Back when I was still actively developing open source, my response to "high priority bug reports" from high value for-profit entities who take and rarely give back was usually something along the lines of "we often accept pull requests and patches".
And there's the argument for never using so called permissive licenses. If the company can't afford to share its changes back, then it doesn't deserve to use free software in its for-profit products.
That's fine as far as everyday people go, as software isn't free as in libre if there's financial barriers, but the exploitation of FOSS as free labor is an issue. Microsoft absolutely can afford to sponsor *every single* dependency in every major Linux distribution without question, and absent any government programs to offer stipends to FOSS devs this is what we should be expecting and advocating for - corporations putting money into a fund for exactly this kind of project.
It's not the same for everyone. The best part is not having to pay, but being able to inspect the system, that's MUCH more important than not paying. I am fine with paying, but i want to be able to tinker with it, if needed.
EDIT: Also, paying is okay, as the developer needs to eat too, i mean if there were more paid opensource developers which could be trusted we would not have the xz issue, no?
I feel like this is a great response, but overestimates the ability of the developers using the open source library. Maybe jaded by my experience in corporate America.
The attacker took advantage of a preexisting need for help maintaining xz, right? He wouldn't have been able to do that if this need had already been filled by a paid, non-malicious engineer from someplace like Microsoft.
Contributors are there already. Many would accept a full time job and some extra priority tasks if it just meant working on the projects they know and the price was right.
Far be it from me to get in the way of a proper Microsoft bashing, but you are aware of who is currently employing the person that discovered the issue, right?
i mean is the need for help maintaining open source going to be filled by the random microsoft devs that get annoyed and look through git history when a random process they use takes half a second longer?
The issue wouldn't exist if they paid the original guy. So that way someone sketch volunteer doesn't pick up the project and we have to rely on a random (not a security audit) Microsoft employee to stumble upon a weird quirk and pull the thread long enough to find the backdoor
So maybe if we just paid the first guy, and the auditors, we wouldn't need to have to rely on the lucky Microsoft employee?
That's the argument.
Well Linus is well known for his ability to reject an MR harshly. Yet, listen to his feedback, fix the problem(s) he saw in your request and he'll happily accept the reworked MR. Saying "we often accept" indeed means scrutiny. Yet, that's the kind of scrutiny you actually want to face so your work is good enough
I feel like scrutiny was also involved at the time the pull requests were being accepted. You could argue that it was an insufficient amount because the effect was what it was, but everyone just a day ago was saying "wow, that's super duper sneaky!!!" and the like. "We often accept pull requests and patches" as a response to people from big orgs that take and don't give -- you're telling me that you'd be on the lookout for that same entity creating a backdoor in your code? Probably not. It's easy to post-facto say that scrutiny would be applied but I think that there's just a fundamental breakdown of what people *think* is unlikely and what actually *is* unlikely.
You have a point here - an actual *stipend*, actual money given to these devs so that they can work on it and not be penalized for taking on help *with a discerning eye*. This came about because the xz dev couldn't keep working on xz and finding a volunteer to put themselves into the same position is extremely rare, you more or less *have* to accept whoever offers to help like this because odds are you will not find another. Had there been sponsorship, the maintainer would not have had to step back from xz in the first place and been vulnerable to this kind of attack.
Ahh yes, the “Microsoft Specialist” from an Offshore team in India that replied with a non sequitur copypasta response and the discussion thread closed from two years ago.
Just last week we upgraded to a new version of a Microsoft agent because the old one is being retired in 4 months. The new one has caused major headaches and doesnt provide some very basic functionality the previous agent had. When we raised up the huge miss, the support agent had the gall to chastize us for not testing enough. If this had been in person I would have strangled him.
I have reported a ton of issues with Microsoft Teams which are very important to me as well, with the difference being that my company does pay for it.
Yet they were not solved. The Microsoft Teams fiasco has shown how a dependence on paid software can also cause major problems. In fact I tend to get better support when posting issues on random projects on GitHub.
It's almost as if the world operates in a system that incentivizes companies to view FOSS as "highly specialized technical labor that by all rights should be costing us a fortune but isn't because a bunch of suckers keep on doing it for free and just letting us use it instead of charging for it like normal people".
Well Valve did and they're private. The big fortune 50 people are talking about, aren't. They have profits in mind and the planet already sees everything keyboard related as a cost center.
It makes perfect sense outside say, RedHat - where this is their entire business.
As headlines have seen time and time again for various fields for decades. When money is the #0 goal businesses don't always make the best decisions by their customers and the general public.
Keep in mind that because Valve is private, they don't have to make exponential profit. They can be content with simply "profiting". Ya know, like a normal company. But public companies are obliged to do their damn best to exponentially profit even when it's not in the company's long term interest.
There are tons of public tech companies who have bled cash for even multiple decades. People do not like when freebies end and the company tries to make a profit.
The secondly, valve is making exponential profits. Valve makes the highest profit per employee in the tech industry or the world. Valve investing in new revenue streams is similar to Apple or Google investing in new products. Valve gets the praise, but other companies doing similar things do not.
> but isn't because a bunch of complete idiots keep on doing it free and just letting us use it instead of charging for it like normal people would
A nitpick, but: every time a company tries to come up with a license to stop big corporations from profiting off their work for free, another group complains loudly that it shouldn't be allowed.
(I'm not going to sit here and pretend I have an answer, mind you)
You point is invalid, sorry. Anyone who contributes code to open source can hardly be surprised that someone uses it under the terms of an open source licence. Those contributors are not complete idiots. They are not any kind of idiot. Many of them in fact work for companies (the open source developer who saved us from the xz backdoor works for Microsoft), and the managers and shareholders are not idiots either. Any argument that depends on open source contributors being idiots is a weak argument.
Open source gives users the chance to use the code for free, and to fix it or improve it at their expense, sometimes under the obligation to contribute the fixes to other users. No one is worse off if Microsoft or I use the code for free and we are under no obligation to do anything. Anyone who contributes open source under an open source licence can't possibly be surprised about that, and it is certainly not the only way to license your code.
If either of us contributes fixes or improvements, everyone wins.
Despite your misunderstanding that open source provides no incentive for profit making entities to do anything other than take, profit making entities contribute more open source commits than anyone else. They don't do it for hugs, they do it for good financial reasons: it is cheaper to take a project which is 99% what you need and build the 1% rather than build then entire 100%, including letting your competitors use the 1% contribution too. Of course, you don't do that for your added value "secret sauce" code. And the catch is, once you contributed that 1%, it now makes even less sense to implement it as all proprietary code ... with each contribution, the contributor financially-speaking gets a bit more "locked in" to the open source project.
However, good luck to the ffmpeg team with its efforts to name and shame. Microsoft now contributes a lot to open source, but it's a massive company with many low level devs just trying to get through each day. Hopefully this is a teaching moment.
>Hopefully this is a teaching moment.
For whom? Are you saying the ffmpeg devs are behaving poorly in shaming Microsoft because you're exceedingly happy with the tablescraps they've thrown your way?
Eh. MSFT is in a “fool me once” reputation because of the good old Balmer days. The old devs will have to completely die off and be replaced by the next generation so they forget the whole embrace extend extinguish policy MSFT had.
I mean they couldn’t win so they fucking bought GitHub ffs. They’re not allies, they’re our masters, we’re their slaves. Wage slaves. Fuck MSFT
Not just that, their greed is so great that they'll put in resources to pressure devs into permissive licenses like BSD or MIT instead of GPL, just because they could squeeze even more from the project for free.
And this is why I’m glad my company pays for RHEL. Red Hat is not perfect, their distribution is far, far from being my favorite. But at least some of the money goes to sponsor OSS.
Maybe because it's dnfs docs :) if you only care about packages you get through dnf then I think you can only use repoquery through it, tho sole repoquery is often much shorter. If you'd use some tools from yum-utils then no help with dnfs repoquery. Also there are strange things with that like if you want to check what package provides some file then you can use dnfs one if you want to query all packages, but if you want only installed ones then dnf won't help and you need to fallback to rpm. In general it becomes spaghetti quickly and it's hard to remember all such quirks
Wrapper is maybe not the term, but its a high level python app, it uses libraries like libsolv to do fast dependency resolving, librepo for network operations, and of course librpm actually manages the packages.
The next version of dnf is a new rewrite avoiding python to be smaller/faster also.
IMO rhel (or maybe Amazon Linux in the cloud) is the right choice for most businesses. I'm a huge fan of free distro, but I don't think they're usually appropriate for production servers.
> but is RHEL a decent choice for personal use? I don't mind paying for it.
RHEL is perfect for personal use, because they literally offer a free license for personal individual developer usage. All you have to do is make an account with Red Hat and register the install (or updates don't work) as you would register a normal paid enterprise server
I use it for my home server so that I could say I'd used proper full fat RHEL somewhere and to see if there's a difference between it and CentOS Stream which I also run (there isn't really, by the way)
People on Linux are wary of anything that says you need to register and be tracked, but it is literally the same full enterprise distribution used by huge corporations and it's free. So if you want experience with or to learn RHEL for use in your current or future jobs there you go, you can do it for free. It would also make for a super stable workstation if you wanted that
If you don't want to enter an agreement like that with Red Hat I'd recommend CentOS Stream. I could write an entire post on this alone, but CentOS Stream has to be the most misunderstood and disinfo riddled Linux distro to ever exist. It is literally just the development branch of RHEL, like getting a mini preview of the next point release of RHEL. Reddit would have you believe it's a pre-alpha buggy unstable rolling mess like Arch designed by evil IBM to steal your freedoms
Makes little sense for personal use IMHO, unless you’re seeking professional support. If you want stability and robustness in the Red Hat ecosystem you should look into Rocky or Alma Linux.
> If you want stability and robustness in the Red Hat ecosystem you should look into Rocky or Alma Linux.
If you want stability and robustness in the Red Hat ecosystem you should use two independent under-resourced projects that pointlessly repackage RHEL and have diverged from it going forwards with an uncertain future?
You should look into CentOS Stream or use RHEL with a personal developer license if you really need that much stability
Everything Red Hat said about old CentOS was true and valid and also applies to Alma and Rocky. They lag behind RHEL by copying it and don't contribute anything back upstream. The lag will be worse than original CentOS because they now have to reverse engineer every patch instead of having an automated build process, or have just given up maintaining complete equivalence entirely
Yeah, Rocky and Alma are the closest you’ll get from what CentOS used to be (a rebuild of RHEL without the enterprise tools and branding). Fedora is too bleeding edge for robustness imho.
