Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open Source is one person

opensourcesecurity.io

Post reply on HN
Print view View original

91–100 of 184 posts

Re: Open Source is one person

#91

Post by spott »

chamomeal wrote: post #78
kube-system wrote: post #19

Earlier quoted context omitted.

> The DoD is a huge organization That's an understatement if there ever was one. https://en.wikipedia.org/wiki/List_of_largest_employers

Woah that’s insane, I didn’t realize it was THAT big. And that’s not even counting the zillions of contractors and consultants. I live in the DC area and I know a ton of people who work for places that contract for the DOD, and only like 2 people who actually work there

That is including all us military personnel, which puts it into perspective a bit.

Re: Open Source is one person

#92

Post by ozim »

kube-system wrote: post #25

I feel like there's a lot of misunderstanding of this issue in the software community, because primarily, supply chain risk isn't a software or engineering issue. It's a governance issue. Someone doesn't have to be a bad actor for a project to have supply chain risk. Nor do all who evaluate supply chain risk have the same security posture and evaluate risks the same as others might. The DoD likely has a very differen…

Yet still hype leads people to believe in single proprietor billion dollar software companies are just around the corner.

Re: Open Source is one person

#93

Post by ivanjermakov »

Too bad the notion of completed/finished/done software is very weak. In theory, there it nothing wrong with an OSS project made by one person.

I would like to see the LOC these one-person projects with >1M downloads have. I suspect most of these are a simple Node/browser/OS API single-file wrappers that are simple to get right and treat it as complete.

At the same time such projects are easy to verify upon adding as dependency. Lately, I've just copy-pasted relevant parts of a library to my project because adding it as a dependency has a cost. I doubt this is a common practice though, especially in NPM land.

Re: Open Source is one person

#94

Post by conartist6 »

kube-system wrote: post #81
conartist6 wrote: post #75

Earlier quoted context omitted.

Doesn't change the fact that they can just fork it if it ever matters though...

You're missing the point of a supply chain risk assessment. Yes, you can fork a project to maintain it yourself. But, for an organization to do this, they need to allocate resources, e.g. time and money. This is part of the risk you are assessing for in a supply chain risk assessment.

The risk quintuples with no lock files. And the number of maintainers is often not as important as the number of other users who are also putting eyes on the code

Re: Open Source is one person

#95

Post by oblongdefeat »

nickjj wrote: post #84
didgetmaster wrote: post #49

Has anyone seen any stats on what happens to a single maintainer project when said person is hit by a bus (or meets some other demise)? With that many data points, there should be enough of them by now to study it. Is the project taken over by another, single developer? Is it replaced by a similar project? Does it just go away?

Here is one data point. I bought ASIO Link Pro (software) something like 10 years ago to help route virtual audio devices on my system. The author sadly died and eventually the license key server went offline rendering it unable to start. His nephew looked into it and eventually made the tool free after a year or 2. I stopped using it after the license server went offline because I still had to record videos. I ended…

Not sure if you know or not, or if it matters anymore, but someone eventually made a fix for this.

https://github.com/DirkoAudio/ASIOLinkProFIX

I've been using it for over a year on Windows 10 and it works great.

Re: Open Source is one person

#96

Post by munificent »

conartist6 wrote: post #75
moron4hire wrote: post #73

Earlier quoted context omitted.

I don't know where you're working, maybe you work in some secret lab where everything is air-gapped and not even the pigeons are allowed within a mile of the facility. In which case, what the hell are you doing commenting on a public message board? That is absolutely not how DoD works. The vast majority of code is contracted out. Nobody from DoD side is reading any of the code. It's all a series of affidavits and aud…

Doesn't change the fact that they can just fork it if it ever matters though...

By the time you know it matters, it's too late. And if it's not too late, you don't have enough data to know which of the thousands of packages you depend on should be forked and which shouldn't.

Re: Open Source is one person

#97

Post by codazoda »

nickjj wrote: post #84
didgetmaster wrote: post #49

Has anyone seen any stats on what happens to a single maintainer project when said person is hit by a bus (or meets some other demise)? With that many data points, there should be enough of them by now to study it. Is the project taken over by another, single developer? Is it replaced by a similar project? Does it just go away?

Here is one data point. I bought ASIO Link Pro (software) something like 10 years ago to help route virtual audio devices on my system. The author sadly died and eventually the license key server went offline rendering it unable to start. His nephew looked into it and eventually made the tool free after a year or 2. I stopped using it after the license server went offline because I still had to record videos. I ended…

I suspect this is the case for the majority of open source software. I have a handful of tiny projects. I don't think anyone will keep them alive after I die. But I guess we should make a distinction based on popularity or something. My top four projects have only 675, 363, 122, and 96 stars.

Re: Open Source is one person

#98

Post by msgodel »

vitonsky wrote: post #11

Huh, I just checked stats on ecosyste.ms It looks they consider as maintainer only those people who listed on package.json, not a real number of contributors on github or anything. So all conclusions in this post is based on wrong assumption and incorrect data interpretation. That's all you need to know about it. I think you could list random people on github in your package.json to looks cool in eyes of stats cultis…

Maintainers and contributors have overlapping but subtly different responsibilities AFAIK.

Maintainers are the ones responsible in the end for the state of the repo while contributors suggest changes.

Re: Open Source is one person

#99

Post by socksy »

kube-system wrote: post #28
ysofunny wrote: post #17

Earlier quoted context omitted.

software once "perfected" (working well enough long enough) needs NO maintenance. No cleaning. No calibrating/tunning. updating is a systemic issue, not a per-project matter

Under a microscope, maybe. But if you had a "perfect" piece of software that used Log4j in 2020, it wouldn't have been perfect for long. Unfortunately, there's a lot of reasons that software needs maintenance, even if it was thought to be perfect when it was originally written. Hardware changes. The software landscape changes. Dependencies are deprecated, or are found to have their own problems. Vulnerabilities are d…

Plenty of Clojure projects are "done" (the only community I'm aware of that actually believes in this) that presumably specified the vulnerable log4j versions. In reality, it's not an issue, because you can deal with it in your own deps.edn/project.clj/maven.xml, by excluding the dependency, or overriding it with a newer one.

Re: Open Source is one person

#100

Post by saadatq »

gausswho wrote: post #53
didgetmaster wrote: post #49

Has anyone seen any stats on what happens to a single maintainer project when said person is hit by a bus (or meets some other demise)? With that many data points, there should be enough of them by now to study it. Is the project taken over by another, single developer? Is it replaced by a similar project? Does it just go away?

I would love to see a diligently researched episodic series, every episode covering the transition of a popular open-source library/tool/app/site from one maintainer to the next. And that's why I don't run Netflix.

You should pitch this to David Gelb / whoever is responsible for Chef’s Table on Netflix
Post reply on HN