten 1y agoSo that if they find it useful, they will contribute their own improvements to benefit the project. I don’t think many projects see acquiring unpaying corporate customers as a goal.
- arp242 1y agoA lot of these "security bugs" are not really "security bugs" in the first place. Denial of service is not resulting in people's bank accounts being emptied or nude selfies being spread all over the internet. Things like "panics on certain content" like [1] or [2] are "security bugs" now. By that standard anything that fixes a potential panic is a "security bug". I've probably fixed hundreds if not thousands of "security bugs" in my career by that standard. Barely qualifies as a "security bug" yet it's rated as "6.2 Moderate" and "7.5 HIGH". To say nothing of gazillion "high severity" "regular expression DoS" nonsense and whatnot. And the worst part is all of this makes it so much harder to find actual high-severity issues. It's not harmless spam. [1]: https://github.com/gomarkdown/markdown/security/advisories/GHSA-m9xq-6h2j-65r2 https://github.com/gomarkdown/markdown/security/advisories/G... [2]: https://rustsec.org/advisories/RUSTSEC-2024-0373.html https://rustsec.org/advisories/RUSTSEC-2024-0373.html
- nicce 1y ago> A lot of these "security bugs" are not really "security bugs" in the first place. Denial of service is not resulting in people's bank accounts being emptied or nude selfies being spread all over the internet. That is not true at all. Availability is also critical. If nobody can use bank accounts, bank has no purpose.
- bogeholm 1y agoSecurity and utility are separate qualities. You’re correct that inaccessible money are useless, however one could make the case that they’re secure.
- Aurornis 1y agoI empathize with some of the frustrations, but I'm puzzled by the attempts to paint the library as low-quality and not suitable for production use: > The viewpoint expressed by Wellnhofer's is understandable, though one might argue about the assertion that libxml2 was not of sufficient quality for mainstream use. It was certainly promoted on the project web site as a capable and portable toolkit for the purpose of parsing XML. Open-source proponents spent much of the late 1990s and early 2000s trying to entice companies to trust the quality of projects like libxml2, so it is hard to blame those companies now for believing it was suitable for mainstream use at the time. I think it's very obvious that the maintainer is sick of this project on every level, but the efforts to trash talk its quality and the contributions of all previous developers doesn't sit right with me. This is yet another case where I fully endorse a maintainer's right to reject requests and even step away from their project, but in my opinion it would have been better to just make an announcement about stepping away than to go down the path of trash talking the project on the way out.
- rectang 1y agoI think Wellnhofer is accurate in his assessment of the current state of the library and its support infrastructure institutions. Software without adequate ongoing maintenance should not be used in production. (Disclosure: I'm a past collaborator with Nick on other projects. He's a fantastic engineer and a responsible and kind person.)
- firesteelrain 1y agoThe crux is these seemingly bogus security “bugs”. If there were quality issues, the amount of software and people using libxml by virtue of testing in production/wild would have found most issues by now. There is plenty of software today that is tested within cost and schedule that’s closed source and it’s running in production. I get the point but libxml is not one of those cases
- flomo 1y agoRecall similar things were said about OpenSSL, and it was effective at getting corps to start funding the project.
- bjourne 1y agoSo software released under the MIT license and maintainer now complains that corporate users are not helping improve it? I'd file this under Stallman told you so.
- kayodelycaon 1y agoNo. He’s complaining about companies demanding he do free work for them.
- burnt-resistor 1y agoThe correct response is "FU, pay me."
- tzs 1y agoThe license used is completely irrelevant here. Corporate users generally aren't making any changes to software like libxml2.
- JonChesterfield 1y agoThis is an alarming read. Not so much the "security bugs are bugs, go away" sentiment which seems completely legitimate, but that libxml2 and libxslt have been ~ solo dev passion projects. These aren't toys. They're part of the infrastructure computing is built on.
- chronid 1y agoExactly how openssl was (is?) when heartbleed happened. It's nothing new sadly, there are memes about the "unknown oss passion project" holding up the entire stack all over the internet.
