7 ms·
Stepping Down as Libxml2 Maintainer
- gnabgib 1y agoRelated Libxml2's "no security embargoes" policy (298 points, 84 days ago, 270 comments) https://news.ycombinator.com/item?id=44381093 https://news.ycombinator.com/item?id=44381093
- 0xbadcafebee 1y agoThanks, this is really interesting. I feel like it adds more weight to my feeling that we should have a software building code. When you have software that's critical infrastructure, with a nutso security policy like "no embargoes / 0day me bruh", we should have some regulations in place to require the software be maintained properly (that is to say, in a sane manner) or you can't use it commercially or for safety-critical things. Which would inevitably force commercial entities to pay for the maintenance so it could be done right.... which they should be doing already, the same way any company that builds safety-critical infrastructure has to pay to do it right. If we want society to be safe, we have to make a law that enforces it. That's how that shit works. (as an aside: holy shit, you're a prolific HN submitter, and all from different sources. where do you get it all?)
- Snild 1y ago> we should have a software building code This made my brain go "Oh no, not this again. Open source projects don't owe you..." etc etc. > or you can't use it commercially or for safety-critical things Oh. Yeah, okay, absolutely! For safety-critical, I would like to think the responsibility already lies with the integrator/seller, but making it explicitly so can't hurt.
- elcritch 1y agoSafety critical fields like aviation already have strict requirements. Usually there's very few software dependencies used in those projects. Expanding that to more fields would be interesting, but difficult and expensive across the board. Particularly any sort of requirements like that generally incur significant regulatory and certification overhead. However, if it was done similar to PCISS as an industry forum it might work better. Especially if certain fields like anything connecting with the electric grid we're required to use certified software.
- deleted 1y ago[deleted]
- 0xbadcafebee 1y agoPretty much all construction uses materials which follow a specification. The least we could do is start requiring all commercial software do the following: 1. Declare an SBOM 2. Each software component must have a listed specification We'd then need to make software specifications. Start with the most basic specification possible; "has performed linting", "has full integration test coverage", "has passed QA testing", "has an active maintainer", "lists its license", "does not have a hidden back door", "is free of known vulnerabilities", etc. Make more detailed specifications as-needed (for a particular industry, use case, requirements). Once we have all that, you can glance at a company's SBOM and find out if they've done the bare minimum due-diligence. We could also make or modify regulations that require these same materials standards, like privacy regulations, financial regulations. And yes, meeting minimum material standards is more expensive. We already accept that cost in the physical world, why not in the software world? If there's a TDS, SDS, MSDS, etc for physical products, we should have them for software too. I want to know your materials are safe before I use your products. I'm sick of being exposed by companies who are completely irresponsible.
- WJW 1y ago> or you can't use it commercially or for safety-critical things The license for libxml2 (like the license for almost any kind of open source software) already states "THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT." I don't see how you can put the responsibility even more on the integrator/seller than that. It literally states the devs don't even guarantee it works correctly.
- pcdavid 1y agoIsn't this what the european Cyber Resilience Act (CRA) is about? See https://orcwg.org/cra/ https://orcwg.org/cra/ and the work of the Open Regulatory Compliance Working Group in general.
- rcxdude 1y agoMore or less, though the CRA is pretty minimal: it has a few basic requirements and hobby/unpaid open source software is not covered. A company integrating open source software is essentially responsible for covering those requirements themselves.
- jeroenhd 1y agoThe company being responsible for the open source components they integrate should solve the biggest dependency problems, though. From a security perspective, it doesn't really matter if a company fixes the bugs themselves or if they pay someone to fix it for them.
- tinco 1y agoPeople building "safety critical" systems already pay for a "secure" ecosystem. It's called Microsoft. We don't need regulations to have Microsoft exist. Do you think some random med tech startup is going to pay to have libxml2 maintained? They'll see the regulation and go "oh ok, Windows licenses it is". It's not the "safety critical" software that needs this fixed, it's all software in general. There's a million software systems that have important privacy sensitive data or safety relevant processes that fly under the "safety critical" radar.
- thyristan 1y agoRead your Microsoft licensing agreement. If you don't have one, read the EULA for OEM windows. The warranty, fitness for purpose and damages exclusion is not as extensive as what the grandparent cited, but it basically boils down to "as limited as legally possible, and the most damages you will get is your license fee back". You also won't get a binding requirements document anyways, so you don't even really know what the software microsoft sells you is fit for. At any point in time, there could be some knowledgebase article saying something like "oh, and btw, don't do this because it breaks", so per their warranty agreement you signed they are free from any responsibility simply by documenting the problem. Really safety-critical stuff like ASIL-D, ISO26262, IEC61508 (and tons of other magic numbers) isn't something you can buy from microsoft. At best, you can sometimes get a reseller to sign something a little more binding, but with tons of restrictions that basically boil down to "use the microsoft stuff for the readout gauges, but the critical control part goes somewhere else".
