6 ms·

If information security people would spend the same amount of time they are spending complaining about this vulnerability trying to educate their organisations

If information security people would spend the same amount of time they are spending complaining about this vulnerability trying to educate their organisations on the importance of supporting open source solutions they depend on we wouldn’t be in this situation. I am sick of reading of very senior people complaining about the impact this vulnerability has had on their week when their companies don’t even contribute a penny to open source projects.

jeffbee 5y ago
I'm baffled by these claims that we should compensate the authors and maintainers of what has been conclusively shown to be software too dangerous to exist. It has the same problem as calls to pay the maintainers of openssl. No amount of money is going to impart good taste and best practices onto these projects. The uncomfortable truth is these libraries need scratch rewrites with better authors.
- pclmulqdq 5y ago
  The unfortunate thing about scratch rewrites is that they are not a good business. Open Source has conditioned people to think that libraries should be free. It's not clear to me that the alternative where libraries are obscenely expensive (like in the hardware world, where a hash table is a $100k investment) is any better. Nobody has ever built a successful company charging between $0 and $10,000 for a library. That is just how people see things, and unfortunately it is extremely hard to change.
  - tjalfi 5y ago
    Some platforms have reasonable markets for libraries; Advanced Messaging Systems[0], DevExpress[1] and Aspose[2] are three examples of companies that successfully sell software libraries for .NET, Java, and Office. [0] https://www.dimastr.com/redemption/home.htm https://www.dimastr.com/redemption/home.htm [1] https://www.devexpress.com/ https://www.devexpress.com/ [2] https://www.aspose.com/ https://www.aspose.com/
- TingPing 5y ago
  OpenSSL at least has significant value, handling logs is usually an easy task.
- RHSeeger 5y ago
  Saying things like "I don't like this software because <concrete reason>" is reasonable; it can be considered constructive criticism, especially if you include a way it could be done better. Heck, even just "I think it's too complicated to use, and the underlying code base needed to support that complexity lends itself to bugs that can be exploited" would be better. Saying things like "No amount of money is going to impart good taste and best practices onto these projects" is insulting the people who wrote it with no real basis. It's not helpful and it makes you (and some other people in the thread) sound like a jerk.
  - def_true_false 5y ago
    If only being nice to people prevented security bugs, eh?
    - virtual_void 5y ago
      Are you proposing that being rude does?
      - deleted 5y ago
        [deleted]
- samhw 5y ago
  > The uncomfortable truth is these libraries need scratch rewrites with better authors. If that's true, do you think that having money might possibly be helpful to that effort?
  - ksaj 5y ago
    One of the maintainers in question holds two jobs to live. Having money might allow him more time to test and retest and update the software more expediently.
    - samhw 5y ago
      Sorry, I was posing that question semi-sarcastically. I agree it's blindingly obvious to any sensible person that money would help immensely. However, sadly, there are apparently plenty of people who are just about sensible enough to be able to get out of bed and navigate to this site, but not sensible enough to understand much else.
  - dwaite 5y ago
    That wouldn’t be funding log4j2 though (from the ‘better authors’ part). That would most likely be an internal effort (devs you trust) published as a new open source logging framework in a sea of existing ones.
  - staticassertion 5y ago
    Honestly, absolutely not, and I think money would be harmful. Lots of software doesn't need a lot of work. It can be simple. When people get paid to solve problems there's an incentive to add more code, to add new domains, etc. Use the standard java logger and move on, it's that easy.
    - tekknik 5y ago
      Where’s my incentive to work the weekend supporting a project after a long week of supporting my production code? If we want solid and secure OSS, we gotta pay someone!
kzrdude 5y ago
Maybe we should tell them to engage with open source, not "support it". Companies should look for a way to spend work hours on open source, not finding someone to send money.
- throwaway19937 5y ago
  If it's an enterprise (https://zwischenzugs.com/2018/10/02/why-are-enterprises-so-slow/ https://zwischenzugs.com/2018/10/02/why-are-enterprises-so-s...) the latter will be a much easier sell to management. Paying for support is a given but contributing developer time will require many approvals from different departments if it can be done at all.
- l5ymep 5y ago
  Convincing project managers to tackle tech debt is hard enough. Contributing to open source won't even reach the middle ear unfortunately.
  - tekknik 5y ago
    Let’s not even get legal involved…
    - emn13 5y ago
      Don't worry, legal will answer a completely different question that's unrelated, but rests on a fundamental misunderstanding of the entire premise due to a combination of misinterpreting technical jargon as plain English and then misapplying a legal generalization, resulting in absolutely essential advice that needs to be followed immediately, which is couched in legalese that the techs will proceed to misunderstand by misinterpreting legal jargon as plain English in combination with a misapplied technical generalization, resulting in an absolute quagmire when it turns out that these essential compliance steps turn out to have a minor impact on the next quarter's bottom line. Thus some even more obtuse interpretation will be dreamed up by some manager to claim CYA without hurting the bottom line (or addressing the reinterpretation of the reinterpretation of the reinterpretation of the original issue). The issue will be resolved, pending small details like the actual legal risk and technical issues, and all will be fine. But just be be sure, we should ask legal!
dwaite 5y ago
How do I fund ripping out bad ideas from existing open source software? Log4j2 partially exists because of pushback on adding features to v1
- nlitened 5y ago
  Fund a new fork
  - bobbyi 5y ago
    Why not logback instead? It's existed for more than 10 years and its stated goal is "picking up where log4j 1.x leaves off" http://logback.qos.ch/ http://logback.qos.ch/
