145 lines
7.7 KiB
Markdown
145 lines
7.7 KiB
Markdown
---
|
|
title: '"Open Source" is Broken'
|
|
date: 2021-12-11
|
|
author: Mai
|
|
tags:
|
|
- rant
|
|
---
|
|
|
|
or: Why I Don't Write Useful Software Unless You Pay Me
|
|
|
|
Recently there was a [massive
|
|
vulnerability](https://www.lunasec.io/docs/blog/log4j-zero-day/) found in a
|
|
critical Java ecosystem package. When fully weaponized, this allows attackers to
|
|
coerce Java servers into executing arbitrary code that was fetched from an LDAP
|
|
server.
|
|
|
|
[If this is news to you and you work at a Java shop, I'm sorry but you have a
|
|
long couple days ahead.](conversation://Mara/hacker)
|
|
|
|
I believe this is a perfect microcosm of all of the major ecosystem problems
|
|
with "Open Source" software. I have some thoughts about all this, as I think
|
|
log4j2 is a _perfect_ example of one of the worst case scenarios for this. It is
|
|
perfectly reasonable for everyone involved in this issue to have done all this
|
|
for perfectly valid solutions to real-world problems and this also to have
|
|
created a massive hole on accident in the process.
|
|
|
|
<center>
|
|
|
|
|
|
|
|
</center>
|
|
|
|
All software is made on top of the shoulders of giants. Consider something as
|
|
basic as running an SSH server on the Linux kernel. In the mix you would have at
|
|
least 10 vendors (assuming a minimal Alpine Linux system in its default
|
|
configuration), which means that there are at least 10 separate organizations
|
|
that still have bills to pay with actual money dollars regardless of the number
|
|
of users of the software they are giving away for free. Alpine Linux is also a
|
|
great example of this because it is used frequently in Docker contexts to power
|
|
many, many companies in production. How many of those companies do you think
|
|
fund the Alpine Linux project? How many of those companies do you think even
|
|
would even THINK about funding the Alpine Linux project?
|
|
|
|
I've had this kind of conversation with people before and I've gotten a
|
|
surprising amount of resistance to the prospect of actually making sure that the
|
|
random smattering of volunteers that LITERALLY MAKE THEIR COMPANY RUN are able
|
|
to make rent. There is this culture of taking from open source without giving
|
|
anything back. It is like the problems of the people who make the dependencies
|
|
are irrelevant.
|
|
|
|
<center>
|
|
|
|
|
|
|
|
</center>
|
|
|
|
GitHub stars famously cannot be used to pay rent. An example of this is the
|
|
[`core-js` debacle](https://github.com/zloirock/core-js/issues/767). `core-js`
|
|
is a JavaScript library that gives JavaScript's standard library a lot of core
|
|
primitives that can make you not need to reach out to other libraries. This
|
|
library is also infamous for letting you know that the author is looking for a
|
|
job every time you install it in CI. You probably have seen this message in your
|
|
CI a thousand times:
|
|
|
|
```
|
|
Thank you for using core-js ( https://github.com/zloirock/core-js ) for
|
|
polyfilling JavaScript standard library!
|
|
|
|
The project needs your help! Please consider supporting of core-js on Open
|
|
Collective or Patreon:
|
|
> https://opencollective.com/core-js
|
|
> https://www.patreon.com/zloirock
|
|
|
|
Also, the author of core-js ( https://github.com/zloirock ) is looking for a
|
|
good job :-)
|
|
```
|
|
|
|
The author of the project is either still in prison for vehicular manslaughter
|
|
or has just been released. `core-js` is a dependency of React. How many of you
|
|
have actually donated to this project? Especially if you use React?
|
|
|
|
Now let's turn our eyes to `log4j2`. This project is effectively in the standard
|
|
library for Java users. This library is so ingrained into modern Java that
|
|
you'd expect the developers of it would be well-funded and not need to focus on
|
|
anything else but that library, right?
