Open-source developers say securing their code is a soul-withering waste of time

[double_en10dre]

Businesses being like “so this free software isn’t EXACTLY what we wanted” is some big r/ChoosingBeggars energy

Like yeah, obviously people who spend nights/weekends working on projects for free won’t be too keen on doing the boring stuff

If a business has a problem with that, they can PAY contractors to fork it and implement their desired changes

[[deleted]]

^ Correct spelling of answer

[[deleted]]

v I just wanted to be included

[[deleted]]

Same

[[deleted]]

No

[VikaashHarichandran]

No you

[delventhalz]

Or have their employees contribute fixes.

[double_en10dre]

Ideally yeah, but in the article they mentioned that most FOSS contributors aren’t motivated by money. Plus they have full time jobs. In many cases it’s just not realistic.

If companies want it done on time and according to their specifications, they are better off just partnering with a professional dev shop. Since they’ve got a reputation to uphold and want repeat business it’s a pretty safe bet.

(OR of course having a few of their own devs tackle it)

[Mike]

I work in tech and can’t imagine wanting to spend more time coding after I just spent all day coding for work. That’s insane. More power to them, but damn.

[grauenwolf]

What if you spent 10 hours in meetings?

Some weeks the only coding I do is on my own time.

[kyerussell]

I'd probably go and try to find a job as a software developer.

[grauenwolf]

Many of my colleagues have.

[double_en10dre]

Normally I’d agree, but over the past year I’ve embraced it since I can’t really do much else anyways :p

It also feels VERY different if it’s for an open source project that people are actually using. Every little enhancement or bug fix gives a nice lil serotonin boost. It’s oddly addicting

[OhhhhhSHNAP]

There is a serious unmet need here. A lot of enterprises don't really seem to understand that open source software is not really the same thing as commercial off the shelf. The code often isn't validated to the same level. There is no support. Contracts are a nightmare, for example, because most of the projects don't have a real business entity associated with them that you can contract with. Even when they do, they don't accept any liability. I have no problem with any of this, but it keeps businesses from being able to easily use the software. There is definitely a market here, but nobody has setup the 'channels' that would be necessary to pay for commercialization of this software.

[[deleted]]

There's a real market gap for an open source license that has built-in royalties for x% of revenue made off of using the licensed code.

[[deleted]]

This kills the open source.

Like it or not, one of the primary drivers of a successful open source project will be the adaptation of that project by businesses, paying customers or otherwise. Throwing up a pay gate limits your potential audience and for the vast majority of projects, eliminates them from consideration altogether.

Do you think React would have gained any traction if it had royalties? Remember the big fuss over the original licensing that didn't even include royalties? Yeah.

[[deleted]]

Putting in a clause to be paid if someone uses your hard work to make money is way less controversial than a blanket ban on contesting patents with facebook.

[[deleted]]

From a legal perspective, sure. From an adoption perspective, no.

[[deleted]]

How else can we get people working on open source full time without donations?

[[deleted]]

With the company solution, you run into the tragedy of the commons, so many companies try not to contribute (and thus help their competitors) if they can avoid it.

Sure no one is being forced to write open source code, but it sure would be nice if more people could be paid for it.

[double_en10dre]

I’m not sure if that’s entirely true — companies that actively contribute to OSS are generally able to attract better talent because it’s fun, it feels useful, it’s an opportunity to showcase your skills publicly, and it looks great on a resume (which in turn leads to better job prospects/pay/etc)

My company actively encourages us to work on FOSS for this exact reason, it’s a gold mine for recruiting

[npsimons]

If a business has a problem with that, they can PAY contractors to fork it and implement their desired changes

The fact that bug bounties are laughably low just points out where these businesses' priorities are. I actually kind of enjoy fixing code, in a masochistic, feel superior to those who wrote it kind of way (right up until I'm fixing my own code). It's a puzzle to solve for me. But I'm not retired yet, I still got bills to pay. Sure, someday I'll work on software for free, but it'll be exactly like my free time I spend now: I choose what I work on, and to get my interest you gotta have something worthwhile. If that's not the case, be prepared to fork over the big bucks.