  - Too 5y ago
    Just leads to the xkcd “there are now 14 competing standards.” Honestly the biggest problem of package managers is finding a reputable package that one can trust. The best one can do to aid this situation is reviewing, vetting and warning of which packages that can be trusted and not. Automatic scanners to find code smells and vulnerabilities. “Security rating: 2/10, This package seems to use JNDI loading, are you sure you want to continue (y/n).”
    - yjftsjthsd-h 5y ago
      Humor me: if log4j had 13 (independently developed) competitors, wouldn't the impact of this be much lower, because many consumers would use different libraries? Like genetic diversity as a hedge against disease.
      - rini17 5y ago
        Joke's on you: Then any nontrivial project would end up depending on half of them, actually increasing attack surface.
      - gonzo41 5y ago
        I bet they'd all compete on features and probably implement the same exploit trying to maintain market share. Logging as it's understood today should ship with most STD libraries. Things like logback an log4j really should just eventually be rolled into the std.
symlinkk 5y ago
Giving something away for free and then turning around and guilting people into paying for it is wrong.
- ncmncm 5y ago
  That seems to be an opinion. Opinions vary. Mine does.
- yjftsjthsd-h 5y ago
  Using something for free and expecting support is hilarious.
solididiot 5y ago
[dead]
natded 5y ago
> educate their organisations on the importance of supporting open source solutions Githubs of the world could just gate downloads, pull requests etc. behind a payment to see what is the real valuation of open source software; I imagine it'd mostly settle around $0 excluding couple of big projects.
- samhw 5y ago
  Up until the semicolon, this was actually a decent point. I can see a future for high-quality open-source software hosted on an 'app store' which requires a small payment for use - or for commercial use, perhaps.
  - ahtihn 5y ago
    And how are you going to prevent someone from just hosting a mirror for free?
    - samhw 5y ago
      That's the question that such an effort would have to solve. I think you're assuming a model where software is directly used by an individual consumer, though, which is not always the case. For commercial applications where your software is integrated into the end product, for instance, companies would never risk stealing unlicensed code considering the risk. How one would address the question you posed is entirely dependent on the domain one's operating in.
akeck 5y ago
I read a post recently that said part of the open source funding issue comes down to a financial "structure" mismatch. Open source folks are often individuals or loose collections of individuals. Sometimes they have things like Patreons, ask to receive crypto currencies, etc. Companies don't/can't provide funding via these types of structures, so the writer of the post ended up incorporating a company, setting up a mercantile bank account, commercial payment processing, etc., so companies would be comfortable funding his efforts. Fortunately, this path is lot easier lately with services like Stripe, etc.
- hotpotamus 5y ago
  I have a feeling if a company wrote a large enough check, they'd figure out how to cash it.
  - ricardobayes 5y ago
    Well, wrte it to whom? No legal structure is what the comment was partly about.
- themerone 5y ago
  My Fortune 500 company has to pay a third party to pay for Google Maps, because we can't pay a supplier with a credit card. If we can't find a way to pay Google, there is no hope for some random developer in Nebraska.
  - macinjosh 5y ago
    Just because a dev lives in the Midwest doesn’t mean they’re idiots compared to coastal elites. The hate/mockery/minimizing of anyone not from a major coastal city is really gross. Screw you.
    - deleted 5y ago
      [deleted]
    - themerone 5y ago
throwaway19937 5y ago
> If information security people would spend the same amount of time they are spending complaining about this vulnerability trying to educate their organisations on the importance of supporting open source solutions they depend on we wouldn’t be in this situation. Security teams are stuck with securing the tire fire; they didn't choose the library or platform. If anyone should be advocating for supporting open source, it's the developers who benefit by using open source libraries.
- r-w 5y ago
  I’m not interested in kicking the can down the lane, I just want this stuff to be sustainable.
UncleMeat 5y ago
Would more funding have actually uncovered this?
- xyproto 5y ago
  No. Funded projects also contains bugs.
- darkr 5y ago
  Not in and of itself.. However if part of that funding was used to cover formal (external) audits, investment in fuzzing/automated security testing etc.. then it might well have done
  - layer8 5y ago
    That’s a really big "if" though.
  - svieira 5y ago
    "Might have" is the operative word. In a world where Project Zero's _This shouldn't have happened_ [1] was also published this month (buffer overflow on NSS), I'm less certain. Quoted from the article: ---- This wasn’t a process failure, the vendor did everything right. Mozilla has a mature, world-class security team. They pioneered bug bounties, invest in memory safety, fuzzing and test coverage. NSS was one of the very first projects included with oss-fuzz, it was officially supported since at least October 2014. Mozilla also fuzz NSS themselves with libFuzzer, and have contributed their own mutator collection and distilled coverage corpus. There is an extensive testsuite, and nightly ASAN builds. I'm generally skeptical of static analysis, but this seems like a simple missing bounds check that should be easy to find. Coverity has been monitoring NSS since at least December 2008, and also appears to have failed to discover this. Until 2015, Google Chrome used NSS, and maintained their own testsuite and fuzzing infrastructure independent of Mozilla. Today, Chrome platforms use BoringSSL, but the NSS port is still maintained. Did Mozilla have good test coverage for the vulnerable areas? YES. Did Mozilla/chrome/oss-fuzz have relevant inputs in their fuzz corpus? YES. Is there a mutator capable of extending ASN1_ITEMs? YES. Is this an intra-object overflow, or other form of corruption that ASAN would have difficulty detecting? NO, it's a textbook buffer overflow that ASAN can easily detect. ---- [1]: https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html https://googleprojectzero.blogspot.com/2021/12/this-shouldnt...