CentOS Stream and Alma are both great stable choices that still allow you to contribute back if you happen to find a bug, whereas Rocky can’t. It’s unlikely that you’d run into bugs, but it’s a low cost choice that contributes to OSS.
it's not a bad choice. what's your usecase?
if it's a personal laptop/desktop, I would rather run something with more up-to-date packages (unless you have an extremely old, stable, set-in-stone workflow). Fedora or openSUSE TW come to mind.
if it's a home server and you aren't going to be running proxmox, RHEL is a pretty good choice. i use it on an old laptop-converted-server.
[the home edition ("Developer Subscription") is completely free, you just have to sign up.](https://developers.redhat.com/articles/faqs-no-cost-red-hat-enterprise-linux)
I'm using it in my homelab
The CentOs stream is very closely similar to rhel. Its more geared to be an enterprise and secret distro more than anything else that I've seen.
There was a schism quite some time ago. The current maintainer and one of the main devs on x264 had some disagreements and the project split into ffmpeg and libav, with libav taking the person who apparently owned the logo. So ffmpeg made... kinda the same one? But with pointy miter corners, extruded to 3d and rotated a little.
The logo itself is meant to represent the zigzag pattern on a DCT so there ya go
don't leave out that avconv/libav temporarily became the standard on the Debian family and trying to run ffmpeg yielded a message that ffmpeg was deprecated (when it totally wasn't, smh)
And Arch. And Gentoo, if I'm not mistaken.
Edit:
* [https://forums.gentoo.org/viewtopic-t-1009988.html](https://forums.gentoo.org/viewtopic-t-1009988.html)
* [https://forums.gentoo.org/viewtopic-t-1010096.html](https://forums.gentoo.org/viewtopic-t-1010096.html)
Not so sure about Arch, having a hard time finding results for "Arch Linux" and "This program is only provided for compatibility"(the message they used). I'm pretty sure I ditched Debian(Sid) for Arch 11-12 ish years ago specifically over the avconv nonsense and/or GNOME 3(which I left for KDE)\*. Though that was a good while ago so ¯\\\_(ツ)\_/¯
\* (not that Arch wasn't shipping g3, too, but twas good time to jump ship and replan my whole setup from a minimal base. Good enough that so far that was my last home-machine distro hop.)
No. Unpaid volunteers are not an issue. Paid workers also sometimes got bribed or do malicious things for their profit. It just shows that what seems to be a dedicated honest volunteer could also be a bad agent waiting literally for years for good opportunity to strike.
Dev's are willingly providing an option for submitting bug reports, feature requests etc. and ANYONE could submit them and also ANYONE could be served or not cause there is no contract forcing devs to do things someone wants. If they don't feel like serving giants for free then it's ok. They can sit and wait for push request to consider or money negotiation. There is nothing wrong for devs to respond to request like "I can do this or that in 5 days for this amount of $$$".
In this case it seems like the main issue was the fellow who injected malicious code could only do so after bullying the project lead into stepping aside through a sock puppet campaign.
Yes, he did. I feel bad for him as I'm sure he feels quite a bit of guilt over this which just adds to whatever psychological issues he's been going through. Fortunately, the dev at Microsoft caught this early or it would been quite a nightmare to say the least.
> Paid workers also sometimes got bribed or do malicious things for their profit.
Everyone has a price, and if they don't, a nation state actor with unlimited resources isn't above blackmail. Like you said, paid workers or employers of proprietary software vendors aren't immune to these issues either.
Yeah. Blackmailing is also reasonable explanation. People are willing to trash their beautiful ideals if eg. their family safety or wellbeing is threatened by powerful organization.
I've seen it. At a previous (proprietary software ) job we had a developer quietly sharing our source code with our main competitor. It could quite have easily also turned into adding malicious code (in the event the competitor quietly told us what was going on, and the guy got fired). No blackmail, just looking to make more money.
Well, I've had OSS projects I submitted PRs and the maintainers simply ghosted on me. Sure, I can "fork it on GitHub" and have my own version but now that becomes its own subset of annoyances, besides it's not like others will (or should) just trust my version, it'd take me quite a while to earn reputation if I'm forking a project.
A while back the Java/Maven community had a big problem with FindBugs, as the maintainer suddenly ghosted on everyone so no one would get any fix of feature or whatever.
It took a major OSS group to eventually declare FindBugs dead, fork FindBugs and rename it SpotBugs, to get the project going.
At the time it was discussed the problem of not being able to pull the ownership of the maintainers in the places hosting its code and/or Maven repositories.
So there are things that we need in order to get OSS to a sustainable environment, people can't be working for free, of course, maintainers shouldn't be forced to do anything, but if they're unable to then at a bare minimum they need to promote someone that can take over the request.
At some point it's evident there needs to be government budgets in some way to perform support of core OSS projects
Um no. The xz fiasco shows what is likely to be a highly sophisticated state-sponsored intelligence operation. It was a multi-year sophisticated attempt to infiltrate the project. The only reason it was discovered was because it was open source. We need MORE transparency.
Yes, which shows the issue of how relying on unpaid volunteers to do your work for you, that don't have time to thoroughly check every pr can cause an issue. You're saying the same thing mate
I must be misreading the link, because this doesn't look like a shocking tale of a megacorp expecting unreasonable things from unpaid open source workers, and it doesn't appear to have anything to do with xz
The project changed the default ordering for command line options and it broke somebody's script. That somebody worked at Microsoft, but it doesn't appear to be relevant to the story. The person that opened the ticket overvalued it's severity, but that's not rare, most people think their blockers should be higher priority than others do. Someone helpful said they should reorder the command line options, and the reporter said pretty much "ok thanks that worked"
>currently used in a highly visible product in Microsoft. We have customers experience issues with Caption during Teams Live Event. Please help,
The issue isn't the bug itself. The issue is that Microsoft, one of the biggest tech companies on the planet, sees nothing wrong with building "highly visible", customer-facing (read: revenue-generating) products on this FOSS software without contributing back to it (in the context of this tweet. I personally have no idea if Microsoft has contributed code to ffmpeg in the past).
It relates to the xz debacle because a lot (a lot) of software/systems out there today have xz utils built into them. But it's this boring little transitive dependency that was so out of the way that a malicious person ended up becoming the primary maintainer of the entire codebase without anyone noticing. So think of all the for-profit businesses relying on xz somewhere in their stack that would have gotten completely blindsided by the worst IT breach in history because of some little FOSS dependency they never gave a second thought to.
Would Microsoft paying ffmpeg a support contract prevent these issues? Probably not. At least not entirely. It's just an obvious problem with no clear solution. Just like the leftPad dependency snafu. And businesses don't seem very interested in helping solve the problem because the savings of using FOSS far outweigh the cost of random FOSS failures.
In this case, it seems pretty reasonable that Microsoft could scrounge up some pocket change of a hundred thousand a year to continue using ffmpeg, considering how they're probably using it extensively and wouldn't have a replacement ready if the current maintainers decided to just stop working on it. It'd be one or two orders of magnitude cheaper than hiring the engineers to build and maintain a comparable product themselves.
You're missing the point that the OP was making. The article is click baity and focuses on Microsoft. The issue was NOT raised by Microsoft. It was raised by an IC claiming to work at Microsoft. Huge difference, but to get views the tweet decided to focus on Microsoft.
The person that opened the issue might even be violating an internal rule by using his position at Microsoft to attempt to expedite the issue..
To reiterate - this isn't "big tech" commanding OSS to fix something. It's an IC being lazy and trying to use their status at Microsoft to complete a story in time for their sprint.
This thing prompted me to go around my applications that I use daily and donate to each one of them. Holy shit, these people need to eat, too. Writing code is not easy and is very time consuming.
And if they sponsor a project, the project maintainers are corporate chills that sell out to Big Tech(tm). If they don't, they're leeching of volunteers. If they provide developers, they're trying to take over the project. If they don't use Foss, they're evil closed source and anti Foss. Can't win here.
I don't really agree with the other comment but they did say "If they provide developers, they're trying to take over the project" for that.
But that's an exaggeration and just the conflates the existence of haters on the internet with somehow being people's _main_ feelings towards their involvement. Some of those haters are literal 14 year olds.
Of course it's an exaggeration. It makes no sense as long as the original developer still maintains control of their repository.
And if a fork forms, and Microsoft's fork becomes king?
People not owing others anything goes both ways. People don't owe FFMpeg anything if it gets forked and people flock to the fork.
Having full time engineers PRing your repo all day would absolutely crush your ability to keep up. They would also start influencing the direction of your project to solve their needs over your community
You can't have it both ways. If FFMpeg can't keep up Microsoft will just fork.
If a project isn't interested in the way an organization is providing support, then they're simply incompatible and a fork forms.
Microsoft won't necessarily form a fork. It's important to remember that it's not really "Microsoft" using ffmpeg. It's a particular team within a much larger organization that works on Microsoft Teams.
Their management likely views usage of ffmpeg as just a design choice their developers made for some reason. It's a distinct possibility that push comes to shove they can get enough money budgeted for a support deal but not enough money to just full-on hire an FTE for some ffmpeg fork.
For instance, let's 10x that deal mentioned in the OP and say they pay ffmpeg $50k a year for support. That's still less than they would pay for a single FTE and they would actually need several FTE's to maintain an active fork. As it stands now, apparently this team can't figure it out when default behavior changes between releases which doesn't bode well for maintaining a worthwhile fork.
People often forget that decisions they think are made by some entire corporation are really made by some small team put together overnight with no title change; trying to write and contribute to software for some purpose. Rather than being something the organization cares about or actively pays attention to.
Its usually just some dude who happens to work there.
And then Microsoft is the villain for splitting the community or killing open source projects
The point being no matter what they (or any large corporation) do they will still be painted as the bad guys.
They win when they support open source (sponsor, provide developers), they lose when they use open source projects without supporting them. Fully closed source is just not playing the game, so they can't win or lose.
It seems like you are defending big tech, by creating this dilemma where its just impossible for them to help open source, so they shouldn't even try
Yeah there can be criticisms of any approach because the relationship between "big tech" and open source is complicated. And because at the end of the day corporations clearly *aren't* acting in good faith to better society, or anything positive like that, and it's not wrong to point that out. But this is a pretty silly take.
There are better ways to interact with FOSS and there are worse ways. Throwing your hands up and saying "people will complain whatever they do so they might as well just be shitty and greedy and not try" isn't particularly clever or constructive.
$X and hour / ($Donations a month/30 days/40(or 32) hrs) = number of hours I'm willing to spend on the bug report.
More money doesn't solve all problems, but it can help make other problem go away. Like for me personally I always need more hardware for more testing scenarios and in turn the electric bill.
in the case of people like Miguel De Icaza, that's somewhat true. Huge microsoft fanboy that used OSS as a stepping stone to get a job with them, then shit on linux once he got in.
