Hacker News Reader

Comment by di4na | Hacker News Reader

Author here.

You do realise that the main source of dangerous vulnerability is low level infrastructure that do not come from these package managers ? The purity and capabilities sadly solve nothing when the source of the problem is the fact that NTP, OpenSSL, OpenSSH, the BGP daemon, the libc you run on, etc are all maintained and "fixed" and evolved by people that can barely pay for their food, even less for basic tests ?

Like i love capabilities and i would love to have more, but the basic problem here is that the low level that you totally depend on for the capabilities to work cannot even be funded to work.

Hell you do realise that Autoconf has not had a maintainer since 2012? If it was pwned and had injected backdoor in your software since then, we would have noone to fix it.

View on HN

nonsense.

autoconf didn't have a core developer. But it had many distro package managers.

there's nobody adding code/fixing bugs, but there are plenty people reading and looking at diffs before packaging it in distros.

then the js libs have neither core maintainers nor anybody at npm corp that cares about security or reading anything.

the top comment is correct to care about those before system libraries.

I don't agree. When there's a problem in OpenSSL, OpenSSH, or libc, nearly every company with an online presence has as freak-out and rushes to patch.

When there's a vulnerability or malware found in a python or npm package, 75% of the tech world does a quick audit (or not), shrugs, and goes on with their day.

Why the weak words? "reading", "looking" is not "understanding".

IANADev, but surely if they were going as deep as understanding patches they'd practically be a project maintainer rather than a package maintainer. Expecting package maintainers to have even reviewed diffs seems like high expectations. I wouldn't expect them to do more than the actual packaging.

Weak words seem appropriate.

I've hacked together a couple of packages for personal use but didn't even go so far at to look what language the code was in. I'm assuming a lot of packages from ppa-s are produced in an automated way with no code review, and depending on your distro that might also be true of some principal libraries.

> NTP, OpenSSL, OpenSSH, the BGP daemon, the libc ... by people that can barely pay for their food

I think those used to be national or telco lab projects in 60s-80s. The values created are hard to exploit and to capitalize. Perhaps it's a policy problem.

Yeah, I think that's the most viable solution to this problem. The US federal govt should fund software projects that are widely used. It's good for our national security, and it facilitates economic growth.

This could either be grants to maintainers, grants to software nonprofits like linux foundation, or some kind of national software lab that employs people to maintain and audit open source software (or ideally, all of the above)

They would not pay non-USA citizens, and the NSA would be asking for backdoors.

OpenSSL was at various times prior to 2014 maintained by a gamer guild, and by nobody.

> when the source of the problem is the fact that NTP, OpenSSL, OpenSSH, the BGP daemon, the libc you run on, etc are all maintained and "fixed" and evolved by people that can barely pay for their food, even less for basic tests ?

My take: I suspect that (perhaps a majority) of us here have a distant and abstract understanding of long-term poverty (eg:hunger on the table for years at a stretch). I'd offer that even the memory of real poverty doesn't equate with presently living in a long state of active poverty.

Translating across that gap is hard.

note: I'm not socially critiquing HN here. I am opining that survivor bias may be in play, however.

> are all maintained and "fixed" and evolved by people that can barely pay for their food, even less for basic tests ?

I suspect many people working on OSS are getting paid, if not handsomely, then enough to survive.

I would be surprised if they even get a thank you per 1,000 users.

I advise you to go read the Road and Bridges report i linked in the blogpost.

As of today, the reality is not at all. As I mentioned elsewhere there are zero maintainer of autoconf since 2012, even less one well paid.

Log4j devs took unpaid time off to fix it.

OpenSSL dev lived for years with less than 10k per year.

> there are zero maintainer of autoconf since 2012,

Paul's work doesn't count?

Reply on news.ycombinator.com