jeffbee 5y ago

I'm baffled by these claims that we should compensate the authors and maintainers of what has been conclusively shown to be software too dangerous to exist. It has the same problem as calls to pay the maintainers of openssl. No amount of money is going to impart good taste and best practices onto these projects. The uncomfortable truth is these libraries need scratch rewrites with better authors.

pclmulqdq 5y ago
The unfortunate thing about scratch rewrites is that they are not a good business. Open Source has conditioned people to think that libraries should be free. It's not clear to me that the alternative where libraries are obscenely expensive (like in the hardware world, where a hash table is a $100k investment) is any better. Nobody has ever built a successful company charging between $0 and $10,000 for a library. That is just how people see things, and unfortunately it is extremely hard to change.
- tjalfi 5y ago
  Some platforms have reasonable markets for libraries; Advanced Messaging Systems[0], DevExpress[1] and Aspose[2] are three examples of companies that successfully sell software libraries for .NET, Java, and Office. [0] https://www.dimastr.com/redemption/home.htm https://www.dimastr.com/redemption/home.htm [1] https://www.devexpress.com/ https://www.devexpress.com/ [2] https://www.aspose.com/ https://www.aspose.com/
TingPing 5y ago
OpenSSL at least has significant value, handling logs is usually an easy task.
RHSeeger 5y ago
Saying things like "I don't like this software because <concrete reason>" is reasonable; it can be considered constructive criticism, especially if you include a way it could be done better. Heck, even just "I think it's too complicated to use, and the underlying code base needed to support that complexity lends itself to bugs that can be exploited" would be better. Saying things like "No amount of money is going to impart good taste and best practices onto these projects" is insulting the people who wrote it with no real basis. It's not helpful and it makes you (and some other people in the thread) sound like a jerk.
- def_true_false 5y ago
  If only being nice to people prevented security bugs, eh?
  - virtual_void 5y ago
    Are you proposing that being rude does?
    - deleted 5y ago
      [deleted]
samhw 5y ago
> The uncomfortable truth is these libraries need scratch rewrites with better authors. If that's true, do you think that having money might possibly be helpful to that effort?
- ksaj 5y ago
  One of the maintainers in question holds two jobs to live. Having money might allow him more time to test and retest and update the software more expediently.
  - samhw 5y ago
    Sorry, I was posing that question semi-sarcastically. I agree it's blindingly obvious to any sensible person that money would help immensely. However, sadly, there are apparently plenty of people who are just about sensible enough to be able to get out of bed and navigate to this site, but not sensible enough to understand much else.
- dwaite 5y ago
  That wouldn’t be funding log4j2 though (from the ‘better authors’ part). That would most likely be an internal effort (devs you trust) published as a new open source logging framework in a sea of existing ones.
- staticassertion 5y ago
  Honestly, absolutely not, and I think money would be harmful. Lots of software doesn't need a lot of work. It can be simple. When people get paid to solve problems there's an incentive to add more code, to add new domains, etc. Use the standard java logger and move on, it's that easy.
  - tekknik 5y ago
    Where’s my incentive to work the weekend supporting a project after a long week of supporting my production code? If we want solid and secure OSS, we gotta pay someone!

