A place to cache linked articles (think custom and personal wayback machine)
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

index.md 7.7KB

2 년 전
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129
  1. title: “Open Source” is Broken
  2. url: https://christine.website/blog/open-source-broken-2021-12-11
  3. hash_url: f57abf8bb9e96e5cb5cfe845d76729f5
  4. <p>or: Why I Don't Write Useful Software Unless You Pay Me</p>
  5. <p>Recently there was a <a href="https://www.lunasec.io/docs/blog/log4j-zero-day/">massive
  6. vulnerability</a> found in a
  7. critical Java ecosystem package. When fully weaponized, this allows attackers to
  8. coerce Java servers into executing arbitrary code that was fetched from an LDAP
  9. server.</p>
  10. <p></p><div class="conversation">
  11. <p class="conversation-chat">&lt;<b>Mara</b>&gt; If this is news to you and you work at a Java shop, I'm sorry but you have a
  12. long couple days ahead.</p>
  13. </div>
  14. <p>I believe this is a perfect microcosm of all of the major ecosystem problems
  15. with "Open Source" software. I have some thoughts about all this, as I think
  16. log4j2 is a <em>perfect</em> example of one of the worst case scenarios for this. It is
  17. perfectly reasonable for everyone involved in this issue to have done all this
  18. for perfectly valid solutions to real-world problems and this also to have
  19. created a massive hole on accident in the process.</p>
  20. <center>
  21. <p><img src="https://imgs.xkcd.com/comics/dependency.png" alt='the XKCD comic "Dependency", depicting all modern digital infrastructure being held up by some random project made by a thankless anonymous person in Nebraska.'></p>
  22. <p><a href="https://xkcd.com/2347/">XKCD #2347: Dependency</a></p>
  23. </center>
  24. <p>All software is made on top of the shoulders of giants. Consider something as
  25. basic as running an SSH server on the Linux kernel. In the mix you would have at
  26. least 10 vendors (assuming a minimal Alpine Linux system in its default
  27. configuration), which means that there are at least 10 separate organizations
  28. that still have bills to pay with actual money dollars regardless of the number
  29. of users of the software they are giving away for free. Alpine Linux is also a
  30. great example of this because it is used frequently in Docker contexts to power
  31. many, many companies in production. How many of those companies do you think
  32. fund the Alpine Linux project? How many of those companies do you think even
  33. would even THINK about funding the Alpine Linux project?</p>
  34. <p>I've had this kind of conversation with people before and I've gotten a
  35. surprising amount of resistance to the prospect of actually making sure that the
  36. random smattering of volunteers that LITERALLY MAKE THEIR COMPANY RUN are able
  37. to make rent. There is this culture of taking from open source without giving
  38. anything back. It is like the problems of the people who make the dependencies
  39. are irrelevant.</p>
  40. <center>
  41. <p><img src="https://christine.website/static/blog/5xi3x7.jpg" alt="A meme based on the Tim and Eric &quot;It's free real estate&quot; template contrasting the idea of open source software maintained by passionate developers with a heartless taking without giving attitude"></p>
  42. </center>
  43. <p>GitHub stars famously cannot be used to pay rent. An example of this is the
  44. <a href="https://github.com/zloirock/core-js/issues/767"><code>core-js</code> debacle</a>. <code>core-js</code>
  45. is a JavaScript library that gives JavaScript's standard library a lot of core
  46. primitives that can make you not need to reach out to other libraries. This
  47. library is also infamous for letting you know that the author is looking for a
  48. job every time you install it in CI. You probably have seen this message in your
  49. CI a thousand times:</p>
  50. <pre><code>
  51. <span>Thank you for using core-js ( https://github.com/zloirock/core-js ) for
  52. </span><span>polyfilling JavaScript standard library!
