News for hackers. Stuff that matters.
Re:Reflections on Distrusting xz by irdc on Wednesday April 03, 2024 @06:40AM (#39915671)
“Given enough underfunded maintainers, all security is shallow.”[0]

0. https://en.wikipedia.org/wiki/Linus%27s_law

Re:Reflections on Distrusting xz by lenerdenator on Wednesday April 03, 2024 @10:00AM (#39917606)
I wouldn't say "funding" is necessarily the problem.

Most maintainers do it because they like doing it. Their main limiting factor is time. I can drop a million dollars an hour into a maintainer's lap; that doesn't mean they can dedicate every waking moment to a project. They still have human needs that money can't buy like sleep, family obligations, and health concerns. And that's making the assumption that the maintainer uses that million/hr to quit their job.

No, the problem is a lack of trustworthy candidates for maintainership and a lack of time. There are components of a GNU userland that are now too complex for a single human to both maintain and enhance at the same time. We now need to target multiple distros (really, more than are necessary, strictly speaking) and ISAs. Most are written in systems programming languages like C that are more complex than the average software engineer in 2024 works with.

We need consolidation, simplification, maintainer redundancy, and a trust/governance framework for packages.

Re:Reflections on Distrusting xz by mikrotikker on Thursday April 04, 2024 @08:36AM (#39929619)
We need to utilise a specialised AI to scan through the code looking for bugs and security holes. Imagine if openai donated server time to this.