xign

That's definitely true. And a lot of times it could be a random open source project that is under the radar and rarely thought about. E.g. The Great Suspender Chrome extension which was sold to an unknown buyer which later turned it to malware: https://www.bleepingcomputer.com/news/security/the-great-sus...

I don't think it's strange to be honest. Like, if you make your code available under a permissive license like BSD, it's… permissive. Companies don't have a moral or ethical or legal obligation to contribute back. AWS saw an available software, and did what they do and packaged it up and offered a service. Does it suck for Redis? Sure. But they shouldn't have used BSD license to begin with. There's a reason why FSF spent so much time focusing on their license (not that I'm saying everyone should be using copyleft license).

A charitable interpretation is that Redis was being naive. A more realistic interpretation is that Redis knew a proprietary license would not have allowed it to be widely adopted, and that only a standard permissive license would have allowed it to be adopted, and now that it's popular they can force a change due to inertia on developers' side.

I just think something like Redis has no place being open source. And we should just be honest about it instead of beating around the bush. This whole "we will spend our R&D making a free software and make money on hosting" never had any legs because the obvious conclusion is someone can also make money on hosting your software without having put in the R&D work. If yet another new company comes to the market saying "we love open source" we should just be skeptical. The business model likely just doesn't make sense in the long run.

Pretty much. I think it's the whole virtue signaling and intellectual hand wavy dishonesty that really bugs me about these companies. They want to have the cake and eat it too.

Do companies like Apple say macOS is open source (I mean the entire OS, not just Darwin)? No. Some people are fine with it because we know this.

> The vast majority of the users don't need to do anything, and if they change [to any upcoming fork], it's for ideological, not licensing (concrete), reasons.

This is simply not true. Most normal users are not directly affected but this change, but if they previously used AWS to host Redis, they would now be affected. A big point of open source is that you can find competing hosts to give you the best service, but Redis would want it so that only they are allowed to sell hosting service meaning that you don't have competition. This directly affects users.

Also, it's important to note that Matt Asay works for MongoDB. His paycheck comes from a similar business model as Redis.

---

I think a lot of people are missing the issue here. Let me summarize my own take on this:

1. Redis is no longer open source under any reasonable definition (note that SSPL has very important distinctions from AGPL. They are not the same). And yet companies like Redis/MongoDB/ElasticSearch keeps trying to say they are "open source" and try to change the meaning of the term. It's virtue signaling without adopting the virtue. Lots of beloved companies are proprietary. They should just come out and say they are proprietary and be done with it.

2. Redis performed a rug pull. They previously released they source under BSD which is what attracted users and contributors, then once it became popular they changed the license (which they can legally do because they forced contributors to sign CLAs). Would contributors like Madelyn Olson (who works for Amazon) contributed to Reddis on her free time if it was under SSPL right off the bat? I highly doubt it. Redis knew that as a newcomer they had to parrot "we love open source" but once popular enough they can now force people to put up because of inertia.

I think it's fine to be proprietary, but I would trust a company much more if they don't try to change it midway through, or keep saying BS like how they still embrace open source (which is intellectually dishonest).

I'm not confused about it. I never said Collin is legally liable to help. I'm talking about societal obligations here. Just because you do something for free doesn't mean your actions don't have consequences.

Jia Tan is absolute a possible real name. Most people commenting on this topic aren't even Chinese native speakers lol. Each pinyin can map to a lot of different Chinese characters because they are missing the tone of the character anyway.

Tan is a real Chinese surname, and could be mandarin or hokkien.

Either way the name is likely made up. Obviously the attacker wasn't going to just use their real names.

The stealing part is related because in this case, his project is "stealing" (or injecting a backdoor"). Does that make the analogy clearer?

To be exact, he didn't do it specifically, but the non-profit is usually locked but he unlocked the door to let someone in and that person ended up stealing from the non-profit.

I really don't understand why people do not see that if you cause a giant mess, you have some responsibility to clean up after yourself. Again, I'm not saying that they should be obligated to do work. But this isn't "working". This is cleaning up an issue that you have caused.

> No. No one forced the society to use the work that somebody was doing for free. And if society decided that it's fine to use it, it's on the society to take the associated risks. Everything else is a good will of the maintainer.

If I voluntarily baked a cake for you for free because I was nice and I mistakenly poisoned you, would you say "Oh i decided to take the risk of eating your cake anyway, not your fault"?

I didn't have to bake the cake. But since I decided to, I have basic obligations including not putting poison in it.

I think in a centralized environment (workplace), it could be argued that immediately triggering all the build failures and having good hygiene in cleaning them up is actually not a bad thing. It really depends on how that's set up.

And how is sparse checkout worse for discoverability? With multiple repos it's even harder to find what you want sometimes if you are talking about 100's of random repos that aren't organized well.