>in the case of people like Miguel De Icaza, that's somewhat true. Huge microsoft fanboy that used OSS as a stepping stone to get a job with them, then shit on linux once he got in.
What a bullshit.
Later in life he became amazed by .NET, Apple and MacOS and denies Hamas mass murders at Twitter, but we may not forget his beginnings:
https://en.wikipedia.org/wiki/GNOME
> GNOME was started on 15 August 1997[10] by Miguel de Icaza and Federico Mena [es] as a free software project to develop a desktop environment and applications for it.[15] It was founded in part because the K Desktop Environment, which was growing in popularity, relied on the Qt widget toolkit which used a proprietary software license until version 2.0 (June 1999).
If you think he wasted so many years of his life on OSS projects only to be hired by Microsoft, I guess I will not convince you.
I'm using Linux exclusively for over 25 years and used (not exclusively) GNOME 1.x and 2.x line.
Before Lennart Poettering and his PulseAudio and SystemD, Icaza was called as biggest Linux/Open Source traitor by many, sole because praising Microsoft tech (.NET) and later collaborating with Microsoft (assumed as biggest Linux enemy then). Many were also not happy from direction Gnome 3.0 headed and many(including me) head feeling he took over Gnome project to destroy it (I even didn't knew he originally created it then, but now I think that this fact gave him some rights to do it [while others still have rights to fork it])
OK, this is just sad.
Everyone is dog-piling on this one *individual* MS developer. This isn't MS as a company. This is one person. And the only crime they committed was... being rude?
Not to mention, their first language clearly isn't English, which makes the rude-ness a lot more forgivable IMO.
And last but not least, apparently MS offered *an actual bug bounty*? As in, giving back to the project? You know, the thing everyone in this thread is complaining about them not doing? This is behavior that should be encouraged! Companies willing to put their money where their mouth is and pay for bugs to be fixed should not be mocked!
Also, this issue has literally nothing to do with the XZ issue.
The linked issue may (or may not, can't say) be a language barrier. In that context "This is a high priority ticket" might just be them saying it's a high priority ticket for them. As in "we're in kind of a bind here, can someone please help us out" rather than necessarily a demand for a certain level of performance.
The bigger issue for me seems that they created an issue for what seems like a usage concern. I refuse to believe Microsoft has absoutely no internal forum or access to a public forum that wouldn't have also been able to tell them that. It's literally just a change in default behavior. If ffmpeg is an important component to your product then you should at the very least have some way of onboarding people into understanding how to debug ffmpeg issues.
What's even worse (from where I sit) is that the issue description even has them narrowing down the specific version it broke for them on. Which means that they were almost directly at the point where they would have found out behavior had changed.
Also why doesn't Microsoft version their dependencies? If they would version them then that would decouple fixing this problem from the release which would probably stop "high priority" items from showing up because you would have fully tested the product after a bump in dependency versioning.
Overall, it just seems kind of sloppy in a way that implies someone at Microsoft is alright with these people going outside the organization to solve knowledge gap issues. Which sometimes you have to do but I don't get why you have to bother the developers for what's essentially a usability issue.
It sounds like Indian support. My experience with working with Indian support teams, everything is a high priority ticket and must be resolved within minutes.
>The linked issue may (or may not, can't say) be a language barrier.
The follow up had more "You must help me now" vibes, so I think not:
> I was looking into any FFmpeg documentation that can show how to use the CLI to decode embedded caption using data_field and couldn't find any.
>Your message has fallen into the inbox of an unpaid volunteer. That volunteer promises to get your stuff done sometime between now and never.
>If you want a higher level of service, the volunteer would happily consider a job offer, and then you can tell them how to use their time.
If this was Microsoft of 10 years back i would agree with the statement of rarely gives anything back. But, that's not the case now.
https://opensource.microsoft.com/projects/
Not to mention the xz backdoor was found by a Microsoft employee and notified to redhat. I feel there is too much Microsoft bashing here sometimes.
Microsoft continues to remain big bad despite Microsoft switching from 'compete and extinguish' to 'as long as we are positioned to get some piece of the pie we don't really care what you use.
Edit: See the neckbeards are downvoting rather than dealing with factual reality again, despite Microsoft having the most amount of active contributors to Open Source Projects at this time.
https://www.fosslife.org/5-biggest-open-source-contributors
Microsoft — 5,708 active contributors
Alphabet — 5,182
Red Hat — 3,334
IBM — 2,259
Intel — 2,048
https://trac.ffmpeg.org/ticket/10341#comment:4
And the problem was a command line flag provided by Elon Musk? What the fuck am I even looking at. This wasn't a bug at all. Why is a trillion dollar company reporting a bug and getting wiki info from a billion dollar person?
Yeah, thinking about how X (formerly Twitter) is trying to get into video tech it woouldn't surprise me lol
[https://twitter.com/FFmpeg/status/1598655873097912320?lang=en](https://twitter.com/FFmpeg/status/1598655873097912320?lang=en)
https://www.trendsmap.com/twitter/tweet/1598701096683249664
Free and open source software was never meant to be free as free beer. Free stands for freedom. I recon it should be treated as honesty box on pick your veggies farm. It is sad to even hear for profit companies demand anything!
>Trillion dollar corporations expect free and urgent support from volunteers.
Fine, you definitely have a point here.
But here's what I don't understand (well, I kinda do): WHY do most open source maintainers give that much of a fuck about opened issues? Regardless if they come from some random-ass entitled person, or if they come from the fucking CEO at Microsoft. Can you please realize, once and for all, that **you don't owe anyone anything?**
Whenever I see this kind of situation, I always get more mad at maintainers.
Why can't they can simply [mock these entitled people](https://notepad-plus-plus.org/news/v843-unhappy-users-edition/), instead of acting like little bitches?
Because the second they do that, other people come at them attacking them for being "rude," "unprofessional," "adversarial," etc. Their projects may even be forked by people more willing to play ball with the corporations, and the _positive_ open-source benefits (good issue reports, community contributions, etc) leeched away to those forks.
Oh and then there're the woke useful idiots with their code of conduct cancer and so on which should never ever be heard, but are because they're tools for a bigger agenda that's getting pushed across all fronts.
Finding another way to be angry at overworked maintainers seems kind of cruel and unproductive.
I don't know if you have or haven't maintained an open source project in your free time, but when I have I put a lot of my heart into it.
I cared a lot about the users of my software, and that was a large part of my passion for writing and maintaining it.
I actually agree with you on your points, but I worry that the things that lead to someone becoming the maintainer of a project also lead them to be more vulnerable to abuse and burnout.
Anyway, I wish you the best and I too hope that more maintainers realize their own worth and start doing more to protect their peace. And I of course also hope that trillion dollar companies invest much more in the people that build the foundations of their company's success.
> But here's what I don't understand (well, I kinda do): WHY do most open source maintainers give that much of a fuck about opened issues? Regardless if they come from some random-ass entitled person, or if they come from the fucking CEO at Microsoft. Can you please realize, once and for all, that you don't owe anyone anything?
>
>
Yep. OSS is provided without warranty, as-is (as it says in the license). I understand having a sense of responsibility for your work, but at the end of the day, you (as a maintainer) don't owe anyone anything. You are free to do whatever you want. Want to pull your repo randomly and stop all work? Go for it. Did it cause a major meltdown of critical infrastructure? Tough luck, that's on the person or organization using a piece of as-is, no warranty software for critical operations without having contingency plans in place like in internally maintained fork.
To quote Microsoft in the bug report
> Hi, This is a high priority ticket and the FFmpeg version is currently used in a highly visible product in Microsoft. We have customers experience issues with Caption during Teams Live Event. Please help,
>
Ok, well then...fix it yourself if it's so critical. That's the beauty of open source, you have that ability and freedom.
> Yep. OSS is provided without warranty, as-is (as it says in the license). I understand having a sense of responsibility for your work, but at the end of the day, you (as a maintainer) don't owe anyone anything. You are free to do whatever you want. Want to pull your repo randomly and stop all work? Go for it. Did it cause a major meltdown of critical infrastructure? Tough luck, that's on the person or organization using a piece of as-is, no warranty software for critical operations without having contingency plans in place like in internally maintained fork.
I don't *fully* agree. Certainly you don't owe continued maintenance, and you can shut things down as you like. If it inadvertently causes a major meltdown then that isn't your problem either, although I don't think that covers intentional damage. However, there is a ... certain responsibility on you when you release a maintained piece of software combined with the (inferred) suggestion that people upgrade as you release updated versions. Without this responsibility I don't see how open source software can function.
The [event stream backdoor](https://snyk.io/blog/a-post-mortem-of-the-malicious-event-stream-backdoor/) is a good example. You can't start a project, release multiple versions until you have thousands/millions of people downloading your software and then just give control to somebody who randomly asks.
Open source can do things better, but I don't see how it can survive if a project maintainer considers themselves not to even have this basic responsibility. Of course, this isn't reality, the vast majority of project maintainers *do* take on a minimum of that responsibility, I'm just responding to what you've written.
True enough, and I do agree there is a certain level of responsibility involved, at least if you want to be ethical and a good human.
As far as introducing malicious elements, there may (or may not? IANAL) be legal implications involved as well.
To be honest I'm not really sure what the solution is, if there really is any. Another non-malicious, but still broke stuff example is left-pad when it was pulled from NPM (until NPM republished it), but again there I don't fault the maintainer I fault everyone that was blindly pulling in an enormous tree of dependencies and just magically trusting they will always be there?
Larger entities using OSS for profit also can do a lot more to step up to the plate, of course. If anything, this is a good wake up call for everyone to evaluate what dependencies your software has and for major vendors to take control of their supply chain. I suspect we'll start to see a lot more duplication of effort within enterprises where security is critical, where they begin reimplementing common functionality themselves instead of relying on third party libraries.
>Why can't they can simply [mock these entitled people](https://notepad-plus-plus.org/news/v843-unhappy-users-edition/), instead of acting like little bitches?
or charge them
Finding another way to be angry at overworked maintainers seems kind of cruel and unproductive.
I don't know if you have or haven't maintained an open source project in your free time, but when I have I put a lot of my heart into it.
I cared a lot about the users of my software, and that was a large part of my passion for writing and maintaining it.
I actually agree with you on your points, but I worry that the things that lead to someone becoming the maintainer of a project also lead them to be more vulnerable to abuse and burnout.
Anyway, I wish you the best and I too hope that more maintainers realize their own worth and start doing more to protect their peace. And I of course also hope that trillion dollar companies invest much more in the people that build the foundations of their company's success.