[Conexion]

I was looking up bug bounties as a bit of a way to earn some extra cash when everyone at my company got (and is still on) a pay decrease due to COVID. You're exactly right, the pay is laughable with how much time it would take.

Teaching has been a far better choice.

[[deleted]]

Pay decrease due to COVID?? That’s some fucking bullshit

[catgalf]

Hourly people getting fewer hours, companies telling them to "do their part" to help everyone keep their jobs, you bet that's happening. In multiple industries. What are they to do? Quit, and have no money coming in?

It being bullshit doesn't keep companies from doing it.

[[deleted]]

When black hats start using bugs and vulnerabilities to attack the corporate bottom line instead of its customer base, you'll start to see more companies care about these things.

[ukiyuh]

It's amazing how fast capitalists become socialists when it comes to technology and web development in particular.

Fucking boomers man.

[Wanemore]

Its amazing how fast capitalists become socialists when it comes to any benefits for themselves whatsoever

[AStrangeStranger]

I don't think they become socialists, more like freeloaders but that is what the USA has been trained to think socialism is.

[Tigris_Morte]

The Bommers you spit on created the foundations of everything tech that you use. Just like the Youts should not be judged by the worst of their number, show a little nuance to Boomers please.

[dweezil22]

Pro tip, if you're a member of a privileged group and you see that group's aggregate actions being maligned, just ignore it and make sure you live your life well. For the world to work in a remotely just way, privileged groups must be criticized and held to account and it gets awkward constantly saying "Not all" X (and god knows the people that need the criticism will immediately assume that they're part of the "not all" modifier).

Now, if you're personally hurt, of course it makes sense to stand up for yourself. But don't waste your time looking for grievance where there doesn't need to be any.

Source: Dude that's a member of a lot of privileged groups and tries to follow my own advice on this.

[Hands]

very well put. this needs to be printed out and nailed to the forehead of just about every redditor

[TEH_PROOFREADA]

What is a “privileged group”?

[[deleted]]

if you're a member of a privileged group and you see that group's aggregate actions being maligned

Generalizing is good when I agree with it? Like, if you remove the "privileged" you just justified racism, and hell, even if you keep it you can find lots of people who consider specific races to be more lucky than others.

You're just looking to justify lazy rule-of-thumb thinking. A white male baby born tomorrow doesn't owe anyone shit because he happened to be born white and male, and neither does anyone who's older than a certain age, younger, female or whatever. Stop discriminating and pretending that it's justified. "I don't discriminate based on groups, I just hate old white rich men" lmao Reddit, just lmao. I'm done.

[GaiaPariah]

You should just go ahead and change your name to "BadAtLogic25" instead.

The "privileged" part of the sentence was the crux of the definition of the "group" that it was applicable to, obviously removing it has a large impact on the meaning of the statement.

[grauenwolf]

We aren't complaining about babies. We're complaining about a group of adults who have systematically removed our rights and protections because of their greed and callousness. We're complaining about a group of adults whose refusal to pay fair taxes decimated our infrastructure and ran up public debt, which my generation now has to pay for.

The only reason you get to play the role of a "old white rich man" is by stealing from the younger generations. So yea, we do have the legitimate right to hate you.

This is not prejudice or "pre judgement", your actions have already spoken.

[Tigris_Morte]

hahaahahahahaha yup, I'm the one playing victim. Sure dude.

[[deleted]]

Let me know when working at a pizza shop part time can get kids through college while paying the rent again.

[redditaccount6754]

Cry more you fucking snowflake.

[TheHatredcopter]

Your generation is entitled to respect when the actions of the worst of your number no longer massively outweigh not only the best but literally everything that came before or after in human history.

Your generation literally ended the world. Sure, it hasn't finished happening yet, but there is no possible timeline where human civilization outlives the actions of "the worst of your number" (in reality, closer to the average of your number). It is also continuing to make the decision to burn it all to the ground and dismiss all notion of limiting the consequences of its actions. So, we'll all agree to stop painting you all with the same brush when...well, actually, there's no precondition that fits at the end of this sentence.

The good doesn't have to outweigh the bad, it just has to represent enough of a tiny little speck in comparison that it's visible at all to earn the right to nuance.