I'm sorry but no. If you are responsible for the worst backdoor in recent computing history (which is probably a criminal act in nature), then you do have a responsibility to explain what went down. Maybe he can take a couple days to write it but I think more than that would be irresponsible. Collin is partially responsible because he gave the keys to Jia Tan. I don't want to burn him at the stake since he's a victim too but I think it's reasonable to expect him to help clean up this mess and at least help us fill in the gaps and understand what happened.

Think about it this way. Say you are volunteering for a non-profit. You obviously don't have to do it and could just chill at home instead. But once you have agreed to say take a volunteer shift on Saturday, you are obligated to show up. Obviously no one can really stop you from skipping, but it would look bad on you and may get you banned from the non-profit. Along the same token, you obviously shouldn't steal from the non-profit, or say randomly beat up the customers/clients. If you accidentally set the building on fire which ends up killing 5 people, I would also assume you would help in some fashion to clean up.

Just because you are doing things for free does not mean you don't have social responsibility for your actions. You don't have to work, but just saying "oh my software ends up compromising everyone's computer? sorry not my problem" is seriously misunderstanding your role (I'm not saying that Collin is doing that). Similarly, if I just randomly slapped you in the face, I might have done it for free, but you would also probably be pretty pissed at me and expect an apology.

Just want to point out that this isn't a typical "demand underpaid open source developers to work 24/7" issue here. This is a unique circumstance where his action has directly resulted in this happening. I feel bad for him being guilt-tripped to add a maintainer after reading through the old threads two years ago, and as I said I don't want to burn him at the stake, just saying that saying he has no responsibility to help at all is really a bad take.

There are a lot of bad to terrible takes here, ranging from hindsight 20/20 to borderline discriminatory:

3. The issue here has more to do with the generated tarball doesn't match source. You (i.e. distro owners) should be able to generate the tarball locally and compare with the generated artifact and compare. Autotools is just a scapegoat.

4. xz is used in a lot of places. Reducing dependencies is good, but trying to somehow say this is all systemd's fault, for depending on liblzma is not understanding the core issue here. The attacker could have found another dependency to social engineer into, or find a way to add dependencies and whatnot. It's very easy to say all these stuff in hindsight.

5. Again, I agree with you on principle that dependencies and complexity is a big issue and I always roll my eyes when people bring in 100's of dependencies, but xz is a pretty reputable project. I really really doubt someone would have raised an issue with adding liblzma or think that the build script would introduce a vulnerability like that. Again, a lot of hindsight talking here, instead of actually looking forward to how something like this could realistically be prevented. Too many dependencies are but it's not suddenly everyone will write their own compression libs.

6. Again, I mean, I don't disagree with you on principle but that is not the lesson from this particular incident. This may be your pet peeve but it wasn't like the integration with libsystemd would have raised anyone's alarm.

8. This is just a thinly veiled way of saying "don't work with anyone of Chinese descent". I don't want to use the R word but you know exactly what I mean. There's no evidence Jia Tan is Chinese anyway, or that this is done by China. We simply don't know right now, and as far as we know they could have used any western sounding name. The core issue here is that the trust was misplaced, and the overworked maintainer didn't try to make sure the other person is a real one (e.g. basic Googling). So what, if you don't work with any Chinese, if someone is called "Ryan Gosling" you automatically trust them?

---

I do agree with point 7.

That's not what the above commenter said. This may be your interpretation but the above commenter is essentially saying "don't work with Chinese-sounding developers" and is the completely wrong take here. Jia Tan may or may not be Chinese but the core issue is the lack of basic vetting to make sure he/she/they are a real person.

I don't think it's crazy for a maintainer to Google the person a bit, and if there is no positive match, ask the other person for at least a little bit of detail about themselves, like where they live (country/city), who they work for, etc. Maybe hop on a phone call or something.

In this case, Jia Tan just doesn't seem to match any real person we can find online. It's not like there's an elaborate online persona that they have really built.

While I don't want to put Lasse Collin on trial since he's a victim too, I do think he owes the community an update and explanation of what went down. It's not because we want to point fingers at him, but to learn from the experience.

IFUNC is arguably not the real issue. IFUNC was used to create a function that will be called on library load (since you need a resolver function to decide which function to map in). There are other ways to create "callback on library load" as well. I think ifunc was actually used for obfuscation instead. Jia Tan created a somewhat plausible scenario of using ifunc's to select which CRC function at load time to use for performance reasons (whether that actually increases performance is arguable but at least plausible). The malicious version swapped the resolver function to be a malicious one but either way it's just a way to create a function that can be called on library init.

The actual hook for intercepting the call was done via audit hooks.

So I guess it's really two things working together.