kzrdude 5y ago

Maybe we should tell them to engage with open source, not "support it". Companies should look for a way to spend work hours on open source, not finding someone to send money.

throwaway19937 5y ago
If it's an enterprise (https://zwischenzugs.com/2018/10/02/why-are-enterprises-so-slow/ https://zwischenzugs.com/2018/10/02/why-are-enterprises-so-s...) the latter will be a much easier sell to management. Paying for support is a given but contributing developer time will require many approvals from different departments if it can be done at all.
l5ymep 5y ago
Convincing project managers to tackle tech debt is hard enough. Contributing to open source won't even reach the middle ear unfortunately.
- tekknik 5y ago
  Let’s not even get legal involved…
  - emn13 5y ago
    Don't worry, legal will answer a completely different question that's unrelated, but rests on a fundamental misunderstanding of the entire premise due to a combination of misinterpreting technical jargon as plain English and then misapplying a legal generalization, resulting in absolutely essential advice that needs to be followed immediately, which is couched in legalese that the techs will proceed to misunderstand by misinterpreting legal jargon as plain English in combination with a misapplied technical generalization, resulting in an absolute quagmire when it turns out that these essential compliance steps turn out to have a minor impact on the next quarter's bottom line. Thus some even more obtuse interpretation will be dreamed up by some manager to claim CYA without hurting the bottom line (or addressing the reinterpretation of the reinterpretation of the reinterpretation of the original issue). The issue will be resolved, pending small details like the actual legal risk and technical issues, and all will be fine. But just be be sure, we should ask legal!

dwaite 5y ago

How do I fund ripping out bad ideas from existing open source software? Log4j2 partially exists because of pushback on adding features to v1

nlitened 5y ago
Fund a new fork
- bobbyi 5y ago
  Why not logback instead? It's existed for more than 10 years and its stated goal is "picking up where log4j 1.x leaves off" http://logback.qos.ch/ http://logback.qos.ch/
- Too 5y ago
  Just leads to the xkcd “there are now 14 competing standards.” Honestly the biggest problem of package managers is finding a reputable package that one can trust. The best one can do to aid this situation is reviewing, vetting and warning of which packages that can be trusted and not. Automatic scanners to find code smells and vulnerabilities. “Security rating: 2/10, This package seems to use JNDI loading, are you sure you want to continue (y/n).”
  - yjftsjthsd-h 5y ago
    Humor me: if log4j had 13 (independently developed) competitors, wouldn't the impact of this be much lower, because many consumers would use different libraries? Like genetic diversity as a hedge against disease.
    - rini17 5y ago
      Joke's on you: Then any nontrivial project would end up depending on half of them, actually increasing attack surface.
    - gonzo41 5y ago
      I bet they'd all compete on features and probably implement the same exploit trying to maintain market share. Logging as it's understood today should ship with most STD libraries. Things like logback an log4j really should just eventually be rolled into the std.

symlinkk 5y ago

Giving something away for free and then turning around and guilting people into paying for it is wrong.

ncmncm 5y ago
That seems to be an opinion. Opinions vary. Mine does.
yjftsjthsd-h 5y ago
Using something for free and expecting support is hilarious.