- tinco 1y agoIt's not about warranties, it's about having a stable ecosystem with some guaranteed measure of maintenance. The point is not that there's even more stable and expensive options than Microsoft. The point is that there's very little space for OSS here. Go to any hospital and count the amount of Windows devices and compare that to the amount of other operating systems you see. The second something becomes even a little safety oriented, there's going to be proprietary software. So when these regulations that OP would start to take hold, would we get companies to sponsor random open source dependencies like libxml2? Or would they gather around some stable proprietary ecosystem like Microsoft's and maybe some big innovative solutions built on top of Microsoft?
- Joker_vD 1y ago> When you have software that's critical infrastructure, with a nutso security policy like "no embargoes / 0day me bruh", ...you then should stop and re-evaluate your life choices: specifically, choosing this particular piece of software, which is known to have always been insecure, to be a critical part of your infrastructure.
- knowitnone2 1y ago[flagged]
- ivolimmen 1y agoMaybe my human interaction interfacing software has a glitch but I am having a hard time parsing this content. Do I detect a hint of sarcasm? Please add a '/s' at the end of your future posts to aid my very archaic and vintage brain matter.
- yupyupyups 1y agoJia Tan was the alias of the hacker(s) who infiltrated xz to plant a backdoor. He/They were in the project for 2 years I believe, and so had "significant experience" "maintaining" open source software.
- ivolimmen 1y agoThanks for the info; I read the news but did not remember the name of the person.
- tsimionescu 1y ago"Jia Tan" was the name of the person (or group) who became a maintainer of libxz and sneaked in a vulnerability targeting OpenSSH.
- mid-kid 1y ago*liblzma
- rjh29 1y agoMaybe _my_ software has a glitch but was your comment also sarcastic? Be sure to add an /s next time...
- bombcar 1y ago
- traversaro 1y agoRelated gitlab comment: https://gitlab.gnome.org/GNOME/libxml2/-/issues/976#note_2538944 https://gitlab.gnome.org/GNOME/libxml2/-/issues/976#note_253... .
- codethief 1y agoThis should be higher up and seems very relevant to understanding what's going on. Looks like the (former) maintainer does not actually want to abandon libxml2.
- bayindirh 1y agoHe just wants his sanity and dignity back while continuing his passion project. Respectable and commendable, if you ask me.
- morkalork 1y agoThe bit about google employees willing to step up and work on the project is kind of disgusting: The company is too cheap to fund the project with money, but don't worry, they've got an endless supply of eager developers looking to 'pad their résumé' and deny you all the reward and satisfaction of what you built. It almost reads like a threat "work for free or we'll fork it and take it away from you". Wow
- bayindirh 1y agoWow, indeed. To add insult to the injury, the whole message reads like this: > Good news is several Google and Apple engineers have volunteered to help with libxml2 and libxslt security issues, despite your effort to sabotage libxml2 users... I mean, c'mon. He's carrying the world on his shoulders and people are just pointing fingers? Also, this shows how evil corporations are. I can understand Apple, it's their culture to avoid GPL code and and committing code to any public project needs permission from everyone plus the campus cat, but Google, the apparently bastion of open source software is doing the same thing without any shame... They have morphed into the next Microsoft AFAICS. Despicable.
- throw839393949 1y ago[flagged]
- throw839393949 1y ago[flagged]
- mort96 1y agoI don't think this is about money but about will.
- throw839393949 1y ago> Since commercial users of libxml2 are completely unwilling to fund further development
- mort96 1y agoWhere's that a quote from? I can't find it in the linked post (https://discourse.gnome.org/t/stepping-down-as-libxml2-maintainer/31398/2 https://discourse.gnome.org/t/stepping-down-as-libxml2-maint...)
- throw839393949 1y agohttps://gitlab.gnome.org/GNOME/libxml2/-/issues/976#note_2538944 https://gitlab.gnome.org/GNOME/libxml2/-/issues/976#note_253...
- darkamaul 1y agoNick Wellnhofer is stepping away from libxml2 after a decade of unpaid maintenance. He’s forking it under the AGPL, but that will probably scare off most corporate users. Meanwhile libxml2 is still everywhere. Without someone with real backing, a core piece of infrastructure is about to go unmaintained. Once again, the open-source funding problem is laid bare: the internet runs on the unpaid evenings of a few people until they burn out (add relevant reference from XKCD, obviously).
