• @[email protected]
    link
    fedilink
    2758 months ago

    Commit 77a294d

    Update maintainer and author info. The other maintainer suddenly disappeared.

    Lmao, that’s putting it lightly.

  • Possibly linux
    link
    fedilink
    English
    1258 months ago

    I wonder if he has a donation page. We need to get him some money.

    • @kadu
      link
      250
      edit-2
      8 months ago

      I agree we should support him, but you know who should be more concerned with giving him and other open source maintainers money? The billion dollar corporations that rely on these critical projects and use them absolutely for free. Amazon, Microsoft, Sony, Samsung, Google, Siemens, Motorola, God knows how many more.

        • @[email protected]
          link
          fedilink
          Deutsch
          218 months ago

          This!!!

          This!!

          People, stop celebrating “freeing” software of maintainers that want to prevent being exploited.

        • @grue
          link
          English
          18 months ago

          Because often what the sort of folks ideologically predisposed towards Free Software actually want is for users to donate voluntarily, or for governments to give maintainers grants or stipends, or something like that.

        • @ricdeh
          link
          English
          -128 months ago

          Because that’s a bad not even a solution.

          • qaz
            link
            358 months ago

            What about a license that would require every company with a market cap above 25 B that (indirectly) uses the software to contribute X amount (like $1000 a year) of revenue back?

            • paraphrand
              link
              English
              26
              edit-2
              8 months ago

              I think if that caught on then companies would call it undue burden to sift through all the dependencies they use to make such small payments.

              It is a difficult problem. But on the face of it your suggestion seems very reasonable.

              • @[email protected]
                link
                fedilink
                138 months ago

                Maybe that force them to just donate to every dependency, probably cheaper on their level. And better for project.

              • qaz
                link
                5
                edit-2
                8 months ago

                GitHub has a tool built-in to show all dependencies, it’s not that hard to write a little script to check the LICENSE files in the repositories. I’m sure one of the biggest companies in the world has the ability to do that.

              • @[email protected]
                link
                fedilink
                28 months ago

                If dual licensing was standard the software that uses things like xz would pay down the line so everything was funded.

            • @[email protected]
              link
              fedilink
              58 months ago

              I mean this is already a thing to certain degrees right? Virtualization platforms I use both are free for personal use, but not business use, or at least certain feature package use isn’t permitted. What’s the difference? Putting the software under a different license/eula?

              • qaz
                link
                28 months ago

                Yes, but the proposed license would also be free for businesses except for the largest in the world.

                • @[email protected]
                  link
                  fedilink
                  28 months ago

                  Why limit it? If you’re actively making money, or you are a licensed business attempting to do so, people actively helping you build business deserve to be compensated. If a developer just happened to live in your area and said “I could make your business better by making this thing for you,” would they be worth hiring? What’s the saying, socialize the resources, privatize the profits? Size << Intent

      • aard
        link
        fedilink
        378 months ago

        He probably needs a comaintainer. We could select one of us and then try pressuring him into accepting that.

      • Possibly linux
        link
        fedilink
        English
        168 months ago

        We need more non profits who can set aside funds for these projects. It not like these companies don’t want to help its just jot entirely clear how they can help.

          • Strit
            link
            fedilink
            58 months ago

            Sure. But if the project in question only has one or two donation methods and none of those are supported by the company, then the company can’t easily donate anything. Companies usually have a strict way of how they can donate and it usually entails Paypal or some other costly solution, while projects like that likely just has a patreon or LibrePay option and perhaps a crypto wallet. Most companies can’t work with that.

            • catnash [she/her, ae/aer]
              link
              fedilink
              English
              18 months ago

              In my opinion it is a terrible choice for a company to rely on a dependency like XZ, especially maintained by one person as a hobby, without being able to meaningfully contribute to the maintenance themselves. I just don’t think I can be sympathetic to a company having to maybe bend a rule or two to donate.

            • catnash [she/her, ae/aer]
              link
              fedilink
              English
              18 months ago

              This is one of the problems, these companies and other groups just use a dependency maintained by one person (Lasse) without meaningfully contributing to its survival themselves.

              • Possibly linux
                link
                fedilink
                English
                28 months ago

                We just need more non profits to manage projects. If a maintainer burns out they should be able to contact some organization to find help.

      • @someacnt_
        link
        -28 months ago

        I bet Samsung would not even know if open source is a thing

          • @someacnt_
            link
            18 months ago

            Ofc I exaggerated, samsung is not a monolithic entity. I mean most, if not all, on the managerial position would not care at all. Also, does being android-like mean they are receptive to OSS?

            • @[email protected]
              link
              fedilink
              English
              18 months ago

              © 2024 Tizen Project, a Linux Foundation Project. All Rights Reserved. Linux is a registered trademark of Linus Torvalds.

        • @[email protected]
          link
          fedilink
          2
          edit-2
          8 months ago

          I gotta hand it to Samsung that they outline all the open source licences they use, at least in their Galaxy smartphone products:

          • JackbyDev
            link
            fedilink
            English
            78 months ago

            As required by the licenses, yes. That’s the bare minimum lol.

    • @[email protected]
      link
      fedilink
      138 months ago

      I wrote to ask him but I never heard back. To be fair he’s probably quite stressed at the moment.

  • @[email protected]
    link
    fedilink
    348 months ago

    Can someone provide a summary on what this means? I thought there were malicious exploits in this. Why is it back up and the perpetrator unbanned?

    • @pixxelkick
      link
      968 months ago

      Lasse is the original maintainer of XZ, they have been placed back in their position as sole maintainer.

      “Jia Tan” was the person who slipped the backdoor into XZ and is now banned.

      Lasse has already fixed abd removed the backdoor.

      XZ itself is critical software everyone uses (its one of the main compression/decompression programs used on linux)

      • @[email protected]
        link
        fedilink
        English
        5
        edit-2
        8 months ago

        Yes but damage seems to be done. Distros are talking or have moved off of it to zstd.

        • Billegh
          link
          228 months ago

          There are some, probably. But any exodus will be slow. Xz isn’t useless because it was dangerous once.

          • @[email protected]
            link
            fedilink
            148 months ago

            Besides, XZ isn’t the only project in such a danger. Banning doesn’t solve that problem. They need to put in more funding and eyes.

        • Calyhre
          link
          108 months ago

          I would argue this might make xz safer mid-term. So much eyes on it. I’m not familiar with other solutions, but who’s to say the bad actor won’t try a similar trick elsewhere

        • @[email protected]
          link
          fedilink
          108 months ago

          Zstd and xz fullfil different needs. Xz take more time to compress and is faster to decompress as far as I know.

          • Atemu
            link
            fedilink
            68 months ago

            XZ is a slog to compress and decompress but compresses a bit smaller than zstd.

            zstd is quite quick to compress, very quick to decompress, scales to many cores (vanilla xz is single-core only) and scales a lot further in the quicker end of the compression speed <-> file size trade-off spectrum while using the same format.

    • @[email protected]
      link
      fedilink
      578 months ago

      Exploits were removed. Maintainer who committed them still banned. xz is a critical piece of software.

    • Billegh
      link
      378 months ago

      This sounds just like something Jia Tan might say…