- deleted 1y ago[deleted]
- pabs3 1y agoThe Nebraska project in this diagram isn't just one project, its pretty much the entirety of our underlying software infrastructure. https://xkcd.com/2347/ https://xkcd.com/2347/
- stavros 1y agoYou got the timeline wrong: libxml2 has always been a solo dev passion project, then a bunch of megacorps used them for the infrastructure computing is built on. This is on them.
- jeroenhd 1y agoThese projects are toys. The real problem is that multi billion dollar companies are using toys to keep you safe. Maybe we shouldn't build our core infrastructure with LEGO blocks and silly putty.
- bryanlarsen 1y ago> The point is that libxml2 never had the quality to be used in mainstream browsers or operating systems to begin with I think that's seriously over-estimating the quality of software in mainstream browsers and operating systems. Certainly some parts of mainstream OS's and browsers are very well written. Other parts, though...
- burnt-resistor 1y agoThat's the problem of abusing and freeloading off critical components of the FOSS supply chain. Megacorps must pay their fair share or bad things happen, just like unbounded, corrupt crapitalism.
- karel-3d 1y agoI have only experience with Chrome codebase and while it's C++ (which I don't personally like) it's pretty solid and most of the weird hairy stuff were the external linked libraries. But I didn't poke around THAT much.
- troupo 1y agoRemember "25000 string allocations per each key stroke"? https://groups.google.com/a/chromium.org/g/chromium-dev/c/EUqoIz2iFU4/m/kPZ5ZK0K3gEJ?pli=1 https://groups.google.com/a/chromium.org/g/chromium-dev/c/EU...
- quietbritishjim 1y agoThat's certainly interesting but to give context for those not following the link: This is for entering into the address/search bar, so it covers all the work of searching history, performing network requests to autocomplete search terms, and displaying those results. It's not like entering a character into a regular text box on a page.
- troupo 1y agoIMO no amount of context can justify 25000 string allocations per key stroke :) Also, if you read the issues in the first post, it has nothing to do with "covering all the work". It's just really bad programming
- deleted 1y ago[deleted]
- kstrauser 1y ago> It includes a request for Wellnhofer to provide a CVE number for the vulnerability and provide information about an expected patch date. “Three.” “Like, the number 3? As in, 1, 2, …?” “Yes. If you’re expecting me to pick, this will be CVE-3.”
- tptacek 1y agoI don't think this trend much matters. Serious vendors concerned about security will simply vendor things like libxml2 and handle security inbounds themselves; they'll become the real upstreams.
- canyp 1y agoSerious vendors:
- hyperman1 1y agoThen they all have patches floating around, and get in trouble coordinating with each other. Long term, they would have to set up a foundation to manage these patches, call it the 'a patchie' foundation. Maybe they'll think about a cute name and release a webserver.
- benced 1y agoDo we need a more profound solution than what the maintainer is doing here? Any given bug is either: a) nonsense in which case nobody should spend any time fixing this (I'm thinking things like the frontend DDOS CVEs that are common) b) an actual problem in which case a compliance person at one of these mega tech companies will tell the engineers it needs to be fixed. If the maintainer refuses to be the person fixing it (a reasonable choice), the mega tech company will eventually just do it. I suppose the risk is the mega tech company only fixes it for their internal fork.
- prmoustache 1y ago> I suppose the risk is the mega tech company only fixes it for their internal fork. They'd rather send a patch than having to maintain and sync an internal fork with upstream.
- djoldman 1y agoI really don’t understand solo unpaid maintainers who feel “pressure” from users. My response would always be: it’s my repo, my code, if you don’t like how I’m doing things, fork the code megashrug. You owe them nothing. That fact doesn’t mean maintainers or users should be a*holes to each other, it just means that as a user, you should be grateful and you get what you get, unless you want to contribute. Or, to put it another way: you owe them exactly what they’ve paid for!
- msgodel 1y agoThe correct response to this kind of thing is an invoice IMO.