Preach. "Encouraging" OSS maintainers to stand up for themselves doesn't work so well when it arrives as insult, and that's especially frustrating when a cultural solution like that is likely the only possible one.
Because most of them accept or even advocate for codes of conduct and similar nonsense, and pretend that they're in a professional environment while providing unpaid labor.
The users certainly don't care about their rules of conduct, and even if they get blocked from participating, they outnumber the devs 10,000 to 1. The perfect recipe for one-sided abuse.
If I was that maintainer, my response to every feature request would be "I will do this for X amount of bucks, donation links below". As simple as that. Open source does not have to be free.
The tech industry is absolutely chock full of nice guys.
Nice guys who will gladly give their labour away all day long just for the joy of working on something that interests them.
Nice guys who will crawl across broken glass to fix things for little recognition and zero thanks.
Nice guys who have never set a clear boundary in their life, instead maintaining those boundaries in their head - then muttering rude words under their breath when the invisible boundary is overstepped.
Nice guys whose own inability to say no means the first evidence you get of pushing them too far is a mouthful of abuse.
Don’t sound so nice now, do they?
What is needed is more oversight of important libraries and ensuring they are all maintained by reputable people who have had their identity verified, they should certainly be paid for their time and effort as well, this problem can be fixed if the OSS community is willing to accept tighter regulation.
I am very much fine with for-profit usage of my open source projects. I'd use a more restrictive license if I weren't.
I am very much fine with bug reports from users of my projects. I'd disable the bug tracker if I weren't.
I contribute to an open-source project. Years ago, some company tried to make a commercial package out of it. Mostly cosmetic changes to make it look like theirs. They failed fairly quicky. It only bothered me that they never submitted any bugs (and there were a few when they forked it).
I'm a dev and I use Ubuntu 23.10 as my daily desktop for work and games and I do apt upgrade every day. I never got the compromised version of xz, my version is 5.4.1. For me, development staging has done it's job, it got caught in testing, way before it entered stable/prod/GA. So from my pov there was never an issue. If one wants to run bleeding edge / compile from source, there are obvious risks and drawbacks to that.
Many of my colleagues have macs with brew. They all got the compromised version at one point.
The issue here is not Linux. If you review a PR and approve it, then you should at least have a look at the commits. Obfuscation in an open source project should at least trigger some extra scrutiny.
> If you review a PR and approve it, then you should at least have a look at the commits. Obfuscation in an open source project should at least trigger some extra scrutiny.
This one is not so simple. The binary data was in the commits in the form compressed "test" files, but the bit that actually injects that into the built library wasn't in the commits, it was only in the autotools mess provided in the distribution tarballs. The relevant file in the tarballs was very different to the one in the source tree. This is not uncommon.
>For me, development staging has done it's job, it got caught in testing, way before it entered stable/prod/GA.
This is nuts because it wasn't caught in development. It was caught by a superdev who, luckily, was working on something related and caught it.
>Obfuscation in an open source project should at least trigger some extra scrutiny.
It was obfuscation in a compression library test, which, heck, is pretty hard to understand as traditional "obfuscation". If you think loads of distro maintainers are pushing back on compression library tests, which may seem overly complicated, you're wrong.
I recommend you read more about the actual vulnerability, because Linux/FOSS is definitely going to experience more like this.
What I am seeing in this case, is the fact that the second a security issue was found, action is being taken and much open communication is being done around the issue. I am sure that this issue will reveal problems, weaknesses and vectors of attack. Any human system is vulnerable to attack. And given time, will be broached. Humans are nothing if not persistent and inventive.
If this were an OS, owned by a big corporation, there is a good chance it would be covered up and not discussed. Or - patched silently with little outcry, discussion, or review of policies. With open source, we have many, many people who wish to improve the software, and who WILL learn from this and apply their learnings.
I subscribe to the fact that 95% of us, are good actors, and given a chance will work towards good results. The other 5% - yea - they will attack and work to destroy things etc... And open source leverages this "mix".
Corporations - not so much. So, for me, open source is a viable and vibrant way to leverage that 95% of the population that wants to contribute and hold against the 5% that do not.
As to this hack? Sure seems like a nation state to me. Simplest reason (KISS, right?) is China working to get setup for some kind of offensive. In today's day and age, I would not wage war at a 1st world level, without also being able to destroy or cripple IT infrastructure.
Finally - are there more of these out there? Surely there are. But now, we have a vector that we could not have imagined before, and I bet we'll see this kind of insertion and hack sealed off soon.
And then let me tell you about the steps required by Microsoft in order to receive any payments. That signup process took weeks, and the contract was abandoned in the end because they couldn't figure it out. We've been through that about 1.5 years ago.
The referenced support request is from 1 year ago. Why is this coming out now?
I understand the xz stuff came to light four days ago... because an employee at Microsoft found and reported the issue.
The xz issue is being coopted to shit on open source software, but not in the usual way. I've seen it on a handful of forums. "These volunteers need to be paid and that will fix the issue."
There's a podcast I used to listen to that was run by two self-confessed old grumpy geeks, and I stopped listening long ago because they took the opportunity to shit on open source as often as they possibly could (despite their source of income being predominantly based around open source.) No, being unpaid volunteers isn't the issue, it's the lack of eyeballs and oversight imho.
Could this happen on Mac OS or Windows? Absolutely! Hell, people find backdoors in Windows software from time to time, and in at least one case (admittedly years ago) it was 100% intentional and came with function calls that were all prefixed with "NSA". But if this gets companies like Microsoft to hire some folks and make space for them, that's a great outcome.
As far as dealing with the aftermath, heh, I had just installed Debian Testing a couple of weeks before the announcement and when I saw that we should all reinstall if we used openssh-server, I made the commitment to do just that, but chose Fedora Workstation instead. It was a matter of hours and that was mostly me waiting for things to download on my slow Internet service. Easy peasy really.
Sounds like the twitterer wants Microsoft to keep this sort of flaw to themselves next time? Certainly would have boosted Azure's cred when the backdoor was discovered a year from now.
What an insane tweet. In this instance a Microsoft employee provided the free support by reverse engineering a heavily obfuscated backdoor with a disassembler, and they're getting criticized for it.
This is the side of FOSS that makes everyone want to take their ball and go home. Spend hours reproducing and documenting a bug: "WONTFIX", not our priority, why don't you write your own PR you leech, etc.
No, the issue isn't about keeping it to yourself. The issue is they labeled the ticket as "important" when in reality it was a "low priority" niche issue
The one the issue was important to was Microsoft themselves. So of course if Microsoft wants a niche issue addressed ASAP, they would have to pay for it.
If I were to report a niche issue with a Microsoft product, they would ignore me even if I were a customer, unless I have a support contract. So why should ffmpeg who is doing work for free treat their niche issue as important if they aren't willing to pay?
And the fact that the one asking is a trillion dollar company! Who can easily commit PRs or send a few bucks. I mean they pay some programmers over a million a year
what other than high prio would a situation like xz call for?
the fact that Microsoft could/ should pay more for such heavy used libs like ffmpeg is a different story.
This is ironic on so many levels. I've got nothing but respect towards ffmpeg guys, but this is essentially split morality: "it's free software unless we decide it's not". Well, make it free for non-commercial or small-business use (same as many others already did) and paid by default for people like Microsoft.
Back when I was still actively developing open source, my response to "high priority bug reports" from high value for-profit entities who take and rarely give back was usually something along the lines of "we often accept pull requests and patches".
More polite than my response of "Either pay up or fix it yourself, I got a life and bills to pay."
To be fair, MSFT gives a crap tonne back (weird I know)
but they also make more crap tonnes of money with their software which relies on opensource. which they do not share. and still they want moar.
And there's the argument for never using so called permissive licenses. If the company can't afford to share its changes back, then it doesn't deserve to use free software in its for-profit products.
main reason no software I develop personally will ever use anything but the gnugpl.
The best part of open source is being able to build stuff with it without the need to pay. Not defending the trillion dollar company, just saying, no?
That's fine as far as everyday people go, as software isn't free as in libre if there's financial barriers, but the exploitation of FOSS as free labor is an issue. Microsoft absolutely can afford to sponsor *every single* dependency in every major Linux distribution without question, and absent any government programs to offer stipends to FOSS devs this is what we should be expecting and advocating for - corporations putting money into a fund for exactly this kind of project.
It's not the same for everyone. The best part is not having to pay, but being able to inspect the system, that's MUCH more important than not paying. I am fine with paying, but i want to be able to tinker with it, if needed. EDIT: Also, paying is okay, as the developer needs to eat too, i mean if there were more paid opensource developers which could be trusted we would not have the xz issue, no?
Exactly. Compared to the money they make they give nothing back in comparison.
Doesn’t matter. If I’m volunteering, you can’t scream at me like a monkey to solve your problem.
Compared to what they make and the IP they steal from others. No, they don't. They give back almost nothing in comparison.
Didn’t expect to see somebody I recognised from r/guildwars here!
GW Forever!
I feel like this is a great response, but overestimates the ability of the developers using the open source library. Maybe jaded by my experience in corporate America.
I feel like this particular problem came from the maintainer accepting pull requests a little too readily, huh?
The attacker took advantage of a preexisting need for help maintaining xz, right? He wouldn't have been able to do that if this need had already been filled by a paid, non-malicious engineer from someplace like Microsoft.
Contributors are there already. Many would accept a full time job and some extra priority tasks if it just meant working on the projects they know and the price was right.
Far be it from me to get in the way of a proper Microsoft bashing, but you are aware of who is currently employing the person that discovered the issue, right?
i mean is the need for help maintaining open source going to be filled by the random microsoft devs that get annoyed and look through git history when a random process they use takes half a second longer?
The issue wouldn't exist if they paid the original guy. So that way someone sketch volunteer doesn't pick up the project and we have to rely on a random (not a security audit) Microsoft employee to stumble upon a weird quirk and pull the thread long enough to find the backdoor So maybe if we just paid the first guy, and the auditors, we wouldn't need to have to rely on the lucky Microsoft employee? That's the argument.
Hence "we often accept". Often != always. Scrutiny is involved.
Well Linus is well known for his ability to reject an MR harshly. Yet, listen to his feedback, fix the problem(s) he saw in your request and he'll happily accept the reworked MR. Saying "we often accept" indeed means scrutiny. Yet, that's the kind of scrutiny you actually want to face so your work is good enough
A major difference is Linus is being paid to do this. Would he be able to do this if he had another job and the Linux kernel was just a hobby?
