Comment by freeqaz | Hacker News Reader

Comment by freeqaz | Hacker News Reader

(Note: I'm the person that coined the term "Log4Shell")

You may be surprised when I tell you what the Apache Software foundation's yearly budget is. You'd think for software that is used by practically every Fortune 500 company and most governments, it would be something reasonable. Maybe a few hundred million dollars a year to pay for a reasonable full-time staff, right?

It turns out... it's about $2 million a year. (Wikipedia[0])

This helps explain to me why the devs of Log4j directly uploaded the file "JNDIExploit.java" (the POC) to GitHub while they were patching. (Here is a full analysis about what happened[1].)

They're not security people. They're volunteers working on this in addition to their full-time job.

What kind of brave soul wants to trudge through and maintain log4j in their spare time for zero compensation? I appreciate the people that are capable of doing that, but I think they are rare!

This whole entire vulnerability was eye opening for everybody and I have actually spent the last year building tooling on GitHub to help fix the problems that Log4Shell exposed.

If you have 2 seconds to try that out or just Star the repo[2], it would be very helpful!

0: Log4j revenue https://en.wikipedia.org/wiki/The_Apache_Software_Foundation

1: "How to Discuss and Fix Vulnerabilities in Open Source" https://www.lunasec.io/docs/blog/how-to-mitigate-open-source...

2: GitHub project building better dependency patching tools https://github.com/lunasec-io/lunasec

> What kind of brave soul wants to trudge through and maintain log4j in their spare time for zero compensation?

It's not clear to me as an outsider what exactly the Apache foundation is doing for these projects. It feels like Apache is willing to accept code donations from anyone and is willing to attach the foundation's name to code that isn't widely used, actively maintained, or may just be abandonware.

I have soooo much more confidence in CNCF projects. The conditions for graduating as a CNCF project include criteria like that your project must be in use by multiple real companies, have maintainers who are (paid) employees of multiple different companies, and get a professional security audit.

>It feels like Apache is willing to accept code donations from anyone and is willing to attach the foundation's name to code that isn't widely used, actively maintained, or may just be abandonware

That's why I'm allergic to Apache software. A lot of it is overengineered, insecure, legacy abandonware.

Apache is what CNCF will become when marketing budgets move on.

> It feels like Apache is willing to accept code donations from anyone and is willing to attach the foundation's name to code that isn't widely used, actively maintained, or may just be abandonware.

That’s incorrect. Projects need to report quarterly and need a Project Management Committee of at least three people, or they are retired. Retired projects may not make releases.

(Source: past ASF board member, who used to review those reports each month.)

There are a fair number of retired projects, and others that may become retired within the near-to-medium term. The ASF has been around for a while, and every software project has a life cycle. Those are still associated with the ASF brand because Google, whatcha gonna do? An explicit retirement policy overseen by a board is still superior to how the vast majority of open source projects approach end-of-life.

In theory. Open Office shows that the process of retiring semi-abandoned projects leaves a lot to be desired.

The project has few, if any, volunteers, and there are security problems known to be actively exploited, yet the ASF is not willing to work to find a viable solution.

Open Office losing popularity and having a shortage of developers makes some sense to me given all the progress in web-based document editors.

Something I have a harder time understanding is how it came to be that Apache Thrift and Facebook Thrift both exist as competing implementations of the same software originated by the same company.

The implied point with Open Office was not the users habits shifting, but that there was a fork in name only. The project is still under active development with a diverse set of developers but under the name Libre Office.

Only a skeleton crew of paid developers stayed with Open Office, enough to cut releases regularly but not even to fix the security issues actively exploited. All distributions moved with the developers, but there is a discoverability problem which has led to mostly Windows continuing to install the unmaintained version.

The ASF could have fixed this quickly, either by helping out with the trademark issues, moving with the developers, or at least moving the unmaintained version to the attic and steering new users towards the actively developed version.