- deleted 1y ago[deleted]
- kayodelycaon 1y agoYour solution is exactly right, but let me try to help understanding the problem. Many open source developers feel a sense of responsibility for what they create. They are emotionally invested in it. They may want to be liked or not be disliked. You’re able to not care about these things. Other people care but haven’t learned how to set boundaries. It’s important to remember, if you’re not understanding what a majority of people are doing, you are the different one. The question should be “Why am I different?” not “Why isn’t everyone else like me?” “Here’s the solution” comes off far better than, “I don’t understand why you don’t think like me.”
- atemerev 1y agoThat's a good argument, thank you. Open source authors are even more heroic with this.
- michaelt 1y ago> I really don’t understand solo unpaid maintainers who feel “pressure” from users. Some open source projects which are well funded and/or motivated to grow are giddy with excitement at the prospect you might file a bug report [1,2]. Other projects will offer $250,000 bounties for top tier security bugs [3]. Other areas of society, like retail and food service, take an exceptionally apologetic, subservient attitude when customers report problems. Oh, sir, I'm terribly sorry your burger had pickles when you asked for no pickles. That must have made you so frustrated! I'll have the kitchen fix it right away, and of course I'll get your table some free desserts. Some people therefore think doing a good job, as an open source maintainer, means emulating these attitudes. That you ought to be thankful for every bug report, and so very, very sorry to everyone who encounters a crash. Needless to say, this isn't a sustainable way to run a one-person project, unless you're a masochist. [1] https://llvm.org/docs/Contributing.html#id5 https://llvm.org/docs/Contributing.html#id5 [2] https://dev.java/contribute/test/ https://dev.java/contribute/test/ [3] https://bughunters.google.com/about/rules/chrome-friends/5745167867576320/chrome-vulnerability-reward-program-rules https://bughunters.google.com/about/rules/chrome-friends/574...
- firesteelrain 1y agoUnderstand the stance, but the big corps using it (Apple, Google, Microsoft) are using it and acknowledge it silently at risk. It's not entirely fair though, Google did make a donation.
- burnt-resistor 1y agoLike tipping someone a penny. If it's so critical to their business, then they can pay a pittance to sustain it.
- firesteelrain 1y agoThis chart claims a lot of contributions (2020). It is certainly more than a penny. https://www.statista.com/chart/25795/active-github-contributors-by-employer/ https://www.statista.com/chart/25795/active-github-contribut... "Microsoft is now the leading company for open source contributions on GitHub" (2016) https://news.ycombinator.com/item?id=12504694 https://news.ycombinator.com/item?id=12504694
- adastra22 1y agoThe article has the number. Google paid him $10k in a one-time grant.
- troupo 1y ago> It's not entirely fair though, Google did make a donation. Yup. $10 000. Remind me what the average Google salary is? Or how much profit Google made that year? Or better still, what is the livable wage is where libxml maintainer lives? You know, the maintainer of the library used in the core Google Product?
- firesteelrain 1y agoI agree that $10,000 isn’t a meaningful investment given the scale of reliance. What would a fair model look like? An open-source infrastructure endowment? Ongoing support contracts per critical library? At the same time, I think there’s a tension in open source we don’t talk about enough: it’s built to be free and open to all, including the corporations we might wish were more generous. No one signed a contract! As the article states, Libxml2 was widely promoted (and adopted) as the go-to XML parser. Now, the maintainer is understandably tired. There is now a sustainability problem that is more systemic than personal. How much did the creator of libxml benefit? I don’t think we should expect companies to do the right thing just because they benefit and it isn’t how open source was meant to be and this isn’t how open source is supposed to work But maybe that’s the real problem
- SAI_Peregrinus 1y agoThere are two types of responsible disclosure: coordinated disclosure where there's an embargo (ostensibly so that the maintainer can patch the software before the vulnerability is widely known) and full disclosure where there's no embargo (so that users can mitigate the vulnerability on their own, useful if it's already being exploited). There's no reason a maintainer shouldn't be allowed to default to full disclosure. In general, any involved party can disclose fully. Irresponsible disclosure is solely disclosing the vulnerability to groups that will exploit it, e.g. NSO.