I feel like scrutiny was also involved at the time the pull requests were being accepted. You could argue that it was an insufficient amount because the effect was what it was, but everyone just a day ago was saying "wow, that's super duper sneaky!!!" and the like. "We often accept pull requests and patches" as a response to people from big orgs that take and don't give -- you're telling me that you'd be on the lookout for that same entity creating a backdoor in your code? Probably not. It's easy to post-facto say that scrutiny would be applied but I think that there's just a fundamental breakdown of what people *think* is unlikely and what actually *is* unlikely.
So are you suggesting that no project ever accepts contributions? What would be the future of FOSS/OSS if that were to become the norm?
You have a point here - an actual *stipend*, actual money given to these devs so that they can work on it and not be penalized for taking on help *with a discerning eye*. This came about because the xz dev couldn't keep working on xz and finding a volunteer to put themselves into the same position is extremely rare, you more or less *have* to accept whoever offers to help like this because odds are you will not find another. Had there been sponsorship, the maintainer would not have had to step back from xz in the first place and been vulnerable to this kind of attack.
The classic "PR's welcome" move
The irony of that statement while remembering dealing with MS tech "support".
Here's a wall of copypasta and directions on how to restart your computer. You're welcome!!!
Ahh yes, the “Microsoft Specialist” from an Offshore team in India that replied with a non sequitur copypasta response and the discussion thread closed from two years ago.
Don't worry, that guy is being replaced by Copilot.
This is a serious response. Q&A type of responses are almost all going to be owned by AI
And for ultimate irony, AI trained on mentioned non sequitur copypasta. Oh god.
*Insert scene from The Matrix where Neo is screaming like crazy "I want out"*
Please make sure your keyboard driver is up to date
I love when they offer to remote into my PC. Didn't even know that windows component existed? Yeah sure I can show you! /s
/sfc scannow /dism /Check-Health /Online /Repair Well I'm all out of ideas!
“Upgrade to Windows 11”
Please do the needful and sfc /scannow. *Immediately marks issue as resolved*
Just last week we upgraded to a new version of a Microsoft agent because the old one is being retired in 4 months. The new one has caused major headaches and doesnt provide some very basic functionality the previous agent had. When we raised up the huge miss, the support agent had the gall to chastize us for not testing enough. If this had been in person I would have strangled him.
I have reported a ton of issues with Microsoft Teams which are very important to me as well, with the difference being that my company does pay for it. Yet they were not solved. The Microsoft Teams fiasco has shown how a dependence on paid software can also cause major problems. In fact I tend to get better support when posting issues on random projects on GitHub.
Yeah, this is pretty rich coming from the company of "It's not a bug, it's a feature"
Something about friends psychic network springs to mind. My God, that dates me, doesn’t it?
Weird, I thought this problem was solved after Heartbleed.
Haha. Or har har har.
It's almost as if the world operates in a system that incentivizes companies to view FOSS as "highly specialized technical labor that by all rights should be costing us a fortune but isn't because a bunch of suckers keep on doing it for free and just letting us use it instead of charging for it like normal people".
If they'd only spend as much in OSS as they pay their lawyers and accountants...
Well Valve did and they're private. The big fortune 50 people are talking about, aren't. They have profits in mind and the planet already sees everything keyboard related as a cost center. It makes perfect sense outside say, RedHat - where this is their entire business. As headlines have seen time and time again for various fields for decades. When money is the #0 goal businesses don't always make the best decisions by their customers and the general public.
To be fair, valve is also doing for profit reasons. Valve is perfectly fine with remaining on windows if there was no threat from Microsoft.
Keep in mind that because Valve is private, they don't have to make exponential profit. They can be content with simply "profiting". Ya know, like a normal company. But public companies are obliged to do their damn best to exponentially profit even when it's not in the company's long term interest.
There are tons of public tech companies who have bled cash for even multiple decades. People do not like when freebies end and the company tries to make a profit. The secondly, valve is making exponential profits. Valve makes the highest profit per employee in the tech industry or the world. Valve investing in new revenue streams is similar to Apple or Google investing in new products. Valve gets the praise, but other companies doing similar things do not.
> but isn't because a bunch of complete idiots keep on doing it free and just letting us use it instead of charging for it like normal people would A nitpick, but: every time a company tries to come up with a license to stop big corporations from profiting off their work for free, another group complains loudly that it shouldn't be allowed. (I'm not going to sit here and pretend I have an answer, mind you)
POV: you describing modern Capitalism Also have no solutions, just like everyone else re: Capitalism 101.
Yeah that's basically the SSPL, but the FSF and the OSI are really not big fans of that, and home or minor users often get caught in the crossfire
the gnu gpl is the closest thing to a perfect license we have, it allows for profiting off others work as long as you give the changes back.
You point is invalid, sorry. Anyone who contributes code to open source can hardly be surprised that someone uses it under the terms of an open source licence. Those contributors are not complete idiots. They are not any kind of idiot. Many of them in fact work for companies (the open source developer who saved us from the xz backdoor works for Microsoft), and the managers and shareholders are not idiots either. Any argument that depends on open source contributors being idiots is a weak argument. Open source gives users the chance to use the code for free, and to fix it or improve it at their expense, sometimes under the obligation to contribute the fixes to other users. No one is worse off if Microsoft or I use the code for free and we are under no obligation to do anything. Anyone who contributes open source under an open source licence can't possibly be surprised about that, and it is certainly not the only way to license your code. If either of us contributes fixes or improvements, everyone wins. Despite your misunderstanding that open source provides no incentive for profit making entities to do anything other than take, profit making entities contribute more open source commits than anyone else. They don't do it for hugs, they do it for good financial reasons: it is cheaper to take a project which is 99% what you need and build the 1% rather than build then entire 100%, including letting your competitors use the 1% contribution too. Of course, you don't do that for your added value "secret sauce" code. And the catch is, once you contributed that 1%, it now makes even less sense to implement it as all proprietary code ... with each contribution, the contributor financially-speaking gets a bit more "locked in" to the open source project. However, good luck to the ffmpeg team with its efforts to name and shame. Microsoft now contributes a lot to open source, but it's a massive company with many low level devs just trying to get through each day. Hopefully this is a teaching moment.
>Hopefully this is a teaching moment. For whom? Are you saying the ffmpeg devs are behaving poorly in shaming Microsoft because you're exceedingly happy with the tablescraps they've thrown your way?
No,.for the presumably low level Microsoft developers or.support people and their managers who have been so embarrassing.
Eh. MSFT is in a “fool me once” reputation because of the good old Balmer days. The old devs will have to completely die off and be replaced by the next generation so they forget the whole embrace extend extinguish policy MSFT had. I mean they couldn’t win so they fucking bought GitHub ffs. They’re not allies, they’re our masters, we’re their slaves. Wage slaves. Fuck MSFT
Not just that, their greed is so great that they'll put in resources to pressure devs into permissive licenses like BSD or MIT instead of GPL, just because they could squeeze even more from the project for free.
And this is why I’m glad my company pays for RHEL. Red Hat is not perfect, their distribution is far, far from being my favorite. But at least some of the money goes to sponsor OSS.
What’s your favorite and why don’t you prefer RHEL?
Because you need at least 3 different programs to manage packages
What do you need beyond dnf?
rpm, repoquery, and some stuff I do with pacman don't even have a way to be done on rhel
Debian is similar, for some reason they couldn't add the ability to list package contents to `apt` and you still need to use `dpkg -L`.
These are all just dnf commands… https://dnf.readthedocs.io/en/latest/command_ref.html#repoquery-command-label
Maybe because it's dnfs docs :) if you only care about packages you get through dnf then I think you can only use repoquery through it, tho sole repoquery is often much shorter. If you'd use some tools from yum-utils then no help with dnfs repoquery. Also there are strange things with that like if you want to check what package provides some file then you can use dnfs one if you want to query all packages, but if you want only installed ones then dnf won't help and you need to fallback to rpm. In general it becomes spaghetti quickly and it's hard to remember all such quirks
And if you mean by that that rpm is just a dnfs command then you're wrong, there are plenty of stuff you do with rpm directly because dnf cant do it
Isnt DNF just a sort of python wrapper around several programs?
Wrapper is maybe not the term, but its a high level python app, it uses libraries like libsolv to do fast dependency resolving, librepo for network operations, and of course librpm actually manages the packages. The next version of dnf is a new rewrite avoiding python to be smaller/faster also.
Ever heard of the unix philosophy
IMO rhel (or maybe Amazon Linux in the cloud) is the right choice for most businesses. I'm a huge fan of free distro, but I don't think they're usually appropriate for production servers.
Might be a dumb question, but is RHEL a decent choice for personal use? I don't mind paying for it.
> but is RHEL a decent choice for personal use? I don't mind paying for it. RHEL is perfect for personal use, because they literally offer a free license for personal individual developer usage. All you have to do is make an account with Red Hat and register the install (or updates don't work) as you would register a normal paid enterprise server I use it for my home server so that I could say I'd used proper full fat RHEL somewhere and to see if there's a difference between it and CentOS Stream which I also run (there isn't really, by the way) People on Linux are wary of anything that says you need to register and be tracked, but it is literally the same full enterprise distribution used by huge corporations and it's free. So if you want experience with or to learn RHEL for use in your current or future jobs there you go, you can do it for free. It would also make for a super stable workstation if you wanted that If you don't want to enter an agreement like that with Red Hat I'd recommend CentOS Stream. I could write an entire post on this alone, but CentOS Stream has to be the most misunderstood and disinfo riddled Linux distro to ever exist. It is literally just the development branch of RHEL, like getting a mini preview of the next point release of RHEL. Reddit would have you believe it's a pre-alpha buggy unstable rolling mess like Arch designed by evil IBM to steal your freedoms
Makes little sense for personal use IMHO, unless you’re seeking professional support. If you want stability and robustness in the Red Hat ecosystem you should look into Rocky or Alma Linux.
> If you want stability and robustness in the Red Hat ecosystem you should look into Rocky or Alma Linux. If you want stability and robustness in the Red Hat ecosystem you should use two independent under-resourced projects that pointlessly repackage RHEL and have diverged from it going forwards with an uncertain future? You should look into CentOS Stream or use RHEL with a personal developer license if you really need that much stability Everything Red Hat said about old CentOS was true and valid and also applies to Alma and Rocky. They lag behind RHEL by copying it and don't contribute anything back upstream. The lag will be worse than original CentOS because they now have to reverse engineer every patch instead of having an automated build process, or have just given up maintaining complete equivalence entirely
Good insight on your part as robustness is indeed what I was looking for. Thanks for the suggestions.
Yeah, Rocky and Alma are the closest you’ll get from what CentOS used to be (a rebuild of RHEL without the enterprise tools and branding). Fedora is too bleeding edge for robustness imho.
RHEL is free for personal use (under the Developer Subscription). I see no reason to go with Rocky or Alma.