solididiot 5y ago

[dead]

natded 5y ago

> educate their organisations on the importance of supporting open source solutions Githubs of the world could just gate downloads, pull requests etc. behind a payment to see what is the real valuation of open source software; I imagine it'd mostly settle around $0 excluding couple of big projects.

samhw 5y ago
Up until the semicolon, this was actually a decent point. I can see a future for high-quality open-source software hosted on an 'app store' which requires a small payment for use - or for commercial use, perhaps.
- ahtihn 5y ago
  And how are you going to prevent someone from just hosting a mirror for free?
  - samhw 5y ago
    That's the question that such an effort would have to solve. I think you're assuming a model where software is directly used by an individual consumer, though, which is not always the case. For commercial applications where your software is integrated into the end product, for instance, companies would never risk stealing unlicensed code considering the risk. How one would address the question you posed is entirely dependent on the domain one's operating in.

akeck 5y ago

I read a post recently that said part of the open source funding issue comes down to a financial "structure" mismatch. Open source folks are often individuals or loose collections of individuals. Sometimes they have things like Patreons, ask to receive crypto currencies, etc. Companies don't/can't provide funding via these types of structures, so the writer of the post ended up incorporating a company, setting up a mercantile bank account, commercial payment processing, etc., so companies would be comfortable funding his efforts. Fortunately, this path is lot easier lately with services like Stripe, etc.

hotpotamus 5y ago
I have a feeling if a company wrote a large enough check, they'd figure out how to cash it.
- ricardobayes 5y ago
  Well, wrte it to whom? No legal structure is what the comment was partly about.
themerone 5y ago
My Fortune 500 company has to pay a third party to pay for Google Maps, because we can't pay a supplier with a credit card. If we can't find a way to pay Google, there is no hope for some random developer in Nebraska.
- macinjosh 5y ago
  Just because a dev lives in the Midwest doesn’t mean they’re idiots compared to coastal elites. The hate/mockery/minimizing of anyone not from a major coastal city is really gross. Screw you.
  - deleted 5y ago
    [deleted]
  - themerone 5y ago

throwaway19937 5y ago

> If information security people would spend the same amount of time they are spending complaining about this vulnerability trying to educate their organisations on the importance of supporting open source solutions they depend on we wouldn’t be in this situation. Security teams are stuck with securing the tire fire; they didn't choose the library or platform. If anyone should be advocating for supporting open source, it's the developers who benefit by using open source libraries.

r-w 5y ago
I’m not interested in kicking the can down the lane, I just want this stuff to be sustainable.

UncleMeat 5y ago

Would more funding have actually uncovered this?

xyproto 5y ago
No. Funded projects also contains bugs.
darkr 5y ago
Not in and of itself.. However if part of that funding was used to cover formal (external) audits, investment in fuzzing/automated security testing etc.. then it might well have done
- layer8 5y ago
  That’s a really big "if" though.
- svieira 5y ago
  "Might have" is the operative word. In a world where Project Zero's _This shouldn't have happened_ [1] was also published this month (buffer overflow on NSS), I'm less certain. Quoted from the article: ---- This wasn’t a process failure, the vendor did everything right. Mozilla has a mature, world-class security team. They pioneered bug bounties, invest in memory safety, fuzzing and test coverage. NSS was one of the very first projects included with oss-fuzz, it was officially supported since at least October 2014. Mozilla also fuzz NSS themselves with libFuzzer, and have contributed their own mutator collection and distilled coverage corpus. There is an extensive testsuite, and nightly ASAN builds. I'm generally skeptical of static analysis, but this seems like a simple missing bounds check that should be easy to find. Coverity has been monitoring NSS since at least December 2008, and also appears to have failed to discover this. Until 2015, Google Chrome used NSS, and maintained their own testsuite and fuzzing infrastructure independent of Mozilla. Today, Chrome platforms use BoringSSL, but the NSS port is still maintained. Did Mozilla have good test coverage for the vulnerable areas? YES. Did Mozilla/chrome/oss-fuzz have relevant inputs in their fuzz corpus? YES. Is there a mutator capable of extending ASN1_ITEMs? YES. Is this an intra-object overflow, or other form of corruption that ASAN would have difficulty detecting? NO, it's a textbook buffer overflow that ASAN can easily detect. ---- [1]: https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html https://googleprojectzero.blogspot.com/2021/12/this-shouldnt...