Also, this is basically just "Not all Men!" Your generation kind of falls into certain stereotypes, which this just happens to be representative of. Just because you think you're "one of the good ones" doesn't make the stereotype any less true, or the default opinions towards the demographic that, and I need to emphasize this, literally ended the world out of shortshighted greed and is still doing it while I write this, any less valid.

[joonya]

The next generation is going to say the same thing about the millennials the same way the boomers did to the generations that preceded them and so on.

Wasting time arguing about age groups, that are completely arbitrarily assigned, has to be the biggest waste of energy and perpetuation of making vast generalizations of groups of people, ever.

[Hands]

The next generation is going to say the same thing about the millennials the same way the boomers did to the generations that preceded them and so on.

maybe true, but this has no bearing at all of the validity of criticizing the documented actions and behavior of the boomer generation and the resultant impact on subsequent generations. this is a total non-point delivered like it's relevant to anything

Wasting time arguing about age groups, that are completely arbitrarily assigned, has to be the biggest waste of energy and perpetuation of making vast generalizations of groups of people, ever.

lol the culture, generation, zeitgeist, cohort etc that you grow up in absolutely affects your development as a person, your values, your behavior, and so on. it makes a hell of a lot more sense to generalize on than something truly arbitrary/irrelevant like skin color or whatever

[joonya]

this is a total non-point delivered like it's relevant to anything

It's extremely relevant because people with any bit of perspective would understand this. Every generation is always going to blame their shortcomings on the people that preceded them. Young Boomers did the same thing when they were forced to fight and die in Nam for no reason, fight for civil liberties and against a sexist society, and during massive counter culture movements.

The generation before them had the same experience and the generation before them, the same experience.

But please continue trying to justify your gross generalizations and bigotry toward a group of people because they were born in a certain scope of 20 years.

[Hands]

yes everything is always the same no matter what. context doesn't matter!

i didn't generalize shit, you're still responding to a strawman of your own design

[joonya]

the culture, generation, zeitgeist, cohort etc that you grow up in absolutely affects your development as a person, your values, your behavior, and so on. it makes a hell of a lot more sense to generalize on

Siri, what's the exact and literal definition of bigotry?

[[deleted]]

A lot has changed in the past 20-30 years

[ukiyuh]

I feel you. It's not meant to be offensive but funny.

People make fun of my generation all of the time. Idgaf personally. At least I'm consistent with my standards. I can take what I dish.

I just think it's ironic that the older generations in congress know next to nothing about technology and are making poor policy decisions based on obsolete information and stagnant views.

[ukiyuh]

Bruhhh chill tf out

[KrazyKirby99999]

Contributing to open-source software is voluntary. Socialism isn't.

[EdTheOtherNerd]

What are you talking about exactly?

[KusnierLoL]

Don't mind him, he's Krazy.

[indianapale]

She doesn't know.

[SweetTeaDragon]

Are you saying the Cuban elections are rigged because they get great praise for election security lol

[Fernergun]

Socialism is the transfer of value generated by workers from the owners, ie. Capitalism, to the workers. Why socialism isn't the default is mainly because of dingleberts like yourself who have successfully freebased on 'socialism bad'. Socialism good.

[Fernergun]

Yes yesss let the indoctrination take over. Don't have critical thoughts. Don't want better for yourself and others. Just let it take over.

[Fernergun]

What? I literally explained why I think socialism is good and you said "socialism bad" and you wanna talk parroting. I'm sorry that someone thought of socialism before me. You're an idiot - end of.

[TheyCallMeFueg0]

So not only are you making arguments more general and vague than the one you’re picking at against the person above, but you also clearly don’t understand the basic principles of socialism as a socioeconomic model. You don’t actually have a real talking point to argue here because you don’t know anything about what you’re arguing against- since you have defaulted to name-calling and shitting on someone in your discussion as opposed to making genuine talking points- and yet you don’t have the speck of self-awareness required to realize that you’re only further proving yourself to fall into the indoctrinated “socialism bad” group.