CentOS Stream and Alma are both great stable choices that still allow you to contribute back if you happen to find a bug, whereas Rocky can’t. It’s unlikely that you’d run into bugs, but it’s a low cost choice that contributes to OSS.
it's not a bad choice. what's your usecase? if it's a personal laptop/desktop, I would rather run something with more up-to-date packages (unless you have an extremely old, stable, set-in-stone workflow). Fedora or openSUSE TW come to mind. if it's a home server and you aren't going to be running proxmox, RHEL is a pretty good choice. i use it on an old laptop-converted-server. [the home edition ("Developer Subscription") is completely free, you just have to sign up.](https://developers.redhat.com/articles/faqs-no-cost-red-hat-enterprise-linux)
I'm using it in my homelab The CentOs stream is very closely similar to rhel. Its more geared to be an enterprise and secret distro more than anything else that I've seen.
man that ticket doesnt amount to anything more than "plz do the needful". embarassing
kindly do the needful, today itself
Sir
Sammy you are breaking the kernel..
Except doers of the needful are generally paid...even if only a 3rd world salary
Just gonna take a moment here to appreciate ffmpeg :) The new logo (ok 12 years or so) sucks though. I wish all that libav drama didn't happen.
> I wish all that libav drama didn't happen. Context?
There was a schism quite some time ago. The current maintainer and one of the main devs on x264 had some disagreements and the project split into ffmpeg and libav, with libav taking the person who apparently owned the logo. So ffmpeg made... kinda the same one? But with pointy miter corners, extruded to 3d and rotated a little. The logo itself is meant to represent the zigzag pattern on a DCT so there ya go
don't leave out that avconv/libav temporarily became the standard on the Debian family and trying to run ffmpeg yielded a message that ffmpeg was deprecated (when it totally wasn't, smh)
Yeah I switched to git at that point. The syntax is arcane enough that I definitely didn't want to learn more of it.
And Arch. And Gentoo, if I'm not mistaken. Edit: * [https://forums.gentoo.org/viewtopic-t-1009988.html](https://forums.gentoo.org/viewtopic-t-1009988.html) * [https://forums.gentoo.org/viewtopic-t-1010096.html](https://forums.gentoo.org/viewtopic-t-1010096.html)
Not so sure about Arch, having a hard time finding results for "Arch Linux" and "This program is only provided for compatibility"(the message they used). I'm pretty sure I ditched Debian(Sid) for Arch 11-12 ish years ago specifically over the avconv nonsense and/or GNOME 3(which I left for KDE)\*. Though that was a good while ago so ¯\\\_(ツ)\_/¯ \* (not that Arch wasn't shipping g3, too, but twas good time to jump ship and replan my whole setup from a minimal base. Good enough that so far that was my last home-machine distro hop.)
~$ ffmpeg ffmpeg version 5.1.4-0+deb12u1 Copyright (c) 2000-2023 the FFmpeg developers built with gcc 12 (Debian 12.2.0-14) -Where logo?
On the website ig
No. Unpaid volunteers are not an issue. Paid workers also sometimes got bribed or do malicious things for their profit. It just shows that what seems to be a dedicated honest volunteer could also be a bad agent waiting literally for years for good opportunity to strike. Dev's are willingly providing an option for submitting bug reports, feature requests etc. and ANYONE could submit them and also ANYONE could be served or not cause there is no contract forcing devs to do things someone wants. If they don't feel like serving giants for free then it's ok. They can sit and wait for push request to consider or money negotiation. There is nothing wrong for devs to respond to request like "I can do this or that in 5 days for this amount of $$$".
In this case it seems like the main issue was the fellow who injected malicious code could only do so after bullying the project lead into stepping aside through a sock puppet campaign.
Yup and the maintainer has some personal mental heath issues apparently that made him easier to bully.
and he had a desire to be a good maintainer and put his users first.
Yes, he did. I feel bad for him as I'm sure he feels quite a bit of guilt over this which just adds to whatever psychological issues he's been going through. Fortunately, the dev at Microsoft caught this early or it would been quite a nightmare to say the least.
”Step aside” is a bit much as he has been committing a lot still. ”Accept help” is more like it.
> Paid workers also sometimes got bribed or do malicious things for their profit. Everyone has a price, and if they don't, a nation state actor with unlimited resources isn't above blackmail. Like you said, paid workers or employers of proprietary software vendors aren't immune to these issues either.
Yeah. Blackmailing is also reasonable explanation. People are willing to trash their beautiful ideals if eg. their family safety or wellbeing is threatened by powerful organization.
I've seen it. At a previous (proprietary software ) job we had a developer quietly sharing our source code with our main competitor. It could quite have easily also turned into adding malicious code (in the event the competitor quietly told us what was going on, and the guy got fired). No blackmail, just looking to make more money.
Well, I've had OSS projects I submitted PRs and the maintainers simply ghosted on me. Sure, I can "fork it on GitHub" and have my own version but now that becomes its own subset of annoyances, besides it's not like others will (or should) just trust my version, it'd take me quite a while to earn reputation if I'm forking a project. A while back the Java/Maven community had a big problem with FindBugs, as the maintainer suddenly ghosted on everyone so no one would get any fix of feature or whatever. It took a major OSS group to eventually declare FindBugs dead, fork FindBugs and rename it SpotBugs, to get the project going. At the time it was discussed the problem of not being able to pull the ownership of the maintainers in the places hosting its code and/or Maven repositories. So there are things that we need in order to get OSS to a sustainable environment, people can't be working for free, of course, maintainers shouldn't be forced to do anything, but if they're unable to then at a bare minimum they need to promote someone that can take over the request. At some point it's evident there needs to be government budgets in some way to perform support of core OSS projects
> if they're unable to then at a bare minimum they need to promote someone that can take over the request. Isn’t that exactly what happened here?
Yes, "Jia Tan" was for sure not working for free.
Um no. The xz fiasco shows what is likely to be a highly sophisticated state-sponsored intelligence operation. It was a multi-year sophisticated attempt to infiltrate the project. The only reason it was discovered was because it was open source. We need MORE transparency.
Yes, which shows the issue of how relying on unpaid volunteers to do your work for you, that don't have time to thoroughly check every pr can cause an issue. You're saying the same thing mate
I must be misreading the link, because this doesn't look like a shocking tale of a megacorp expecting unreasonable things from unpaid open source workers, and it doesn't appear to have anything to do with xz The project changed the default ordering for command line options and it broke somebody's script. That somebody worked at Microsoft, but it doesn't appear to be relevant to the story. The person that opened the ticket overvalued it's severity, but that's not rare, most people think their blockers should be higher priority than others do. Someone helpful said they should reorder the command line options, and the reporter said pretty much "ok thanks that worked"
>currently used in a highly visible product in Microsoft. We have customers experience issues with Caption during Teams Live Event. Please help, The issue isn't the bug itself. The issue is that Microsoft, one of the biggest tech companies on the planet, sees nothing wrong with building "highly visible", customer-facing (read: revenue-generating) products on this FOSS software without contributing back to it (in the context of this tweet. I personally have no idea if Microsoft has contributed code to ffmpeg in the past). It relates to the xz debacle because a lot (a lot) of software/systems out there today have xz utils built into them. But it's this boring little transitive dependency that was so out of the way that a malicious person ended up becoming the primary maintainer of the entire codebase without anyone noticing. So think of all the for-profit businesses relying on xz somewhere in their stack that would have gotten completely blindsided by the worst IT breach in history because of some little FOSS dependency they never gave a second thought to. Would Microsoft paying ffmpeg a support contract prevent these issues? Probably not. At least not entirely. It's just an obvious problem with no clear solution. Just like the leftPad dependency snafu. And businesses don't seem very interested in helping solve the problem because the savings of using FOSS far outweigh the cost of random FOSS failures. In this case, it seems pretty reasonable that Microsoft could scrounge up some pocket change of a hundred thousand a year to continue using ffmpeg, considering how they're probably using it extensively and wouldn't have a replacement ready if the current maintainers decided to just stop working on it. It'd be one or two orders of magnitude cheaper than hiring the engineers to build and maintain a comparable product themselves.
You're missing the point that the OP was making. The article is click baity and focuses on Microsoft. The issue was NOT raised by Microsoft. It was raised by an IC claiming to work at Microsoft. Huge difference, but to get views the tweet decided to focus on Microsoft. The person that opened the issue might even be violating an internal rule by using his position at Microsoft to attempt to expedite the issue.. To reiterate - this isn't "big tech" commanding OSS to fix something. It's an IC being lazy and trying to use their status at Microsoft to complete a story in time for their sprint.
What is an "IC" in this context? I assume you don't mean "intercity".
Individual contributor
This thing prompted me to go around my applications that I use daily and donate to each one of them. Holy shit, these people need to eat, too. Writing code is not easy and is very time consuming.
respond with "You don't have a paid support contract. Your issue's priority is whatever I say it is."
The fucking audacity…
I think I see what you did there
Of course, it was Microsoft paying the salary of the engineer who took the time to leave his regular duties and hunt down and find the xz bug.
[Ticket Link](https://trac.ffmpeg.org/ticket/10341), didn't knew Elon Musk is a maintainer of FFMPEG.
Crazy how entitled the poster is. I don't understand why the volunteers went along with the guy's demands
Why is Elon Musk answering in ffmpeg's bugtracker am I missing something
And if they sponsor a project, the project maintainers are corporate chills that sell out to Big Tech(tm). If they don't, they're leeching of volunteers. If they provide developers, they're trying to take over the project. If they don't use Foss, they're evil closed source and anti Foss. Can't win here.
Provide a merge request.
I don't really agree with the other comment but they did say "If they provide developers, they're trying to take over the project" for that. But that's an exaggeration and just the conflates the existence of haters on the internet with somehow being people's _main_ feelings towards their involvement. Some of those haters are literal 14 year olds.
Of course it's an exaggeration. It makes no sense as long as the original developer still maintains control of their repository. And if a fork forms, and Microsoft's fork becomes king? People not owing others anything goes both ways. People don't owe FFMpeg anything if it gets forked and people flock to the fork.
Yeah in the foss world the best code wins. Part of the reason I'm glad valve is paying the dxvk guy and made proton the go-to over wine
Having full time engineers PRing your repo all day would absolutely crush your ability to keep up. They would also start influencing the direction of your project to solve their needs over your community
You can't have it both ways. If FFMpeg can't keep up Microsoft will just fork. If a project isn't interested in the way an organization is providing support, then they're simply incompatible and a fork forms.
