>[...] Incidentally, one of the Log4j maintainers’ GitHub sponsors profile is here, if you would like to contribute some money to his cause. [...] these companies should ponder which is more expensive: $100k/year salary for a maintainer of a project they are heavily dependent upon, I don't understand the logic of cause & effect the author laid out. Commercial software with well-paid programmer employees also have lon…
Coordinating with CSIRTS and the big security vendors, think WAFs, XDRs, etc., would allow the impact of a disclosure to be heavily mitigated.
It's kind of crazy that Apple has had the greatest visionary CEO of all time (Steve Jobs) while also having the greatest supply chain manager of all time (Tim Cook). It's no surprise that Apple is the most valuable company in the world and also the most beloved brand.
>[...] Incidentally, one of the Log4j maintainers’ GitHub sponsors profile is here, if you would like to contribute some money to his cause. [...] these companies should ponder which is more expensive: $100k/year salary for a maintainer of a project they are heavily dependent upon, I don't understand the logic of cause & effect the author laid out. Commercial software with well-paid programmer employees also have lon…
> Commercial software with well-paid programmer employees also have long lists of CVE/RCE including MS Windows, Azure, AWS, Adobe PDF reader, Oracle database, etc. Exactly that. What paying some dev for open source work does is give you more ways to influence the direction of the projects. It can help you to put priority on fixing bugs which affect you. But it can't magically make disclosure work better. Also I would…
If there is evidence that a vulnerability is actively being used by an adversary, sure, it’s more responsible to disclose sooner, but in general you want to take into account the fact that the vast majority of engineering organizations aren’t set up to patch and/or update on a dime, which means that if you disclose immediately you now have a window of time in which anybody with a pulse and an internet connection can exploit the vuln, which is why a 90 day disclosure period is usually practiced.
There is no reason to believe that money would actually solve the issue, and maybe even exacerbate it. The log4j issue is product debt, similar to the sqlite fts tokenizer exploit, and a lot of the openssl exploits, features that are rarely used, and are in the codebase for "no good reason" (from the majority of user's standpoint) I think the way to make for those things to happen less, is in fact, to code less, and…
Exactly. If we paid people to maintain log4j, they'd try to justify their existence by writing more code and shipping it in log4j. But log4j doesn't need more code to be secure, it needs dramatically LESS code!
The correct answer here isn't "pay people to make log4j even worse", it's "don't use log4j".
It's kind of crazy that Apple has had the greatest visionary CEO of all time (Steve Jobs) while also having the greatest supply chain manager of all time (Tim Cook). It's no surprise that Apple is the most valuable company in the world and also the most beloved brand.
I hope this post was sarcasm
I think it’s someone testing their blarghbot.
I’m all for pet projects on HN, but it’s getting annoying with what seems to be more and more of these garbage comments made by bots and scripts.
While contracts matter,relationships are also a thing - if you are donating and they are developing, you are funding development.
As a volunteer maintainer, if you want to donate money to one of my projects it’s because you find enough value in my work then you are free to do so to help continue development. If you want to donate money in order to exert some kind of control over how I spend my time, please keep your money.
NFTs are an ideal way for corporations to fund open source projects. When used as a fundraising tool by non-profit projects, they are a portable proof of contribution that confers status to the contributor, and thus incentivizes contributions.
Recently, they were used to raise millions for Ross Ulbricht's campaign for a sentence reduction.
>[...] Incidentally, one of the Log4j maintainers’ GitHub sponsors profile is here, if you would like to contribute some money to his cause. [...] these companies should ponder which is more expensive: $100k/year salary for a maintainer of a project they are heavily dependent upon, I don't understand the logic of cause & effect the author laid out. Commercial software with well-paid programmer employees also have lon…
> Commercial software with well-paid programmer employees also have long lists of CVE/RCE including MS Windows, Azure, AWS, Adobe PDF reader, Oracle database, etc. Exactly that. What paying some dev for open source work does is give you more ways to influence the direction of the projects. It can help you to put priority on fixing bugs which affect you. But it can't magically make disclosure work better. Also I would…
> What paying some dev for open source work does is give you more ways to influence the direction of the projects.
It also gives you assurance that the project maintainer is able to maintain that project full-time, and will not be otherwise occupied at $dayjob when a CVE arises. If a maintainer can only spend spare time on a project, its state can degrade pretty quickly.
NFTs are an ideal way for corporations to fund open source projects. When used as a fundraising tool by non-profit projects, they are a portable proof of contribution that confers status to the contributor, and thus incentivizes contributions. Recently, they were used to raise millions for Ross Ulbricht's campaign for a sentence reduction.
Why is a portable proof of contribution more valuable for a corporate donor than just having the corporate logo in the sponsors area of the website? If anyone bothers to verify that someone isn't lying about their donation they can go check.