- tptacek 1y agoYeah, exactly. And the subtext of all of this is that big companies are going to get burnt by these kinds of decisions. But big companies work around this kind of thing all the time. OpenSSL is a good example.
- sorrythanks 1y agoGPL was a good idea
- jenadine 1y agoI agree. But it doesn't fix this particular problem. GPL software also needs maintainers and can still have security issues.
- bawolff 1y agoSo reading this, it sounds like the maintainer got burned out. That's reasonable, being a maintainer is a thankless job. However i think there is a duty to step aside when that happens. If nobody can take the maintainer's place, then so be it, its still better than the alternative. Being burned out but continuing anyways just hurts everyone. Its absolutely not the security researcher's fault for reporting real albeit low severity bugs (to be clear though, entirely reasonable for maintainers to treat low severity security bugs as public. The security policy is the maintainer's decision, its not right to blame researchers for following the policy maintainers set)
- firesteelrain 1y agoCurl has the same issue and the problem is that these reports are just noise. It wastes everyone’s time and even lacks a Proof of Concept.
- bawolff 1y agoAfaik, curl was complaining about AI generated reports that were bullshit. They were not complaining about reports that legit caused crashes. Totally different thing.
- firesteelrain 1y agoI don’t recall that. I was referring to this blog post and there was a series of them https://daniel.haxx.se/blog/2023/08/26/cve-2020-19909-is-everything-that-is-wrong-with-cves/ https://daniel.haxx.se/blog/2023/08/26/cve-2020-19909-is-eve...
- teddyh 1y agoBeing a free software maintainer, especially for code that you did not yourself write, is in effect a volunteer position in a charity or a non-profit organization. You yourself volunteered to take the position, and when you did, you became responsible for acting in the interests of the project and all its users. The fact that you are not paid does not mean that you can do whatever you please. If you at any time feel that you cannot fulfill your responsibilities to your users and to the development of the project, you should immediately leave your position to more eager and/or capable hands. (You should already have been prepared and have such people ready to take over, which should be possible if the project is popular enough.)
- throwaway2037 1y ago> ...there are currently four bugs marked with the security label in the libxml2 issue tracker. Three of those were opened on May 7 by Nikita Sveshnikov, a security researcher who works for a company called Positive Technologies. I'm confused. Why doesn't Positive Technologies submit a patch or offer to pay the lead maintainer to implement a fix? FYI, Wiki tells me: > Positive Technologies is a Russian information security research company and a global leader in cybersecurity.
- codedokode 1y agoBecause they have other things to do? Nobody pays them for fixing it too.
- brazzy 1y agoBecause they don't use libxml2 and don't actually have any need for a fix. They only want to build a reputation as pentrsters by finding vulnerabilities in high profile projects
- flomo 1y agoPerhaps you are imagining some free software bong(o drum) circle? The big point is this is a critical component for Apple and Google (and maybe Microsoft), and nobody is paying any attention to it.
- jeroenhd 1y agoThe security researcher is paid to find vulnerabilities, not to fix them. These companies are selling code analysis to their customers and the more issues they find, the more they'll be worth. When it comes to fixing the issues, their customers will have to beg/spam/threaten the maintainers until the problem is solved. They probably won't write a patch; after all, Apple, Google, and Microsoft are only small companies with limited funds.
- throwaway2037 1y agoI am replying to my own post instead of replying to all of the child posts: The point of my original post... that I hoped someone would see/interpret: Reporting "security bugs" without a patch or an offer to pay the lead maintainer to implement a fix feels like blackmail in 2025. Yes, I know this will be a hugely controversial opinion amoungst HN crowd. Personally: I don't see a huge amount of commercial value in pure infosec research that does not include funds to develop or fund a patch. The primary purpose of these "pure" infosec research firms is to generate FOMO for enterprise clients who pay them for private patches or "support".