- ChrisArchitect 1y agohttps://xkcd.com/2347 https://xkcd.com/2347
- jeroenhd 1y agoWith not enough time to develop an alternative and too many application ecosystems relying on this library, I think it's a matter of time before a large company forks the library to fix security issues with it now that they have no choice but to do the work themselves. At least until IBM and Google figure out a way to move away from this library.
- moomin 1y agoIronically, IBM and Google 100% could just pay for it to be maintained under current licensing. (But won't.)
- ricardo81 1y agoTrue. It'd be illuminating to know how far and wide it is used. It was always been my go-to library for parsing XML in a number of languages.
- speed_spread 1y ago"Expected effort required to maintain implementation" should be an evaluation criteria when selecting technologies. Thousand page RFCs do not make sustainable standards in the long run. Most committee designed specs end up in this category. People are impressed by complexity but actively pursuing simplicity is what we should be doing.
- AndyKelley 1y agoIf you think you need libxml2, think again. XML is a complex beast. Do you really need all those features? Maybe a much smaller, more easily maintained library would suit your needs while performing better at the same time! For instance, consuming XML and creating it are two very different use cases. Zooming into consuming it, perhaps your input data has more guarantees than libxml2 assumes, such as the nonexistence of meta definition tags.
- EvanAnderson 1y agoGratuitous use of XML does sometimes smell like a "now you have two problems" kind of affair.
- jeroenhd 1y agoXML is used in countless standards. You can't just not use it if you interact with the outside world. Every XML feature is still in the many XML libraries because someone has a need for it, even things like external entities. Maybe you don't need libxml2 specifically (good luck finding an alternative to parse XML in C and other such languages though), but "I don't like the complex side of XML so let's pretend it doesn't exist" doesn't solve the problem most people pick libxml2 for. It's the de-facto standard because it supports everything you could possibly need.
- lyu07282 1y agoYou shouldn't be down voted, its just the truth no matter how unfortunate.
- dontlaugh 1y agoExactly. For example if you need to integrate SAML, you have to support a significant subset of several XML specs. It may be possible to write a SAML-only library that supports less, but it's not clear it would be any simpler.
- AndyKelley 1y agoIt's common for both the producer of XML and the consumer of XML for any given application to be using a dramatically smaller subset of the standard. Well-engineered software is intentional about this and documents those limitations. Under these conditions it's perfectly valid to use a library that only supports this subset. Furthermore, those subsets have natural "fault lines", influenced by the burden:utility ratio. This makes consumers and producers naturally coordinate on a subset. It's not like another commenter here said about everyone needing different features. My argument is therefore that there is value in having different libraries for different subsets - with the smallest subset being much simpler than libxml2.
- fergie 1y agoIts a shame that xslt seems to be struggling so much at the moment. If xslt 3 support was fully implemented in libxml2 (and therefore xsltproc and browsers) then it would be by far the most sensible option for designing anything to do with getting text onto the web. * XSLT is still the only native templating option for HTML pages that runs natively in the browser (but just now you are limited to XSLT v1.0 which as a number of drawbacks and limitations) * XSLT/XML is still best at text markup. In particular interpolation. There is no simple way to represent marked up text in, say, JSON. * Content federation (atom, rss) is still very dependent on XML. Surely somebody somewhere has money to pay for a greybeard to fix XSLT for us? It seems far to fundamental to be left to wither on the vine.
- omcnoe 1y agoRather than struggling/withering, it's actively being killed. Efforts are underway to completely remove XSLT support from browsers, due to the poor state of libxml2 and a lack of any new maintainer stepping up.
- fergie 1y agoRight, but AKAIK its _still_ being maintained on a voluntary basis. Thats nuts, and its not clear why, say, Chrome or Firefox wouldn't want to take over XSLT/libsml2 development, particularly if they won market share from stuff like React, and created a developer acquisition pipeline for their respective ecosystems.
- omcnoe 1y agoThey don’t want to because they don’t see any bright future for the technology even if it’s better maintained. XML/XSLT isn’t trendy anymore, nobody is building new apps on it. It is never going to win market share from react - it’s too baroque and dated.
- epolanski 1y ago> It is never going to win market share from react Not sure what React has anything to do with this. XSLT was pretty much never used as a rendering platform but for XML-data processing. As JSON became the standard of API communication in early 2000s (less powerful, but also much less verbose and easier to manipulate in JS) XSLT became less relevant.
- kelvinjps 1y agoThis isn't the library or feature browsers wanted to drop? I think I saw a hacker news post about it
- MathMonkeyMan 1y agoThat was xslt, which is part of the xml toolset but not specific to libxml2.
- rurban 1y agoFor those cases I have an Invalid CVE tag. No need to worry too much on inbeciles