Hacker News Reader

Comment by Kreotiko | Hacker News Reader

If information security people would spend the same amount of time they are spending complaining about this vulnerability trying to educate their organisations on the importance of supporting open source solutions they depend on we wouldn’t be in this situation. I am sick of reading of very senior people complaining about the impact this vulnerability has had on their week when their companies don’t even contribute a penny to open source projects.

View on HN

Maybe we should tell them to engage with open source, not "support it". Companies should look for a way to spend work hours on open source, not finding someone to send money.

Convincing project managers to tackle tech debt is hard enough. Contributing to open source won't even reach the middle ear unfortunately.

Let’s not even get legal involved…

Don't worry, legal will answer a completely different question that's unrelated, but rests on a fundamental misunderstanding of the entire premise due to a combination of misinterpreting technical jargon as plain English and then misapplying a legal generalization, resulting in absolutely essential advice that needs to be followed immediately, which is couched in legalese that the techs will proceed to misunderstand by misinterpreting legal jargon as plain English in combination with a misapplied technical generalization, resulting in an absolute quagmire when it turns out that these essential compliance steps turn out to have a minor impact on the next quarter's bottom line. Thus some even more obtuse interpretation will be dreamed up by some manager to claim CYA without hurting the bottom line (or addressing the reinterpretation of the reinterpretation of the reinterpretation of the original issue). The issue will be resolved, pending small details like the actual legal risk and technical issues, and all will be fine.

But just be be sure, we should ask legal!

If it's an enterprise (https://zwischenzugs.com/2018/10/02/why-are-enterprises-so-s...) the latter will be a much easier sell to management. Paying for support is a given but contributing developer time will require many approvals from different departments if it can be done at all.

How do I fund ripping out bad ideas from existing open source software?

Log4j2 partially exists because of pushback on adding features to v1

Fund a new fork

Why not logback instead? It's existed for more than 10 years and its stated goal is "picking up where log4j 1.x leaves off"

http://logback.qos.ch/

Just leads to the xkcd “there are now 14 competing standards.”

Honestly the biggest problem of package managers is finding a reputable package that one can trust.

The best one can do to aid this situation is reviewing, vetting and warning of which packages that can be trusted and not. Automatic scanners to find code smells and vulnerabilities.

“Security rating: 2/10, This package seems to use JNDI loading, are you sure you want to continue (y/n).”

Humor me: if log4j had 13 (independently developed) competitors, wouldn't the impact of this be much lower, because many consumers would use different libraries? Like genetic diversity as a hedge against disease.

Joke's on you: Then any nontrivial project would end up depending on half of them, actually increasing attack surface.

I bet they'd all compete on features and probably implement the same exploit trying to maintain market share.

Logging as it's understood today should ship with most STD libraries. Things like logback an log4j really should just eventually be rolled into the std.

Would more funding have actually uncovered this?

No. Funded projects also contains bugs.

Not in and of itself.. However if part of that funding was used to cover formal (external) audits, investment in fuzzing/automated security testing etc.. then it might well have done

That’s a really big "if" though.

"Might have" is the operative word. In a world where Project Zero's _This shouldn't have happened_ [1] was also published this month (buffer overflow on NSS), I'm less certain. Quoted from the article:

---- This wasn’t a process failure, the vendor did everything right. Mozilla has a mature, world-class security team. They pioneered bug bounties, invest in memory safety, fuzzing and test coverage.

NSS was one of the very first projects included with oss-fuzz, it was officially supported since at least October 2014. Mozilla also fuzz NSS themselves with libFuzzer, and have contributed their own mutator collection and distilled coverage corpus. There is an extensive testsuite, and nightly ASAN builds.

I'm generally skeptical of static analysis, but this seems like a simple missing bounds check that should be easy to find. Coverity has been monitoring NSS since at least December 2008, and also appears to have failed to discover this.

Until 2015, Google Chrome used NSS, and maintained their own testsuite and fuzzing infrastructure independent of Mozilla. Today, Chrome platforms use BoringSSL, but the NSS port is still maintained.

Did Mozilla have good test coverage for the vulnerable areas? YES.

Did Mozilla/chrome/oss-fuzz have relevant inputs in their fuzz corpus? YES.

Is there a mutator capable of extending ASN1_ITEMs? YES.

Is this an intra-object overflow, or other form of corruption that ASAN would have difficulty detecting? NO, it's a textbook buffer overflow that ASAN can easily detect. ----

[1]: https://googleprojectzero.blogspot.com/2021/12/this-shouldnt...

Would less funding have uncovered it?

Would less funding have prevented the feature being implemented? Maybe?

There's no way to argue that less than zero funding would have prevented the log4j maintainers from merging a patch that was sent to them by a third party.

probably not but i don’t think anyone suggested less funding

Well I don't think anyone suggested anything actually helpful or relevant, so....

I read a post recently that said part of the open source funding issue comes down to a financial "structure" mismatch. Open source folks are often individuals or loose collections of individuals. Sometimes they have things like Patreons, ask to receive crypto currencies, etc. Companies don't/can't provide funding via these types of structures, so the writer of the post ended up incorporating a company, setting up a mercantile bank account, commercial payment processing, etc., so companies would be comfortable funding his efforts. Fortunately, this path is lot easier lately with services like Stripe, etc.

I have a feeling if a company wrote a large enough check, they'd figure out how to cash it.

Well, wrte it to whom? No legal structure is what the comment was partly about.

My Fortune 500 company has to pay a third party to pay for Google Maps, because we can't pay a supplier with a credit card.

If we can't find a way to pay Google, there is no hope for some random developer in Nebraska.

That feels backwards. Little shops are flexible and can probably do what needs to be done. Lumbering behemoths have (too many) rules and restrict themselves (often) unnecessarily.

Nebraska is a reference to https://xkcd.com/2347/

They must adapt. Period. And don't worry, when they have to, they do find solutions. The thing is, with open source, you don't have to, worse, the vast majority of enterprises rely because you don't need to make any effort.

Solving this issue isn't one of the goals of https://opencollective.com/ ?

> If information security people would spend the same amount of time they are spending complaining about this vulnerability trying to educate their organisations on the importance of supporting open source solutions they depend on we wouldn’t be in this situation.

Security teams are stuck with securing the tire fire; they didn't choose the library or platform. If anyone should be advocating for supporting open source, it's the developers who benefit by using open source libraries.

I’m not interested in kicking the can down the lane, I just want this stuff to be sustainable.

> educate their organisations on the importance of supporting open source solutions

Githubs of the world could just gate downloads, pull requests etc. behind a payment to see what is the real valuation of open source software; I imagine it'd mostly settle around $0 excluding couple of big projects.

Up until the semicolon, this was actually a decent point. I can see a future for high-quality open-source software hosted on an 'app store' which requires a small payment for use - or for commercial use, perhaps.

And how are you going to prevent someone from just hosting a mirror for free?

That's the question that such an effort would have to solve. I think you're assuming a model where software is directly used by an individual consumer, though, which is not always the case. For commercial applications where your software is integrated into the end product, for instance, companies would never risk stealing unlicensed code considering the risk. How one would address the question you posed is entirely dependent on the domain one's operating in.

Giving something away for free and then turning around and guilting people into paying for it is wrong.

That seems to be an opinion. Opinions vary. Mine does.

Using something for free and expecting support is hilarious.

Reply on news.ycombinator.com