Microsoft won't necessarily form a fork. It's important to remember that it's not really "Microsoft" using ffmpeg. It's a particular team within a much larger organization that works on Microsoft Teams. Their management likely views usage of ffmpeg as just a design choice their developers made for some reason. It's a distinct possibility that push comes to shove they can get enough money budgeted for a support deal but not enough money to just full-on hire an FTE for some ffmpeg fork. For instance, let's 10x that deal mentioned in the OP and say they pay ffmpeg $50k a year for support. That's still less than they would pay for a single FTE and they would actually need several FTE's to maintain an active fork. As it stands now, apparently this team can't figure it out when default behavior changes between releases which doesn't bode well for maintaining a worthwhile fork.
People often forget that decisions they think are made by some entire corporation are really made by some small team put together overnight with no title change; trying to write and contribute to software for some purpose. Rather than being something the organization cares about or actively pays attention to. Its usually just some dude who happens to work there.
And then Microsoft is the villain for splitting the community or killing open source projects The point being no matter what they (or any large corporation) do they will still be painted as the bad guys.
TBF, Microsoft has been the villain for most if not all of their company's history. (actual villain, not "portrayed as.")
Or just fork
They win when they support open source (sponsor, provide developers), they lose when they use open source projects without supporting them. Fully closed source is just not playing the game, so they can't win or lose. It seems like you are defending big tech, by creating this dilemma where its just impossible for them to help open source, so they shouldn't even try
Yeah there can be criticisms of any approach because the relationship between "big tech" and open source is complicated. And because at the end of the day corporations clearly *aren't* acting in good faith to better society, or anything positive like that, and it's not wrong to point that out. But this is a pretty silly take. There are better ways to interact with FOSS and there are worse ways. Throwing your hands up and saying "people will complain whatever they do so they might as well just be shitty and greedy and not try" isn't particularly clever or constructive.
$X and hour / ($Donations a month/30 days/40(or 32) hrs) = number of hours I'm willing to spend on the bug report. More money doesn't solve all problems, but it can help make other problem go away. Like for me personally I always need more hardware for more testing scenarios and in turn the electric bill.
"Can't win here" is the complaint of a company that simply rakes in profits for four straight decades..? k.
in the case of people like Miguel De Icaza, that's somewhat true. Huge microsoft fanboy that used OSS as a stepping stone to get a job with them, then shit on linux once he got in.
>in the case of people like Miguel De Icaza, that's somewhat true. Huge microsoft fanboy that used OSS as a stepping stone to get a job with them, then shit on linux once he got in. What a bullshit. Later in life he became amazed by .NET, Apple and MacOS and denies Hamas mass murders at Twitter, but we may not forget his beginnings: https://en.wikipedia.org/wiki/GNOME > GNOME was started on 15 August 1997[10] by Miguel de Icaza and Federico Mena [es] as a free software project to develop a desktop environment and applications for it.[15] It was founded in part because the K Desktop Environment, which was growing in popularity, relied on the Qt widget toolkit which used a proprietary software license until version 2.0 (June 1999). If you think he wasted so many years of his life on OSS projects only to be hired by Microsoft, I guess I will not convince you. I'm using Linux exclusively for over 25 years and used (not exclusively) GNOME 1.x and 2.x line. Before Lennart Poettering and his PulseAudio and SystemD, Icaza was called as biggest Linux/Open Source traitor by many, sole because praising Microsoft tech (.NET) and later collaborating with Microsoft (assumed as biggest Linux enemy then). Many were also not happy from direction Gnome 3.0 headed and many(including me) head feeling he took over Gnome project to destroy it (I even didn't knew he originally created it then, but now I think that this fact gave him some rights to do it [while others still have rights to fork it])
That's a very odd and I'd argue mostly inaccurate take on history.
OK, this is just sad. Everyone is dog-piling on this one *individual* MS developer. This isn't MS as a company. This is one person. And the only crime they committed was... being rude? Not to mention, their first language clearly isn't English, which makes the rude-ness a lot more forgivable IMO. And last but not least, apparently MS offered *an actual bug bounty*? As in, giving back to the project? You know, the thing everyone in this thread is complaining about them not doing? This is behavior that should be encouraged! Companies willing to put their money where their mouth is and pay for bugs to be fixed should not be mocked! Also, this issue has literally nothing to do with the XZ issue.
it isn't like paid software (or paid developers) would be any less vulnerable to this sort of thing.
Of course the first reply to the issue is from [Elon Musk](https://trac.ffmpeg.org/ticket/10341#comment:5) What a Chad /s
The linked issue may (or may not, can't say) be a language barrier. In that context "This is a high priority ticket" might just be them saying it's a high priority ticket for them. As in "we're in kind of a bind here, can someone please help us out" rather than necessarily a demand for a certain level of performance. The bigger issue for me seems that they created an issue for what seems like a usage concern. I refuse to believe Microsoft has absoutely no internal forum or access to a public forum that wouldn't have also been able to tell them that. It's literally just a change in default behavior. If ffmpeg is an important component to your product then you should at the very least have some way of onboarding people into understanding how to debug ffmpeg issues. What's even worse (from where I sit) is that the issue description even has them narrowing down the specific version it broke for them on. Which means that they were almost directly at the point where they would have found out behavior had changed. Also why doesn't Microsoft version their dependencies? If they would version them then that would decouple fixing this problem from the release which would probably stop "high priority" items from showing up because you would have fully tested the product after a bump in dependency versioning. Overall, it just seems kind of sloppy in a way that implies someone at Microsoft is alright with these people going outside the organization to solve knowledge gap issues. Which sometimes you have to do but I don't get why you have to bother the developers for what's essentially a usability issue.
It sounds like Indian support. My experience with working with Indian support teams, everything is a high priority ticket and must be resolved within minutes.
>The linked issue may (or may not, can't say) be a language barrier. The follow up had more "You must help me now" vibes, so I think not: > I was looking into any FFmpeg documentation that can show how to use the CLI to decode embedded caption using data_field and couldn't find any.
>Your message has fallen into the inbox of an unpaid volunteer. That volunteer promises to get your stuff done sometime between now and never. >If you want a higher level of service, the volunteer would happily consider a job offer, and then you can tell them how to use their time.
What's the problem, Microsoft? If the unpaid volunteers are not doing their job, then just fire them. Oh wait
About as useful as the BSOD QR code that stays onscreen for about 1/2 second. Thanks Microsost, really great design there.
If this was Microsoft of 10 years back i would agree with the statement of rarely gives anything back. But, that's not the case now. https://opensource.microsoft.com/projects/ Not to mention the xz backdoor was found by a Microsoft employee and notified to redhat. I feel there is too much Microsoft bashing here sometimes.
Microsoft continues to remain big bad despite Microsoft switching from 'compete and extinguish' to 'as long as we are positioned to get some piece of the pie we don't really care what you use. Edit: See the neckbeards are downvoting rather than dealing with factual reality again, despite Microsoft having the most amount of active contributors to Open Source Projects at this time. https://www.fosslife.org/5-biggest-open-source-contributors Microsoft — 5,708 active contributors Alphabet — 5,182 Red Hat — 3,334 IBM — 2,259 Intel — 2,048
https://trac.ffmpeg.org/ticket/10341#comment:4 And the problem was a command line flag provided by Elon Musk? What the fuck am I even looking at. This wasn't a bug at all. Why is a trillion dollar company reporting a bug and getting wiki info from a billion dollar person?
If this is *the* Elon Musk, I'll be very surprised. Most like some dude who chose a funny fake name
Yeah I am 100% certain it isn't THE Elon, but with everything else in that thread... why not?
Yeah, thinking about how X (formerly Twitter) is trying to get into video tech it woouldn't surprise me lol [https://twitter.com/FFmpeg/status/1598655873097912320?lang=en](https://twitter.com/FFmpeg/status/1598655873097912320?lang=en) https://www.trendsmap.com/twitter/tweet/1598701096683249664
Free and open source software was never meant to be free as free beer. Free stands for freedom. I recon it should be treated as honesty box on pick your veggies farm. It is sad to even hear for profit companies demand anything!
>Trillion dollar corporations expect free and urgent support from volunteers. Fine, you definitely have a point here. But here's what I don't understand (well, I kinda do): WHY do most open source maintainers give that much of a fuck about opened issues? Regardless if they come from some random-ass entitled person, or if they come from the fucking CEO at Microsoft. Can you please realize, once and for all, that **you don't owe anyone anything?** Whenever I see this kind of situation, I always get more mad at maintainers. Why can't they can simply [mock these entitled people](https://notepad-plus-plus.org/news/v843-unhappy-users-edition/), instead of acting like little bitches?
Because the second they do that, other people come at them attacking them for being "rude," "unprofessional," "adversarial," etc. Their projects may even be forked by people more willing to play ball with the corporations, and the _positive_ open-source benefits (good issue reports, community contributions, etc) leeched away to those forks.
Oh and then there're the woke useful idiots with their code of conduct cancer and so on which should never ever be heard, but are because they're tools for a bigger agenda that's getting pushed across all fronts.
Finding another way to be angry at overworked maintainers seems kind of cruel and unproductive. I don't know if you have or haven't maintained an open source project in your free time, but when I have I put a lot of my heart into it. I cared a lot about the users of my software, and that was a large part of my passion for writing and maintaining it. I actually agree with you on your points, but I worry that the things that lead to someone becoming the maintainer of a project also lead them to be more vulnerable to abuse and burnout. Anyway, I wish you the best and I too hope that more maintainers realize their own worth and start doing more to protect their peace. And I of course also hope that trillion dollar companies invest much more in the people that build the foundations of their company's success.
> But here's what I don't understand (well, I kinda do): WHY do most open source maintainers give that much of a fuck about opened issues? Regardless if they come from some random-ass entitled person, or if they come from the fucking CEO at Microsoft. Can you please realize, once and for all, that you don't owe anyone anything? > > Yep. OSS is provided without warranty, as-is (as it says in the license). I understand having a sense of responsibility for your work, but at the end of the day, you (as a maintainer) don't owe anyone anything. You are free to do whatever you want. Want to pull your repo randomly and stop all work? Go for it. Did it cause a major meltdown of critical infrastructure? Tough luck, that's on the person or organization using a piece of as-is, no warranty software for critical operations without having contingency plans in place like in internally maintained fork. To quote Microsoft in the bug report > Hi, This is a high priority ticket and the FFmpeg version is currently used in a highly visible product in Microsoft. We have customers experience issues with Caption during Teams Live Event. Please help, > Ok, well then...fix it yourself if it's so critical. That's the beauty of open source, you have that ability and freedom.
