Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open Source is one person

opensourcesecurity.io

Post reply on HN
Print view View original

81–90 of 184 posts

Re: Open Source is one person

#81

Post by kube-system »

conartist6 wrote: post #75
moron4hire wrote: post #73

Earlier quoted context omitted.

I don't know where you're working, maybe you work in some secret lab where everything is air-gapped and not even the pigeons are allowed within a mile of the facility. In which case, what the hell are you doing commenting on a public message board? That is absolutely not how DoD works. The vast majority of code is contracted out. Nobody from DoD side is reading any of the code. It's all a series of affidavits and aud…

Doesn't change the fact that they can just fork it if it ever matters though...

You're missing the point of a supply chain risk assessment. Yes, you can fork a project to maintain it yourself. But, for an organization to do this, they need to allocate resources, e.g. time and money. This is part of the risk you are assessing for in a supply chain risk assessment.

Re: Open Source is one person

#82

Post by 0cf8612b2e1e »

em-bee wrote: post #72
0cf8612b2e1e wrote: post #65

Earlier quoted context omitted.

leftpad was a minuscule project that could have been created by anyone. Yet its deletion caused chaos. There are certainly load bearing projects of moderate complexity that are still single person efforts.

right, but the problem here was the deletion of the module, not the disappearance of the maintainer. in the later case the module would have remained, and if it would stop to work because of some incompatibility in a future js, people would replace it

You could also imagine leftpad was using some security compromised library (eg log4j). If the project is of moderate complexity and there is nobody behind the wheel to maintain it, what happens to the ecosystem?

Re: Open Source is one person

#83

Post by ARandomerDude »

kube-system wrote: post #19
lantry wrote: post #16

Earlier quoted context omitted.

The DoD is a huge organization, so I'd guess they use almost everything.

> The DoD is a huge organization That's an understatement if there ever was one. https://en.wikipedia.org/wiki/List_of_largest_employers

I think I'm even more amazed that Walmart has almost as many employees as the DoD.

Re: Open Source is one person

#84

Post by nickjj »

didgetmaster wrote: post #49

Has anyone seen any stats on what happens to a single maintainer project when said person is hit by a bus (or meets some other demise)? With that many data points, there should be enough of them by now to study it. Is the project taken over by another, single developer? Is it replaced by a similar project? Does it just go away?

Here is one data point.

I bought ASIO Link Pro (software) something like 10 years ago to help route virtual audio devices on my system. The author sadly died and eventually the license key server went offline rendering it unable to start. His nephew looked into it and eventually made the tool free after a year or 2.

I stopped using it after the license server went offline because I still had to record videos. I ended up solving my problem with hardware, but that tool was extremely helpful when I used it for years. It was around $40 at the time. It's one of the few pieces of software I've purchased and felt really happy about it.

Re: Open Source is one person

#85

Post by dzonga »

the west or those with largely liberal viewpoints who think in black and white vs seeing the world as grey are gonna cost the west a lot.

we already saw this - with 'cancel' mafia.

because russia or i.e putin invaded ukraine doesn't mean the whole russia is bad. or you shouldn't interact with russia at all. no one stopped interacting with usa after they invaded iraq.

just because russia doesn't give a shit about lgbtq rights doesn't mean russia is a bad country. likewise just because china runs an explicit authoritarian system - it doesn't mean its a country - china bad.

trump and his idiotic gvt kinda recognize this - but they're also doing it the wrong way.

anyways - trade with enemies / friends alike as long as they're benefits to be realized.

Re: Open Source is one person

#86

Post by jampa »

didgetmaster wrote: post #49

Has anyone seen any stats on what happens to a single maintainer project when said person is hit by a bus (or meets some other demise)? With that many data points, there should be enough of them by now to study it. Is the project taken over by another, single developer? Is it replaced by a similar project? Does it just go away?

Unless something changes in the underlying infrastructure, most packages don't need active maintenance after achieving their objective.

If there is a major change (e.g., Python 3, React Native new arch), they are replaced/forked.

Re: Open Source is one person

#88

Post by jandrewrogers »

conartist6 wrote: post #70
kube-system wrote: post #25

I feel like there's a lot of misunderstanding of this issue in the software community, because primarily, supply chain risk isn't a software or engineering issue. It's a governance issue. Someone doesn't have to be a bad actor for a project to have supply chain risk. Nor do all who evaluate supply chain risk have the same security posture and evaluate risks the same as others might. The DoD likely has a very differen…

Huh? The DoD would not have used the package if they hadn't read every line, locked it down for updates, and were ready to patch it themselves if needed. Can you really imagine in a war they'd be like "damn, if only there were a second person we also don't trust at all to do this work for us cause otherwise we'd just be SOL"

It mostly doesn't work like that even for closed source in DoD. They have to weigh the risk against the very high cost of mitigating the risk. Their resources are large but not infinite.

Even if they trust the developer they may not trust their process. There are many cases of trusted developers having their development environments compromised such that bad actors were able to insert modifications into source trees, in commits signed by the developer. Most code is not developed in anything remotely resembling a high security context.

Re: Open Source is one person

#89

Post by rs186 »

ysofunny wrote: post #17
blueflow wrote: post #4

If they had done an activity check they would have seen that half of all projects have zero maintainers.

software once "perfected" (working well enough long enough) needs NO maintenance. No cleaning. No calibrating/tunning. updating is a systemic issue, not a per-project matter

LOL. As soon as Python 3.8 is deprecated/replaced by Python 3.9+ in most systems, python packages that depend on old APIs become useless until updated. Any half decent software engineer understands this.

Re: Open Source is one person

#90

Post by spott »

marssaxman wrote: post #69
ii41 wrote: post #42

Earlier quoted context omitted.

I was once forced to use older (but not deprecated) LTS Ubuntu and I hated it. New software come out and you're gonna want to use them (often forced to use them), and they of course use newer dependencies. I had to do the distribution maintainer job and package a bunch of software myself.

What sort of work do you do? I only use LTS distributions, and this is not a problem I have encountered, so I wonder what accounts for the difference in our experiences.

I think this depends on how they are used.

If you are leaning on the package manager for managing things like Python, then they are really annoying.

If you are just skipping that and using something like UV, then you won’t care that LTS only has python 3.9 or similar.

If you are trying to use them interactively, then they can be annoying because everything new isn’t available. If you are using them as a server for running pre-packaged code, then they are fine.

Post reply on HN