- democracy 1y agofunny - when struts2/log4j caused a lot of million-dollar problems, how many companies were looking for commercial alternatives or invested into developing their own solutions? That's right - zero. Everyone just switched to the next freebie.
- KingMob 1y ago"...the project has received the immense sum of $11,000..." Is the author being sarcastic? Or is that genuinely an immense sum relative to how little funding most FOSS gets?
- pabs3 1y agoBoth :/
- otikik 1y agoI think they are not going far enough. "All null-pointer-referencing issues should come with an accompanying fix pull request".
- tzs 1y agoSo if I find a null pointer dereference issue in something written in a language I don’t know, I shouldn’t report it because I can’t include a fix?
- otikik 1y agoIf you don't know the language, why are you reporting null pointers?
- tzs 1y agoBecause the program crashed and the crash dump showed a null pointer dereference, and I found some inputs that reproduce it 100%, so I thought this might be useful to the developer?
- otikik 1y agoIn the context of libxml it does sound that for every hypothetical person like you that there's going to be 20 "security researchers" like the ones the article is mentioning; just running automated tools and trying to use security issues as a way to promote themselves. If getting rid of your input gets rid of the other 20 issues, I would take it.
- jeroenhd 1y agoI don't think putting the burden to fix the code should be on users. However, it also shouldn't be on developers. I think something like "Null-pointer-referencing issues will not be looked at by core maintainers unless someone already provides a patch". That way, someone else who knows how to fix the problem can step in, and users aren't left with the false impression that merely reporting their bug will not guarantee a solution.
- jonathanlydall 1y agoThe breaking point here seems to be security researchers (or maybe just one) essentially “farming” this project for “reputation”. They seem to be approaching it like a computer game against NPCs where you get as much reward as time spent, except in this case they’re imposing a significant amount of work on a real life volunteer maintainer. I suspect the maintainer would mind less if it was reported by actual users of the library who encountered a real world issue and even better if they offer a patch at the same time, but these bugs are likely the result of scanning tools or someone eyeballing the code for theoretical issues. In light of the above, the proposed MAINTENANCE-TERMS.md makes a lot of sense, but I think it should also state that security researchers looking for CVEs or are concerned about responsible disclosure should contact the vendor of the software distributing the library. This would put the onus on the large corporates leveraging the library (at no charge) to use their own resources to deal with addressing security researcher concerns appropriately and they can probably do most of the fix work themselves and the coordinate with the maintainer only to get a release out in a timely manner. If maintainers find that people coming to them with security issues have done all work possible before hand, they’d probably be completely happy to help.
- KingOfCoders 1y agoWhen a project is up, open source developers are keen to promote it, put it on their CV, give conference talks. There is no obligation for companies to sponsor anything, this is not the reason behind open source. Yes open source has changed, from when the early 90s. There are more users, companies use projects and make millions with other peoples work. I feel with the maintainer, with how ungrateful people are. And demanding without giving. Open Source licenses fall short. Open Source projects should clearly state what they think about fixing security, taking on external contributions or if they consider the project feature complete. Just like standard licenses, we should have a standard, parseable maintenance "contract". "I fix whatever you pay for, I fix nothing, I fix how I see fit. Including disclosure, etc." So everyone is clear about what to expect.
- yencabulator 1y agoThat's in the license already, and quite clear. https://gitlab.gnome.org/GNOME/libxml2/-/blob/63f98ee8a3a11f99db60c956746c0156e3a0ed52/Copyright#L18 https://gitlab.gnome.org/GNOME/libxml2/-/blob/63f98ee8a3a11f...
- KingOfCoders 1y agoIt's not, license just says "Nothing guaranteed", it's not saying what to expect. A "I can do whatever I want" doesn't tell you anything about my behavior. "The viewpoint expressed by Wellnhofer's is understandable, though one might argue about the assertion that libxml2 was not of sufficient quality for mainstream use. It was certainly promoted on the project web site as a capable and portable toolkit for the purpose of parsing XML. Open-source proponents spent much of the late 1990s and early 2000s trying to entice companies to trust the quality of projects like libxml2, so it is hard to blame those companies now for believing it was suitable for mainstream use at the time." If the license says one thing, and you say and promote something else, you can't say "But it's in the license" and "I said so at a conference" just as it fits you. So what should I believe? What you write in the license? What you say at a conference? Nothing you say?
