Special author: Jia Tan was a co-maintainer in 2022-2024. He and the team behind him inserted a backdoor (CVE-2024-3094) into XZ Utils 5.6.0 and 5.6.1 releases. He suddenly disappeared when this was discovered.
I agree we should support him, but you know who should be more concerned with giving him and other open source maintainers money? The billion dollar corporations that rely on these critical projects and use them absolutely for free. Amazon, Microsoft, Sony, Samsung, Google, Siemens, Motorola, God knows how many more.
What about a license that would require every company with a market cap above 25 B that (indirectly) uses the software to contribute X amount (like $1000 a year) of revenue back?
GitHub has a tool built-in to show all dependencies, it’s not that hard to write a little script to check the LICENSE files in the repositories. I’m sure one of the biggest companies in the world has the ability to do that.
One of the biggest companies in the world used Copilot to give its users code scraped from GitHub projects without telling them it came from GitHub and that it’s under various licenses that need to be followed.
I mean this is already a thing to certain degrees right? Virtualization platforms I use both are free for personal use, but not business use, or at least certain feature package use isn’t permitted. What’s the difference? Putting the software under a different license/eula?
Why limit it? If you’re actively making money, or you are a licensed business attempting to do so, people actively helping you build business deserve to be compensated. If a developer just happened to live in your area and said “I could make your business better by making this thing for you,” would they be worth hiring? What’s the saying, socialize the resources, privatize the profits? Size << Intent
We need more non profits who can set aside funds for these projects. It not like these companies don’t want to help its just jot entirely clear how they can help.
This is one of the problems, these companies and other groups just use a dependency maintained by one person (Lasse) without meaningfully contributing to its survival themselves.
Sure. But if the project in question only has one or two donation methods and none of those are supported by the company, then the company can’t easily donate anything. Companies usually have a strict way of how they can donate and it usually entails Paypal or some other costly solution, while projects like that likely just has a patreon or LibrePay option and perhaps a crypto wallet. Most companies can’t work with that.
In my opinion it is a terrible choice for a company to rely on a dependency like XZ, especially maintained by one person as a hobby, without being able to meaningfully contribute to the maintenance themselves. I just don’t think I can be sympathetic to a company having to maybe bend a rule or two to donate.
Ofc I exaggerated, samsung is not a monolithic entity. I mean most, if not all, on the managerial position would not care at all. Also, does being android-like mean they are receptive to OSS?
I would argue this might make xz safer mid-term. So much eyes on it. I’m not familiar with other solutions, but who’s to say the bad actor won’t try a similar trick elsewhere
XZ is a slog to compress and decompress but compresses a bit smaller than zstd.
zstd is quite quick to compress, very quick to decompress, scales to many cores (vanilla xz is single-core only) and scales a lot further in the quicker end of the compression speed <-> file size trade-off spectrum while using the same format.
Add comment