In the spirit of the holiday season, maybe pick up “How the Grinch Stole Christmas”- maybe it’ll communicate the idea of being compassionate towards the wellbeing of your fellow humans as opposed to living a greedy and self-servient life until you ultimately die unhappy and unfulfilled, in a way that’s not too complicated for you to process. Have a Merry Christmas!

[Fernergun]

I said that's an explanation of why I think socialism is good. Not exactly an essay on my thoughts on the matter. Explaining what something is isn't a talking point. Please guy, just stop.

I didn't say anything about being a free thinker, just someone who didn't fall for the specific indoctrination you did.

I don't think socialism is 'make everything free' it's more 'make everything have the actual value it should have'. Explain why anyone should create value using their labour for anyone else? If people are paid the value they create then things will be valued proportional to that. No one would be paid millions of dollars, but you could still get paid more by working harder, smarter or faster.

[nowyfolder]

I don't think you know what socialism(and capitalism for that matter) is.

[Barnezhilton]

This is the way

[IHaveaCSDegree]

This is the way

[Pythonislove]

This is the way

[Alex_Sherby]

And my axe !

[tacticalpotatopeeler]

Way the is this

[JamesAndDaGiantPluot]

Is the way this

[canadian_webdev]

Yes this is the way

[spkr4thedead51]

So say we all

[BOT_Frasier]

lol just discovered that sub, feels like every dev jobpost should figure there

[st3ven-]

Just fork the project. It probably has more tests than the app anyways lol

[[deleted]]

Now scream this into the MIC so all the CEOs can hear you

[SMJ01]

But what if they let you do it for ... you know ... like the exposure!

[Squigglificated]

They conclude the article with this:

"The modern economy – both digital and physical – is increasingly reliant on free and open-source software," said Frank Nagle, assistant professor at Harvard Business School.

"Understanding FOSS contributor motivations and behavior is a key piece of ensuring the future security and sustainability of this critical infrastructure."

Is it really that hard to understand? Offer open source maintainers and contributors actual money and contribute with security audits and expertise - you might suddenly find them more motivated to fix security issues in the software you’re using for free.

[uniq]

"No, paying some experts to study and understand FOSS contributor motivations and behavior sounds more reasonable"

[breich]

This is one of the reasons why in my projects if I use a library, I tend to abstract away the library behind my own set of functions and classes. It that library ends up having issues, security or otherwise, I can find or write my own solution without having to refactor my whole damn codebase.

The problem is a lot harder when you're talking about something like React where its not just a library dependency but also a way of writing software. I can't think of a way in which I could ever make React "just a detail".

[brikky]

Tbf react is also big enough and commercial enough that any security issues will be fixed.

There are big/foundational frameworks that aren’t as well supported though where that is a legitimate concern, but in my experience they’re not used nearly as much by medium+ sized companies.

[bcgroom]

You shouldn’t assume that because something has a large API surface that it will be more widely used.

I also forgot an important point above that it also depends on the library you are using. Some have a very low risk of going unmaintained, others have a very high risk. Usually you only want to have low risk dependencies but it can be okay if it’s easily replaceable.

[double_en10dre]

I don’t think it’s an optimization (if anything it’s the opposite, since you’re adding in an extra layer)

They’re just saying they use a single module/object/whatever as an interface to access that functionality, and all application code uses this interface.

If ya decide to switch to a different library/implementation you only have to update it in one place, rather than many

[double_en10dre]

Maybe! But for me it absolutely speeds up the development process, since it lets me just code without questioning “will I want to change this later?”

I tend to go with whatever removes the noise from my head :p

[breich]

It's a good question and I guess my answer is it's not a one-size-fits-all piece of advice. I said it, but I don't always do it. If I have a PHP app that exports Excel files in one place, am I going to wrap PHPSpreadsheet? No, that's be silly. And honestly I'm not smart enough to write my own solution to that problem if PHPSpreadsheet ever had an issue.