  53. </span><span>
  54. </span><span>The project needs your help! Please consider supporting of core-js on Open
  55. </span><span>Collective or Patreon:
  56. </span><span>&gt; https://opencollective.com/core-js
  57. </span><span>&gt; https://www.patreon.com/zloirock
  58. </span><span>
  59. </span><span>Also, the author of core-js ( https://github.com/zloirock ) is looking for a
  60. </span><span>good job :-)
  61. </span>
  62. </code></pre>
  63. <p>The author of the project is either still in prison for vehicular manslaughter
  64. or has just been released. <code>core-js</code> is a dependency of React. How many of you
  65. have actually donated to this project? Especially if you use React?</p>
  66. <p>Now let's turn our eyes to <code>log4j2</code>. This project is effectively in the standard
  67. library for Java users. This library is so ingrained into modern Java that
  68. you'd expect the developers of it would be well-funded and not need to focus on
  69. anything else but that library, right?</p>
  70. <p>No.</p>
  71. <center> </center>
  72. <p>As of yesterday, there were a grand total of three sponsors for this person's
  73. work. THREE. As of today, this number is now 14; however this is no excuse. This
  74. person should be funded in a level that is appropriate for how critical <code>log4j2</code>
  75. is used in the ecosystem. There is no excuse for this. This person's <em>spare time
  76. passion project</em> is responsible for half of the internet working the way it
  77. should. Vulnerable companies to this issue included Apple, Google, my cell phone
  78. carrier and basically everyone that uses JavaEE in its default configuration.</p>
  79. <p></p><div class="conversation">
  80. <p class="conversation-chat">&lt;<b>Cadey</b>&gt; Seriously, I could trigger some part of my cell carrier's infra reaching
  81. out to a DNS server with a specially crafted SMS
  82. message.</p>
  83. </div>
  84. <p>If <code>log4j2</code> is responsible for your company's success, you have a moral
  85. obligation to <a href="https://github.com/sponsors/rgoers">donate to the person who creates this library
  86. thanklessly</a>.</p>
  87. <p></p><div class="conversation">
  88. <p class="conversation-chat">&lt;<b>Numa</b>&gt; As for the problem that created this vulnerability in the first place: what
  89. where they THINKING when they allowed user-submitted untrusted strings to
  90. contain JDNI references that would then cause the JVM to load arbitrary bytecode
  91. into ram and then run it without having to specify that in the format string to
  92. begin with? Like why would you even need to do that in the <em>user-supplied</em> part
  93. of the format string? What would this even accomplish other than being a great
  94. way to get a shell whenever you wanted?</p>
  95. </div>
  96. <p>There is a friend of mine who has been thanklessly maintaining an online radio
  97. station stack for a long time. He has been abused by his users. Users will throw
  98. 5 bucks in the tip jar and then get very angry when he doesn't drop everything
  99. and fix their incredibly specific problems on a moment's notice. He has tried to
  100. get jobs at places, but every time they keep trying to screw him out of
  101. ownership of his own projects and he has to turn them down. Meanwhile the cash
  102. bleed continues.</p>
  103. <p>This is why I am very careful about how I make "useful" software and release it
  104. to the world without any solid way for me to get paid for my efforts. I simply
  105. do not want to be in a situation where my software that I develop as a passion
  106. project on the side is holding people's companies together. That's why I make
  107. software how and where I do. Like, no offense, but I really do not want to go
  108. unpaid for my efforts. The existing leech culture of "Open Source" being a pool
  109. of free labor makes it hard for me to want to have my side projects be actually
  110. useful like that unless you pay me.</p>
  111. <p></p><div class="conversation">
  112. <p class="conversation-chat">&lt;<b>Cadey</b>&gt; Okay, part of this may also be an ADHD thing and not really being able to stick
  113. to projects longer term.</p>
  114. </div>
  115. <p>TL;DR: If you want me to make you useful software, pay me. If you use software
  116. made by others in their spare time and find it useful, pay them. This should not
  117. be a controversial opinion. This should not be a new thing. This should already
  118. be the state of the world and it is amazingly horrible for us to have the people
  119. that make the things that make our software work at all starve and beg for
  120. donations.</p>