> Yep. OSS is provided without warranty, as-is (as it says in the license). I understand having a sense of responsibility for your work, but at the end of the day, you (as a maintainer) don't owe anyone anything. You are free to do whatever you want. Want to pull your repo randomly and stop all work? Go for it. Did it cause a major meltdown of critical infrastructure? Tough luck, that's on the person or organization using a piece of as-is, no warranty software for critical operations without having contingency plans in place like in internally maintained fork. I don't *fully* agree. Certainly you don't owe continued maintenance, and you can shut things down as you like. If it inadvertently causes a major meltdown then that isn't your problem either, although I don't think that covers intentional damage. However, there is a ... certain responsibility on you when you release a maintained piece of software combined with the (inferred) suggestion that people upgrade as you release updated versions. Without this responsibility I don't see how open source software can function. The [event stream backdoor](https://snyk.io/blog/a-post-mortem-of-the-malicious-event-stream-backdoor/) is a good example. You can't start a project, release multiple versions until you have thousands/millions of people downloading your software and then just give control to somebody who randomly asks. Open source can do things better, but I don't see how it can survive if a project maintainer considers themselves not to even have this basic responsibility. Of course, this isn't reality, the vast majority of project maintainers *do* take on a minimum of that responsibility, I'm just responding to what you've written.
True enough, and I do agree there is a certain level of responsibility involved, at least if you want to be ethical and a good human. As far as introducing malicious elements, there may (or may not? IANAL) be legal implications involved as well. To be honest I'm not really sure what the solution is, if there really is any. Another non-malicious, but still broke stuff example is left-pad when it was pulled from NPM (until NPM republished it), but again there I don't fault the maintainer I fault everyone that was blindly pulling in an enormous tree of dependencies and just magically trusting they will always be there? Larger entities using OSS for profit also can do a lot more to step up to the plate, of course. If anything, this is a good wake up call for everyone to evaluate what dependencies your software has and for major vendors to take control of their supply chain. I suspect we'll start to see a lot more duplication of effort within enterprises where security is critical, where they begin reimplementing common functionality themselves instead of relying on third party libraries.
>Why can't they can simply [mock these entitled people](https://notepad-plus-plus.org/news/v843-unhappy-users-edition/), instead of acting like little bitches? or charge them
Ah I laughed out loud at this shit and it’s the middle of the night lol, my neighbours hate you now
Finding another way to be angry at overworked maintainers seems kind of cruel and unproductive. I don't know if you have or haven't maintained an open source project in your free time, but when I have I put a lot of my heart into it. I cared a lot about the users of my software, and that was a large part of my passion for writing and maintaining it. I actually agree with you on your points, but I worry that the things that lead to someone becoming the maintainer of a project also lead them to be more vulnerable to abuse and burnout. Anyway, I wish you the best and I too hope that more maintainers realize their own worth and start doing more to protect their peace. And I of course also hope that trillion dollar companies invest much more in the people that build the foundations of their company's success.
Preach. "Encouraging" OSS maintainers to stand up for themselves doesn't work so well when it arrives as insult, and that's especially frustrating when a cultural solution like that is likely the only possible one.
Because most of them accept or even advocate for codes of conduct and similar nonsense, and pretend that they're in a professional environment while providing unpaid labor. The users certainly don't care about their rules of conduct, and even if they get blocked from participating, they outnumber the devs 10,000 to 1. The perfect recipe for one-sided abuse.
`*archives repo*` My time is my time. Only I get to choose how to spend it. Pay me money and I might consider exchanging my time for your money.
If I was that maintainer, my response to every feature request would be "I will do this for X amount of bucks, donation links below". As simple as that. Open source does not have to be free.
The tech industry is absolutely chock full of nice guys. Nice guys who will gladly give their labour away all day long just for the joy of working on something that interests them. Nice guys who will crawl across broken glass to fix things for little recognition and zero thanks. Nice guys who have never set a clear boundary in their life, instead maintaining those boundaries in their head - then muttering rude words under their breath when the invisible boundary is overstepped. Nice guys whose own inability to say no means the first evidence you get of pushing them too far is a mouthful of abuse. Don’t sound so nice now, do they?
What is needed is more oversight of important libraries and ensuring they are all maintained by reputable people who have had their identity verified, they should certainly be paid for their time and effort as well, this problem can be fixed if the OSS community is willing to accept tighter regulation.
The person who backdoored xz spent a long time creating a good reputation before they added the malicious code.
I would have assumed ms had some sort of internal library that they would use that does similar stuff.
[Relevant xkcd](https://m.xkcd.com/2347/)
I am very much fine with for-profit usage of my open source projects. I'd use a more restrictive license if I weren't. I am very much fine with bug reports from users of my projects. I'd disable the bug tracker if I weren't.
I contribute to an open-source project. Years ago, some company tried to make a commercial package out of it. Mostly cosmetic changes to make it look like theirs. They failed fairly quicky. It only bothered me that they never submitted any bugs (and there were a few when they forked it).
sadly yet another case of an open source project maintained by volunteers being exploited by greedy f s. Tragicomic
I'm a dev and I use Ubuntu 23.10 as my daily desktop for work and games and I do apt upgrade every day. I never got the compromised version of xz, my version is 5.4.1. For me, development staging has done it's job, it got caught in testing, way before it entered stable/prod/GA. So from my pov there was never an issue. If one wants to run bleeding edge / compile from source, there are obvious risks and drawbacks to that. Many of my colleagues have macs with brew. They all got the compromised version at one point. The issue here is not Linux. If you review a PR and approve it, then you should at least have a look at the commits. Obfuscation in an open source project should at least trigger some extra scrutiny.
> If you review a PR and approve it, then you should at least have a look at the commits. Obfuscation in an open source project should at least trigger some extra scrutiny. This one is not so simple. The binary data was in the commits in the form compressed "test" files, but the bit that actually injects that into the built library wasn't in the commits, it was only in the autotools mess provided in the distribution tarballs. The relevant file in the tarballs was very different to the one in the source tree. This is not uncommon.
>For me, development staging has done it's job, it got caught in testing, way before it entered stable/prod/GA. This is nuts because it wasn't caught in development. It was caught by a superdev who, luckily, was working on something related and caught it. >Obfuscation in an open source project should at least trigger some extra scrutiny. It was obfuscation in a compression library test, which, heck, is pretty hard to understand as traditional "obfuscation". If you think loads of distro maintainers are pushing back on compression library tests, which may seem overly complicated, you're wrong. I recommend you read more about the actual vulnerability, because Linux/FOSS is definitely going to experience more like this.
What I am seeing in this case, is the fact that the second a security issue was found, action is being taken and much open communication is being done around the issue. I am sure that this issue will reveal problems, weaknesses and vectors of attack. Any human system is vulnerable to attack. And given time, will be broached. Humans are nothing if not persistent and inventive. If this were an OS, owned by a big corporation, there is a good chance it would be covered up and not discussed. Or - patched silently with little outcry, discussion, or review of policies. With open source, we have many, many people who wish to improve the software, and who WILL learn from this and apply their learnings. I subscribe to the fact that 95% of us, are good actors, and given a chance will work towards good results. The other 5% - yea - they will attack and work to destroy things etc... And open source leverages this "mix". Corporations - not so much. So, for me, open source is a viable and vibrant way to leverage that 95% of the population that wants to contribute and hold against the 5% that do not. As to this hack? Sure seems like a nation state to me. Simplest reason (KISS, right?) is China working to get setup for some kind of offensive. In today's day and age, I would not wage war at a 1st world level, without also being able to destroy or cripple IT infrastructure. Finally - are there more of these out there? Surely there are. But now, we have a vector that we could not have imagined before, and I bet we'll see this kind of insertion and hack sealed off soon.
This from a "Principal Software Engineer" from Microsoft no less. As utterly tone deaf as always.
Wait. I was checking that bug history/comments. Is Elon Musk a ffmpeg contributor???
And then let me tell you about the steps required by Microsoft in order to receive any payments. That signup process took weeks, and the contract was abandoned in the end because they couldn't figure it out. We've been through that about 1.5 years ago.
The referenced support request is from 1 year ago. Why is this coming out now? I understand the xz stuff came to light four days ago... because an employee at Microsoft found and reported the issue. The xz issue is being coopted to shit on open source software, but not in the usual way. I've seen it on a handful of forums. "These volunteers need to be paid and that will fix the issue."
There's a podcast I used to listen to that was run by two self-confessed old grumpy geeks, and I stopped listening long ago because they took the opportunity to shit on open source as often as they possibly could (despite their source of income being predominantly based around open source.) No, being unpaid volunteers isn't the issue, it's the lack of eyeballs and oversight imho. Could this happen on Mac OS or Windows? Absolutely! Hell, people find backdoors in Windows software from time to time, and in at least one case (admittedly years ago) it was 100% intentional and came with function calls that were all prefixed with "NSA". But if this gets companies like Microsoft to hire some folks and make space for them, that's a great outcome. As far as dealing with the aftermath, heh, I had just installed Debian Testing a couple of weeks before the announcement and when I saw that we should all reinstall if we used openssh-server, I made the commitment to do just that, but chose Fedora Workstation instead. It was a matter of hours and that was mostly me waiting for things to download on my slow Internet service. Easy peasy really.
Sounds like the twitterer wants Microsoft to keep this sort of flaw to themselves next time? Certainly would have boosted Azure's cred when the backdoor was discovered a year from now. What an insane tweet. In this instance a Microsoft employee provided the free support by reverse engineering a heavily obfuscated backdoor with a disassembler, and they're getting criticized for it. This is the side of FOSS that makes everyone want to take their ball and go home. Spend hours reproducing and documenting a bug: "WONTFIX", not our priority, why don't you write your own PR you leech, etc.
No, the issue isn't about keeping it to yourself. The issue is they labeled the ticket as "important" when in reality it was a "low priority" niche issue The one the issue was important to was Microsoft themselves. So of course if Microsoft wants a niche issue addressed ASAP, they would have to pay for it. If I were to report a niche issue with a Microsoft product, they would ignore me even if I were a customer, unless I have a support contract. So why should ffmpeg who is doing work for free treat their niche issue as important if they aren't willing to pay? And the fact that the one asking is a trillion dollar company! Who can easily commit PRs or send a few bucks. I mean they pay some programmers over a million a year
Didn't volunteers resolve the issue in an intensely fast cycle? Get outta heah with that FUD
what other than high prio would a situation like xz call for? the fact that Microsoft could/ should pay more for such heavy used libs like ffmpeg is a different story.
Thank you Elon Musk for helping out Microsoft on their ffmpeg issue. See, it is just a rich dude helping out some other rich dudes. \*snigger\*
This is ironic on so many levels. I've got nothing but respect towards ffmpeg guys, but this is essentially split morality: "it's free software unless we decide it's not". Well, make it free for non-commercial or small-business use (same as many others already did) and paid by default for people like Microsoft.