- 1y ago
- lukaslalinsky 1y agoAs a maintainer of several open source projects over my life, I really hated these so called security researchers and their CVEs. I routinely fixed more impacting bugs due to user reports, but when one of these companies found a big, they made a whole theater around it, while the impact being pretty small. Pretty much any bug, except maybe a typo in the UI, is a security bug. It gets tiring very soon. And with the CVEs comes a lot of publicity and a lot of demands.
- mrweasel 1y agoDoes the security researchers provide you with patches, or is it more frequently "there's a bug here". In the later case I'm wondering if there's an argument to be made for "Show me the code or shut up". Simply rejecting reports on security issue which are not also accompanied by a patch. I'm think, will it devalue the CVE on the researchers resume, if the project simply says no, on the grounds of not being a fix? Probably not.
- viraptor 1y agoCVE is an index of vulnerabilities. Whether there's a patch and who made it is largely irrelevant in that context.
- atemerev 1y agoDon't like something? Fork and fix. Unhappy with a maintainer? Fork and maintain it yourself. Some open source code creates issues in your project? Fix it and try to upstream. Upstream is not accepted? Fork and announce the fix. Unpaid open source developers owe you nothing, you can't demand anything, their work is already a huge charitable contribution to humanity. If you can do better — fork button is universally available. Don't forget to say thank you to original authors while you stay on the shoulders of giants.
- h43z 1y agoThe only obstacle here appears to be the psychological issues of the maintainers themselves. I know it maybe hard to say "fuck off" but they will have to learn to say that to stop being exploited.
- heisenbit 1y agoBigger companies have either policies or have policies derived from regulatory demands on the software they are using for their products and services. Defects must be fixed within a certain timeframe. Software suppliers and external code must be vetted. Have such a widely used library explicitly not maintained in theory should make it a no-go area forcing either removal or ongoing explicit security audits - it may well be cheaper for any of them to take over the full maintenance load. Will be interesting to watch. Also the not so relevant security bugs are not just costs to the developers but the library churn is also costing more and more users if the user is forced by policy to follow in a timely manner the latest versions in the name of "security".
- mjw1007 1y agoIt would be better if there was a layer of maintainers between the free software authors and the end users that could act as a buffer in cases like this, in particular to take care of security vulnerabilities that genuinely need dealing with quickly. Of course that's exactly what traditional Linux distributions signed up to do. Clearly many people have decided that they're better off without the distributions' packaging work. But maybe they should be thinking about how to get the "buffering" part back, and ideally make it work better than the distributions managed to.
- neilv 1y agoIf you skim past the less-interesting project history, there's interesting description of some dynamics that apply to a lot of open source projects, including: > Even if it is a valid security flaw, it is clear why it might rankle a maintainer. The report is not coming from a user of the project, and it comes with no attempt at a patch to fix the vulnerability. It is another demand on an unpaid maintainer's time so that, apparently, a security research company can brag about the discovery to promote its services. > If Wellnhofer follows the script expected of a maintainer, he will spend hours fixing the bugs, corresponding with the researcher, and releasing a new version of libxml2. Sveshnikov and Positive Technologies will put another notch in their CVE belts, but what does Wellnhofer get out of the arrangement? Extra work, an unwanted CVE, and negligible real-world benefit for users of libxml2. > So, rather than honoring embargoes and dealing with deadlines for security fixes, Wellnhofer would rather treat security issues like any other bug; the issues would be made public as soon as they were reported and fixed whenever maintainers had time. Wellnhofer also announced that he was stepping down as the libxslt maintainer and said it was unlikely that it would ever be maintained again. It was even more unlikely, he said, with security researchers ""breathing down the necks of volunteers."" > [...] He agreed that ""wealthy corporations"" with a stake in libxml2 security issues should help by becoming maintainers. If not, ""then the consequence is security issues will surely reach the disclosure deadline (whatever it is set to) and become public before they are fixed"".