|
|
|
|
No.
|
|
|
|
<center><blockquote class="twitter-tweet"><p lang="en" dir="ltr">This is the maintainer who fixed the vulnerability that's causing millions(++?) of dollars of damage.<br><br>"I work on Log4j in my spare time"<br>"always dreamed of working on open source full time"<br>"3 sponsors are funding <a href="https://twitter.com/rgoers?ref_src=twsrc%5Etfw">@rgoers</a>'s work: Michael, Glenn, Matt"<br><br>People, what are we doing. <a href="https://t.co/2hAxUWCjuC">pic.twitter.com/2hAxUWCjuC</a></p>— Filippo ${jndi:ldap://filippo.io/x} Valsorda (@FiloSottile) <a href="https://twitter.com/FiloSottile/status/1469441487175880711?ref_src=twsrc%5Etfw">December 10, 2021</a></blockquote> <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script></center>
|
|
|
|
As of yesterday, there were a grand total of three sponsors for this person's
|
|
work. THREE. As of today, this number is now 14; however this is no excuse. This
|
|
person should be funded in a level that is appropriate for how critical `log4j2`
|
|
is used in the ecosystem. There is no excuse for this. This person's _spare time
|
|
passion project_ is responsible for half of the internet working the way it
|
|
should. Vulnerable companies to this issue included Apple, Google, my cell phone
|
|
carrier and basically everyone that uses JavaEE in its default configuration.
|
|
|
|
[Seriously, I could trigger some part of my cell carrier's infra reaching
|
|
out to a DNS server with a specially crafted SMS
|
|
message.](conversation://Cadey/facepalm)
|
|
|
|
If `log4j2` is responsible for your company's success, you have a moral
|
|
obligation to [donate to the person who creates this library
|
|
thanklessly](https://github.com/sponsors/rgoers).
|
|
|
|
[As for the problem that created this vulnerability in the first place: what
|
|
where they THINKING when they allowed user-submitted untrusted strings to
|
|
contain JDNI references that would then cause the JVM to load arbitrary bytecode
|
|
into ram and then run it without having to specify that in the format string to
|
|
begin with? Like why would you even need to do that in the _user-supplied_ part
|
|
of the format string? What would this even accomplish other than being a great
|
|
way to get a shell whenever you wanted?](conversation://Numa/stare)
|
|
|
|
There is a friend of mine who has been thanklessly maintaining an online radio
|
|
station stack for a long time. He has been abused by his users. Users will throw
|
|
5 bucks in the tip jar and then get very angry when he doesn't drop everything
|
|
and fix their incredibly specific problems on a moment's notice. He has tried to
|
|
get jobs at places, but every time they keep trying to screw him out of
|
|
ownership of his own projects and he has to turn them down. Meanwhile the cash
|
|
bleed continues.
|
|
|
|
This is why I am very careful about how I make "useful" software and release it
|
|
to the world without any solid way for me to get paid for my efforts. I simply
|
|
do not want to be in a situation where my software that I develop as a passion
|
|
project on the side is holding people's companies together. That's why I make
|
|
software how and where I do. Like, no offense, but I really do not want to go
|
|
unpaid for my efforts. The existing leech culture of "Open Source" being a pool
|
|
of free labor makes it hard for me to want to have my side projects be actually
|
|
useful like that unless you pay me.
|
|
|
|
[Okay, part of this may also be an ADHD thing and not really being able to stick
|
|
to projects longer term.](conversation://Cadey/coffee)
|
|
|
|
TL;DR: If you want me to make you useful software, pay me. If you use software
|
|
made by others in their spare time and find it useful, pay them. This should not
|
|
be a controversial opinion. This should not be a new thing. This should already
|
|
be the state of the world and it is amazingly horrible for us to have the people
|
|
that make the things that make our software work at all starve and beg for
|
|
donations.
|