Libxml2 Maintainer Ends Embargoed Vulnerability Reports, Citing Unsustainable

socket.dev

27 points·feross··8 comments

Apple, Google, AWS, Microsoft, ... I would call it criminal neglect using hobby software like libxml2 written in a memory-unsafe language (to cite the maintainer) to process untrusted input in systems that need to protect personal data or are even safety-relevant.

So what's the alternative? Microsoft has a longer history than many open source components. Nobody could see the source, but it was proven continuously that it was highly insecure. Less than hobbyist quality, but closed source so nobody could see the (lack of) quality explicitly. Some might claim 20 years later they would produce better software. Maybe marginally, but not fundamentally I'd dare to claim.

Should we rewrite everything in Ada?

That would be nice, but there's a rather lot of ecosystem friction to it. For libraries, I'm also a fan of wuffs, especially because it really lends itself to integrating smoothly with the existing ecosystem.

Good for him, I just wish he made it more obvious how a cash rich but time poor BigTech product owner could help him.

Hire him full time for a Silicon Valley salary? Employ a team of testers using state of the art test automation, fuzzing, static analysis?

"Paid support contracts are available starting at $50k per year"

Is more what I had in mind. Maybe he's already rich :)

Unsustainable what? The title got cut off.

“Burden” is missing but I feel like the title is descriptive enough.

Reply on news.ycombinator.com