But they collectively decided to sit on their hands as users continued to install unmaintained software rather than take the slightest risk of offending one of their members. From an outside perspective, all of this was completely unnecessary.

The Thrift situation is another example where some active stewardship could have made a difference.

If Linux, OSS, and the like is a firmament of modern society, AND IT IS, why would it be left to adhoc donations or the whims of corporate donations?

There should be billions in funding of OSS from governments each year. Think that's ridiculous? Consider how much Microsoft makes in support payments from governments around the world. The US government has a 92 billion dollar software budget.

I mean, look at this: https://www.reuters.com/article/us-usa-cyber-microsoft-exclu...

Because they can.

If it's that important, just make a new tax and stop dicking around with this "oh it would be so nice if companies would just donate out of the goodness of their hearts hint hint" nonsense. It's pretty clear that 99+% of for-profit companies have zero interest in paying for things that developers will (apparently) also develop for free.

Society figured out a way of forcing people to pay for common goods a long time ago, and it's taxation.

> What kind of brave soul wants to trudge through and maintain _____ for zero compensation?

Can't this sentence be changed for almost any open source project?

Absolutely, but if I had to rank Open Source projects by "enjoyment level to work on", I would rank a 10+ year old Java project primarily used by enterprise companies quite low on my list!

Compare that to something like Bun.js[0] which is "sexy" and written in a "cool" programming language (Zig). Or Wasp[1] which is built with Haskell and is trying to define a new programming language designed to make common dev patterns less painful.

Those projects are naturally going to soak up smart people that have extra energy to share because they hate their day job but need to pay their bills. (imo)

Who is left that wants to bang their head against a legacy codebase like Log4j? Maybe somebody that feels there is "clout" to be had from it? (Spitballing here, I honestly don't know!)

0: https://github.com/oven-sh/bun

1: https://github.com/wasp-lang/wasp

I imagine that someone who is good at that style of Java might enjoy the challenge of working on it, particularly if they are already familiar with the codebase.

There are a LOT of Java SWEs floating around...

I bet a big chunk of them have contracts that prevent them from contributing to open source. Atleast without going through a painful vetting process that drains all the enjoyment from it.

Usually that does more than drain enjoyment, but tarpits it to the point it won’t happen - and is only to be a trap for employees so they think it’s an option.

As someone that has done and keep doing this in other niche...

There are people that like to clean messes and make people life better from the shadows. These tend to be called engineers.

You may be interested in https://www.fordfoundation.org/work/learning/research-report...

Why don't the billion dollar companies that bundle this into their own products make the necessary financial contributions?

Hey Oracle.

"How about we vindictively hold onto OpenOffice and then gift it as a white elephant to the Apache Software Foundation instead?"

— Larry Ellison, probably

The ASF didn't have to say yes, and didn't have to allow "Apache OpenOffice" to decay for years afterwards without putting a stop to it.

The current Apache OpenOffice "Vice President" ie the leader of its developers such as they are, is Jim Jagielski, who was also an Apache Director back when a previous "Vice President" suggested the project should be wound up altogether. ASF should have accepted, they did not.

Because they can avoid doing so until…. I don’t know, ask next quarter eh?

So if they are all unpaid volunteer maintainers, what’s happening with that $2 million? It’s still a lot of money!

Servers for documentation and release hosting, Servers for CI and testing will chew up

Is it really needed today? GitHub can host documentation and releases. GitHub CI is free as well.

For small usage, and contributed as a marketing spend.

If Apache tried to use it without doing it in the context of a formal deal or sponsorship, it wouldn’t last long.

No such thing as a free lunch, or whatever.

See page 11: https://www.apache.org/foundation/docs/FY2021AnnualReport.pd...

The core infrastructure team is paid, and that’s been the case since fairly early on — there’s too much work not suitable for a purely volunteer crew. Infra is half the budget.

Reply on news.ycombinator.com