Saying things like "I don't like this software because <concrete reason>" is reasonable; it can be considered constructive criticism, especially if you include a way it could be done better. Heck, even just "I think it's too complicated to use, and the underlying code base needed to support that complexity lends itself to bugs that can be exploited" would be better.

Saying things like "No amount of money is going to impart good taste and best practices onto these projects" is insulting the people who wrote it with no real basis. It's not helpful and it makes you (and some other people in the thread) sound like a jerk.

If only being nice to people prevented security bugs, eh?

Are you proposing that being rude does?

The unfortunate thing about scratch rewrites is that they are not a good business. Open Source has conditioned people to think that libraries should be free. It's not clear to me that the alternative where libraries are obscenely expensive (like in the hardware world, where a hash table is a $100k investment) is any better. Nobody has ever built a successful company charging between $0 and $10,000 for a library. That is just how people see things, and unfortunately it is extremely hard to change.

Some platforms have reasonable markets for libraries; Advanced Messaging Systems[0], DevExpress[1] and Aspose[2] are three examples of companies that successfully sell software libraries for .NET, Java, and Office.

[0] https://www.dimastr.com/redemption/home.htm

[1] https://www.devexpress.com/

[2] https://www.aspose.com/

> The uncomfortable truth is these libraries need scratch rewrites with better authors.

If that's true, do you think that having money might possibly be helpful to that effort?

That wouldn’t be funding log4j2 though (from the ‘better authors’ part). That would most likely be an internal effort (devs you trust) published as a new open source logging framework in a sea of existing ones.

Honestly, absolutely not, and I think money would be harmful. Lots of software doesn't need a lot of work. It can be simple. When people get paid to solve problems there's an incentive to add more code, to add new domains, etc.

Use the standard java logger and move on, it's that easy.

Where’s my incentive to work the weekend supporting a project after a long week of supporting my production code? If we want solid and secure OSS, we gotta pay someone!

Presumably it's the same incentive that pushed you to write it the first time.

If you don't want to work on it anymore that's OK too. Open source libraries are generally not held to particularly stringent requirements by the vast majority of people - perhaps accepting an obvious patch in a critical situation, at most.

You obviously can pay people. They're called employees. The thing about employees is that your money translates to business value, which is much broader than a single library. This means that when a single library is done the developer doesn't have to think "ok but what's next for this library" and start adding more code. They can stop and move on to other tasks.

Paying for a single library is nice. I support multiple open source developers because I appreciate their work. I recommend everyone does so.

I don't at all believe it's going to help security though.

One of the maintainers in question holds two jobs to live. Having money might allow him more time to test and retest and update the software more expediently.

Sorry, I was posing that question semi-sarcastically. I agree it's blindingly obvious to any sensible person that money would help immensely. However, sadly, there are apparently plenty of people who are just about sensible enough to be able to get out of bed and navigate to this site, but not sensible enough to understand much else.

OpenSSL at least has significant value, handling logs is usually an easy task.