"Jia Tan" was not a contributor, but a maintainer of the project. The key point here is that this is a multi-year project of infiltrating the xz project and gaining commit access.

In a large tech company (including ones I have worked at), sometimes you have policy where every change has to be code reviewed by another person. This kind of stuff isn't possible when the whole project only has 1-2 maintainers. Who's going to review your change other than yourself? This is the whole problem of OSS right now that a lot of people are bringing up.

I maintain a widely used open source project myself. I would love it if I could get high quality code review for my commits similar to my last workplace lol, but very very few people are willing to roll up their sleeves like that and work for free. Most people would just go to the Releases page and download your software instead.

FWIW Metal is actually easier to use than Vulkan in my opinion, as Vulkan is kind of designed to be super flexible and doesn't have as much niceties in it. Either way, OpenGL was simply too high level to be exposed as the direct API of the drivers. It's much better to have a lower level API like Vulkan as the base layer, and then build something like OpenGL on top of Vulkan instead. It maps much better to how GPU hardware works this way. There's a reason why we have a concept of software layers.

It's also not quite true that everyone uses Unity and Unreal. Just look at the Game of the Year nominees from The Game Award 2023. All 6 of them were built using in-house game engines. Among indies there are also still some amount of developers who develop their own engines (e.g. Hades), but it's true that the majority of them will just use an off-the-shelf one.

I mean, GitHub is still by far the most open source friendly repository hosting service by orders of magnitude. I wish we have code search back for anonymous GitHub use as well, but the simple fact is there isn't another service that comes close to providing free service to open source software. Now, I know that GitHub built its reputation on hosting open source software so it's probably not fair to compare other services like BitBucket or GitLab to it, but I'm not sure what people are thinking they can divest to.

Even if your open source code is on GitLab they can still be used to train Copilot. Most permissive license allows you to train AI models using them. Any license that forbids AI training would not be considered "open source" under most definitions.

Being on GitHub just makes it easier for them as they don't need to manually clone it from a different service.

To be fair, GitHub still has vast majority of features available as public anonymous API end points other than code search. It's just that they are rate-limited a lot more aggressively. And making a GitHub account is free and not terrible intrusive. Even then, all APIs are rate-limited even if you are logged in anyway as they don't want you to kill the servers (that's why tools like https://gitstar-ranking.com/ have troubles because they are relying on free accounts to scrape all repos' GitHub stars).

As for the actual important data (source code), you can simply clone the repo anonymously using HTTPS endpoints, and do your code search there (e.g. there are third-party websites like https://grep.app/ that can do this).

The issue with say Reddit/Twitter is that the source data (posts/comments/upvotes and tweets) is no longer available via APIs, making it impossible / hard to build third-party tools. With GitHub, the source data is still easily accessible, with search (the auxiliary layer) disabled for non-logged-in users. I think they are quite different situations and mixing them together is not useful.

What's not technical about it? It tells you what the new advancements in the M3/A17 GPUs are, what you should look out for, and how you can take advantage of them. It provides enough information so you can understand what technical tradeoffs you need to make when you target M3 / A17 GPUs. E.g. Register pressure is a real concern in large shaders, and this helps explain how the behavior would be different under a dynamic allocation scheme. It explains how the ray tracing acceleration works, and how it reorders the different intersection calls and how you should avoid intersection queries.

There are some hyperbole interjected about how incredible the performance is but that's only in between the useful data. (I did chuckle at the… enthusiasm of the speaker though)

This isn't a technical document for GPU designers. Apple doesn't really need or want you to understand exactly how the implementation works because that's basically trade secret for them. This is aimed at letting app / game developers know how they should optimize for the new GPUs, since previously Apple just made some ambiguous remarks about some of these new technology ("Dynamic Caching") without explaining what they meant.

But yes, I do like how the Asahi folks tend to end up documenting a lot of how these hardware works, but they also only have public information like this to start from so these are still useful info to have for them.

Wow, I'm impressed by your numbers. Because mine is 0%… :(

It's really disheartening when you try to file proper bug reports, with proper reproduction steps, my own investigative work and more details of it, etc. Then… silent. As if the app just outputs the bug to /dev/null or something.

Yes and no. If you are making a macOS app and want to distribute your own binary (meaning not via the App Store), you are basically doing everything yourself and not using Apple's network. You still have to get a developer account because that's how you 1) get a valid developer signature, and 2) get access to app notarization service. Both 1 and 2 are now mandatory unless you force your users to jump through a lot of security hoops to open your app.

I maintain an open source macOS software and begrudgingly signed up for a developer account since I didn't want my users to have to suffer through the security settings screen. At least I got a donation program up a few years later so at least I'm not paying out of pocket anymore. Some of my peers/competitors (open source text editors) are still not signing their app (since they didn't feel like getting this sorted out) forcing users to have to go through the security settings which I think is a crappy situation.