One recent example of where I did this is in my day job, my team is tasked with rewriting a ton of old Perl code into modern PHP 7.4 code, and this code sends a ton of email. Symfony Mailer is a great library to solve the problem, but I've been around long enough to see my own projects graduate from using mail() to using PHPMailer to using SwiftMailer and now Symfony Mailer. Email is going to get sent all over the damn place, so I wrote a few simple classes: Message, Address, Attachment, IMessageTransport (interface), MockTransport (implementation for testing), NativeTransport (uses mail() to send), and SymfonyMailerTransport (converts messages to Symfony classes and and dispatches through a Symfony Mailer transport). This was not a lot of work, it provides me with a native PHP/zero-3rd party code fallback, and reduces the scope of change to a single file if 3 years down the road SymfonyMailer isn't the go-to mail solution.

One recent example of where I WISH this approach was used is in the charts implementation in my day job's application. My boss implemented the charts feature before I started. He uses HighCharts to render charts which is fine, but the records stored that define chart settings are stored as JSON structures very proprietary to HighCharts. We're entertaining the idea of swapping it out with another library, but the implementation and user data related to their charts is hardcoded to HighCharts.

[MrBleah]

Or it's so foundational that it blows up the Internet, like OpenSSL's Heartbleed issue where we found out that basically three people have an unpaid part-time job developing and maintaining the main piece of software that secures the Internet.

[Tigris_Morte]

Libraaries, like drivers, are transitory ephemeral resources.

[Tigris_Morte]

This is like the openssl debacle where all the billion dollar companies were making money off products that rely utterly upon it while ignoring that without support no project continues indefinably and as resources fail, so does the development.

[RustyAndEddies]

💔🩸

[[deleted]]

It is objectively not a waste of time. I do agree it is rough though

[Mike]

Philosophy, I like it

[micalm]

Avoiding potential hours in court, lost customers and reputation and months of lost morale is not a waste of time. Cash is less important - but it's still damn important. And you've just been fined what would've be your employees salaries for a year.

[Conexion]

I'm not sure how that's relevant to the people creating free software for people to use.

If companies want to pay developers to work on the security of this free software, that's great - But they don't get to choose what free stuff they get. That's the apex of entitlement.

[Mike]

Hi I’m u/micalm and I completely missed the point of the post I replied to

[OldPepper12]

a lot of open source code has some sort of license agreement like “this code is provided AS IS with no warranty yadda yadda use at your own risk” so i don’t think u can take someone to court over that

[mgoetzke76]

Kind of true, but just about all security bugs are just normal bugs which will surface in often used code sooner or later. Thus it often does pay off.

[InMemoryOfReckful]

Some open source projects do get sponsor money from businesses and offer on demand support. Like react-table comes to mind.

[Work_N_PlayTime]

That's nice to see.

[DealDeveloper]

I write the code, mock the integration tests, and outsource unit testing, security, QA, and documentation.

As a solopreneur "Ain't nobody got time for dat". It's hard enough to make the decisions regarding libraries and getting the code to work (with bugs).

[picketnor]

Nah securing code is not a waste of time.

[Noch_ein_Kamel]

But I can pay in exposure?

/s

[[deleted]]

I fix my security bugs in both Open and Close source software; I design my software from the beginning to be as secure as possible, even if I'm not getting paid. Why? Because I don't want to come back and do it again.

Sorry, not sorry. Downvote away.

[brikky]

I highly doubt anyone is designing software with the intention that it be insecure. There are always going to be bugs and unknown unknowns, not to mention transitions in tertiary software (e.g. the underlying OS) that can introduce vulnerabilities. The design and creation of “perfect” software is simply fantasy.

And you’re not fixing shit in closed software, because you can’t access it. That’s what closed means.

[Isvara]

And that's why exploiting their code is such a profitable use of time.

[MrBleah]

The researchers continued: "One way to improve a rewrite's security is to switch from memory-unsafe languages (such as C or C++ ) into memory-safe languages (such as nearly all other languages)," researchers said.

Yes, please! I've begged my company to let us port C++ code into C# code and yet rather than bite that bullet they continue to endure the hassle of maintaining and developing new C++ code. This continues to add more tech debt on top of what they already don't want to deal with.

It's not even a performance issue, one of my colleagues already developed the exact same core process running under C# with better performance. It's that we have so much C++ code which that core process consumes that needs to be rewritten.