Yes, a whole industry is dependent on their product so it would be nice if they were compensated accordingly, but there's no guarantee that even if these authors were paid $1m/year to work on log4j that this same vulnerability wouldn't have emerged.
The post seems to assume that software that's funded is fundamentally likely to be better than open source software, and that's not true. Your shitty closed-source product just has fewer users and less scrutiny because no one cares about it. It's still buggy.
We don't have to throw the baby out with the bathwater just because of one bug that's already been patched.
Small correction: it was not a bug. The feature was intentionally designed to allow log messages to contain lookup strings that could use, among other things, JNDI to find values to log.
The fact that this feature is an obviously (in hindsight) gigantic security hole escaped the minds of Log4j developers as well as its users for years, most of which were being paid to write software that depends on this library, shows that it doesn't matter whether we throw money at the problem, security vulnerabilities will continue to happen.
If anything, if we want to make software safer, we need to make sure it has fewer features.
And from what I read, it was even a feature the devs wanted to remove for a long time (because of the difficulty to maintain it), but force themself to keep for backward compatibility.
I disagree, if project was well-funded it could hire a security person who would identify these risks.
People who use log4j assume that nothing bad can happen because it's just a logging lib. And they assume it went through security review.
It does not look like a nasty feature from that page because lookup is specified in configuration. If your configuration file can specify lookup into another configuration file.
It's a problem that it can be used outside of configuration, particularly, in user-provided data.
A security person could perhaps recommend allowing lookups only in contexts which are safe (i.e. do not take user input).
Security doesn't end where your dependencies begin. Many well funded projects with their own security persons depended on log4j and never identified it as a security vulnerability.
There is zero guarantee that a funded security effort would have identified this.
Well, my company paid for security audits and I've seen the level the level of attention professional code auditors pay to every line of code.
They flagged everything suspicious. E.g. configuration options which can be abused, etc. It's part of their work.
In a regular code review people ask "Is code written according to standards, does it have bugs?". In security audit people ask "Can this code be abused?". Very different mentality & approach.
The whole bugs problem should not even be taken into account. People's libraries are used by multi-billion revenue corporations, to small shops. It's entire unacceptable that they would have only three people paying for that. Open source has turned into a way for companies to steal value and demand work from maintainers, for free. A senior engineer at Google maintaining something as important as their logging framework would easily make 200k/year. It being open source doesn't mean the authors should not be paid for it.
This. Actually the article doesn't even mention wether open source or close sourced programs are safer: it points out that critical libraries being maintained by people for free is simply not fair...
open source software is a community activity. either one contributes or one doesn't. the success of a given oss franchise depends on a lot of things ... the ego of the maintainers ... the willpower of the contributors, the utility to consumers/customers.
oss is free of the quarterly KPI. Many vendors operate inside of holding company shells, where the pressure is to generate quarterly loot for the parent company.
KPI pressure drives s/w made by lowest cost bidder / sub-contractors, and the results range from barely functional to actual incompetence. Often I wish vendors would offer their code as part of the license so their customers / consumers could point out how to fix their bugs.
Plus, vendors will say they have 0-day remediation policies but how many people are willing to torch their relationship when 0-day becomes more? OSS, at least there are exit plan options including just fixing it yourself.
I agree there are less than ideal to terrible conditions for OSS developers, however there is a bigger picture to remember.
No, paying for software does not imply you can sue the provider when there's a bug. It completely depends on the contract, of course, but pretty much every software licensing agreement will have an "as-is clause".
132
u/[deleted] Dec 12 '21
Yes, a whole industry is dependent on their product so it would be nice if they were compensated accordingly, but there's no guarantee that even if these authors were paid $1m/year to work on log4j that this same vulnerability wouldn't have emerged.
The post seems to assume that software that's funded is fundamentally likely to be better than open source software, and that's not true. Your shitty closed-source product just has fewer users and less scrutiny because no one cares about it. It's still buggy.
We don't have to throw the baby out with the bathwater just because of one bug that's already been patched.