Yeah, he kind of seems like the only guy who cares as someone looking from the outside. There are a lot of technology details where you need to dig up some random Apple Developer forum post from him just because Apple sucks at documenting some of their technology.

Stepping back, I kind of feel like Google is abusing their power. Seems like they literally print money by issuing new TLDs every other month or so, for doing… not much. Are people really asking for these TLDs, like .zip and .mov? Some of them almost seems like an extortion where you are forced to protect your brand by buying up relevant domains.

Websites are still super relevant, especially for more serious / professional usages, or in random circles like gaming (since PC gaming is a thing that refuses to die). Domains are still the primary way you get to control your web presence, and websites are still easier to spin up than apps while providing much more flexibility and control.

I do think it depends on what kind of sites you are building. If it's say a recipe website, sure people will just Google it and click on a link. But for websites with a specific purpose I think a easy-to-remember or at least a not-sketchy looking domain name still has some values. Some random examples: wikis (which actually have a .wiki TLD now), professional tools like Figma, a service that you want to sell, or let's say a social site like Discord, I feel that having a clean domain name still makes a difference. I don't know if anyone will ever be able to quantify it though.

E.g. I have been following gaming tournaments, and a lot of them are hosted on start.gg. I find that I can definitely remember it much easier than otherwise and I don't want to use an app for something like that, nor do I feel like bookmarking it.

(Note: To be fair though, start.gg is using a country-TLD and I personally have a distaste of abusing country TLDs like .gg/.io/.ly/.tv/etc but that's another story)

Can you explain what you mean by "patch stack"? I can roughly guess what you meant but not sure. Do you mean rebasing changes while to preserving the diffs of what you were reviewing? (I find that essentially no Git service I have used does this well)

Personally I think I got used to Git since it's 99.99% of what I use today. There are definitely pain points to it, but just like most people it's kind of become "the way it is", which I don't think is healthy. While Git has helped revolutionized the way SCM works, it's far from perfect (and it still does certain things worse than a traditional centralized SCM like binary file management and renaming files), and I think its prevalence sometimes puts people in a collective blindspot/groupthink. Imagine if you are in your 20's and Git is the only SCM you have used, everything other than Git would either be old-school or weird.

I definitely agree on GitHub though. I think it's quite nice for small projects (I manage one myself) but I don't see how it's usable for a serious large software project for reasons you mentioned. Even simple things like correctly linking issues together, or code review tools just seem severely lacking to me.

Those are two separate things though. C is more vulnerable than Rust, but either way we should properly sandbox our applications even if they are written in a memory-safe language like Rust (which is not infallable, it's just safer).

One issue is if cURL is allowed to write to "one or more files", then how do you prevent it from writing to a key configuration file or sensitive one that has a lot of downstream effect or write a Bash script that could launch further attacks?

That blog post is talking about something else though. He's saying that the CVE system does not do a good job and allows for people who drums up severity for drama. That is just a generic issue he has with the procedure. You can have severity written in C to JavaScript to even Rust, or just simple configuration mistakes. That's not what he's complaining about.

In fact, him saying that this vulnerability is high is part of the point. If every single bug or vulnerability is a "high" severity bug, then nothing really is. It's only when you use this rating when it makes sense to that it would have the proper impact.

I don't think the comment above you is a valid perspective considering that it does not appear to be a 0-day vulnerability and there is no evidence of it being used in the wild. The information he provided is IMO not enough to craft an exploit out of. Yes, now there is a giant bullseye on cURL and maybe the bad guys will start looking hard at it, but cURL has always been a widely distributed software that needs to interact with the unsafe world (the internet), so I would imagine attackers have been looking at it for a while already. So far he hasn't revealed critical information such as when the vulnerability was introduced and exactly what area it affects, which would have helped a potential attacker narrow down the scope.

So I think it's just fear mongering to say suddenly people will craft exploits because of this notice. Like, if they are so good at finding the exploit then they probably would have found it a long time ago already given the lack of useful intel here.

Fair enough, but it was never a problem because most software like Terraform would not have been open source to begin with in the good old days. So in a way yes, what you said is true, but I don't think the takeaway is "open source used to work just fine", but rather "sometimes a non-open-source license is really what works in this scenario".

WebKit already added support for it if I remember correctly. It's just not on Safari so to speak since it uses the macOS stack for this, so it needs the OS itself to adopt it, but Apple was clearly interested in it.

And web browsers aren't the industry. Adobe added support for it, for example, and it didn't really seem like Google did a good-faith discussion with actual industry players, who range from content creation software to OS makers to other web browsers.

It's also not like there are people lining up to use AVIF right now and Google is still pushing for it.