- ZiiS 1y agoIt seems perfectly reasonable for any library to take the stance they are not a security barrier. It is up to people using libxml2 in applications and OSs that have the resources to issue CVEs and track embargos. I am sure any resulting PRs will be gratefully welcomed.
- VMtest 1y agoI'm very sure if he is well paid by those corporations he will have no problem maintaining it, take note guys
- mystified5016 1y agoHonestly the only permanent solution to this is probably a big string of LeftPad events. Maintainers of projects like this that have been subsumed into corporate infrastructure should pull the plug and nuke the git repo. Disastrous, apocalyptic consequences is the only way to get the attention of the real decision makers. If libxml2 just vanishes and someone explains to John Chrome or whoever that $150k a year will make the problem go away, it's a non-decision. $150k isn't even a rounding error on a rounding error for Google. The only way to fight corporations just taking whatever they want is to absolutely wreck their shit when they misbehave. Call it juvenile, sure, but corporations are not rational adults and usually behave like a child throwing a temper tantrum. There have to be real, painful and ongoing consequences in order to force a corporation to behave.
- ytfghghvh 1y ago> It was certainly promoted on the project web site as a capable and portable toolkit for the purpose of parsing XML. This is a garbage criticism. It’s perfectly adequate for that for almost everyone. If you are shipping it in a browser to billions of people, that’s a very unique situation, and any security issues are a you problem. Not sure if this is intended to be a “show both sides” journalism thing but it’s a totally asshole throwaway comment.
- anonzzzies 1y agoWe get so many 'security advisors' trying to blackmail us for money or blackmailing us to post on some social media that we don't care about security because we ignored their emails. A small company, let alone an opensource maintainer doesn't have time for this. Most of this stuff is just not priority or not valid for our case. We had some relief years ago when we changed our internal stuff to give off productnames and version numbers that simply don't exist, but because so much is frontend now tools are so good at finger printing that, so now we do get tons of those again.
- jonathanlydall 1y agoSomeone who runs a small company with a static content website, got an email like this, I was thinking a response like the following might be a appropriate: Thank you for reaching out to us. Please be aware that we do not run any kind of security bounty/reward programs. Having performed our own analysis we have not been able to identify any practically exploitable security risks. If you have found a practically exploitable security issue with our website, please provide some form of demonstration so that we may discuss further. I don’t think that would come across as not being concerned about security, but puts the onus on the “researcher” to prove there is a real problem. Chances are they did some automated scan and found some out of date JavaScript library version which despite having a vulnerability, is not actually a security risk on a static content site.
- kiitos 1y agoThe point is that libxml2 never had the quality to be used in mainstream browsers or operating systems to begin with. It all started when Apple made libxml2 a core component of all their OSes. Then Google followed suit and now even Microsoft is using libxml2 in their OS outside of Edge. This should have never happened. Originally it was kind of a growth hack, but now these companies make billions of profits and refuse to pay back their technical debt, either by switching to better solutions, developing their own or by trying to improve libxml2. The behavior of these companies is irresponsible. Even if they claim otherwise, they don't care about the security and privacy of their users. They only try to fix symptoms. Hear, hear!
- akshatver12312 1y agoValid points, hope you get it...
- akshatver12312 1y agovbc
- leoh 1y agoI wonder if fil c would make most of these issues go away https://github.com/pizlonator/llvm-project-deluge https://github.com/pizlonator/llvm-project-deluge
- sim7c00 1y agoits so weird to me to report a bug to open source but not atleast suggest a fix :/. especially around security bugs. to prove it u need to reliably trigger and exploit it so it should be plainly obvious in most cases what the fix is :/. this is why i never report stuff to open source. if you wanna play bug bounty and cve hoarder its better to stick with bug bounty programs. why? there the security researcher can be depressed about the process himself rather than some volunteer coder. gotta not make your issues other ppls issues.