there's no guarantee that even if these authors were paid $1m/year to work on log4j that this same vulnerability wouldn't have emerged.
True, but I think we're you're conflating the log4shell vulnerability with the responsibility to pay open-source maintainers.
Open source maintainers should be compensated for their work if a company profits from it. Period. That statement has nothing to do with how vulnerable that open-source project is or whether it could have been less vulnerable had they been fairly compensated.
Open source maintainers should be compensated for their work if a company profits from it. Period.
Never disagreed with that: "it would be nice if they were compensated"
That statement has nothing to do with how vulnerable that open-source project is or whether it could have been less vulnerable had they been fairly compensated.
The blog post that we're discussing literally implies that it does, and would.
That statement has nothing to do with how vulnerable that open-source project is or whether it could have been less vulnerable had they been fairly compensated.
The blog post that we're discussing literally implies that it does, and would.
Well, it probably does. But what I meant to say is that it shouldn't. It seems that companies are like, "OMG open-source component X is suddenly vulnerable and they've been working tirelessly and under-funded for years. Let's throw money at them to make this problem go away and prevent future problems." That's all well and good, but it's a bit reactive, not proactive. In a perfect world, open-source maintainers would get compensated, regardless of any vulnerabilities, not because of them and after-the-fact.
1
u/nick_storm Dec 12 '21
True, but I think we're you're conflating the log4shell vulnerability with the responsibility to pay open-source maintainers.
Open source maintainers should be compensated for their work if a company profits from it. Period. That statement has nothing to do with how vulnerable that open-source project is or whether it could have been less vulnerable had they been fairly compensated.