Friend who is not a software person sent me this tweet, which amused me as it did them. They asked if “runk” was real, which I assume not.
But what are some good examples of real ones like this? xz became famous for the hack of course, so i then read a bit about how important this compression algorithm is/was.
There is a guy named Arthur David Olson who maintains a small database of all the time zones in the world, including things like leap seconds and such. It’s used by everybody and it is updated several times a year. See here:
If we could all just stop making changes to time zones, that would make my job very slightly easier.
Perhaps we’ll move to UTC+10¼, and then move forward 45 minutes in the summer.
If the day number is a prime, then we’ll go back π hours.
Hope that will help!
I bet he’s paid nothing to do it. Then one day, when a timing attack happens that can be traced to the DB, some knobhead CTOs and tech influencers will start talking about “securing the supply chain”. They’ll want other such bullshit and responsibilities to be shoved unto volunteers.
Two quotes come to mind “Fuck you, pay me” and “Open source maintainers owe you nothing”.
It would make sooo much more sense for the ISO to set something up, and make governments each responsible for keeping it updated, since they’re the ones doing the changing.
Require all participants to amend their law/regulations, so there’s a note to prompt whoever is in power and changes it next.
I’m sure some places would still neglect to do it… Haha
It has organizational support from ICANN, so it’s not done in total isolation.
Sqlite isn’t quite one person, but it is a very small team and is extremely widely used. https://www.sqlite.org/mostdeployed.html
And their website is quirky
As is their code of ethics.
Have something to share?
Lmao yo wtf
Jesus Christ
SQLite devs are trolls to their suppliers that’s great 😂
They said they’re quite serious about it, actually. While it’s quirky, I don’t see anything wrong with it. It’s… weirdly charming? I’d never use anything like it, but it’s fun to see something different amidst a world of copy-pasted contributor covenants.
I mean, to make such a point that the only point of the page was simply to satisfy a requirement of someone else’s volition and yet creating that page and apparently saying what you’re saying—seems like there’s something misaligning here :P
Also I no doubt that they hate people who talk too much and hate making jokes — there’s some seriously unserious stuff inside of the rules they posted. They are serious folks who have zero tolerance for laughter apparently :D
My headcanon is they’re a bunch of people who have a super religious supplier with strict checkbox rules and they are fucking with them.
NTP is the one that comes to mind for me.
Basically every device uses it and until fairly recently was maintained by a single person
Curl comes to mind. Libcurl is at the foundation of almost all networking.
And they still get emails from randos when some program that uses curl doesn’t work (the Readme is top notch).
I cannot for the life of me find what you’re referencing. I only remember the
sqlite/etilqsfiasco with McAfee.https://github.com/mackyle/sqlite/blob/a009acaca1fe25d909d8b5180c0120af1abc2b82/src/os.h#L56-L79
https://bagder.github.io/emails/ has the email collection.
Here’s an example from NASA
I feel a bit split about this. Seems it is an actual law, and it kind of makes sense. You probably don’t want random components from unknown people and places in your multi million dollar space equipment. But it feels rather arrogant to just demand such things.
Is NASA actually a customer? Did they pay for a license to use curl (genuine question - I’m not familiar enough with it to know if enterprises and organisations require a paid license)? Are they planning on becoming a paying customer? Do they make donations to the project? If not, it feels kind of rude to send a demand letter to the lead developer of a free piece of software straight up demanding a formal letter stating where the free software is being developed and maintained (for free), or if outside the USA, that the free software has been tested in the USA. Oh, and a bonus demand that such information be returned within 5 business days (naturally with an implied “or else”, just to really make sure those pesky people maintaining open source software for free really get the memo)
In any case, why don’t all their scary 3 letter spy agencies go and figure it out on behalf of NASA themselves? It’s open source, they could just like, read the source, test the source, and audit the source themselves. Or fork it and make any modifications they’d like to ensure its safety
I don’t blame the person sending the emails, obviously, they’re just following orders, but the whole email reads as very entitled and arrogant, assuming NASA don’t provide any compensation to the project and projects maintainers for their use of curl
https://daniel.haxx.se/blog/2020/12/17/curl-supports-nasa/
https://daniel.haxx.se/blog/2023/02/07/closing-the-nasa-loop/
Their process for validating software doesn’t have a box for “open source”, and basically assumes it’s either purchased, or contracted. So someone in risk assessment just gets a list of software libraries and goes down it checking that they have the required forms.
As the referenced talk mentions, the people using the software understand that all the testing and everything is entirely on them, and that sending these messages is bothersome and unfair, and they’re working on it. Unfortunately, NASA is also a massive government bureaucracy and so process changes are slow, at best.
The TLAs don’t generally help NASA, and getting them involved would unfortunately only result in more messages being sent.As for contributions, I think that turns into an even worse can of worms, since generally software developed by or for the US government isn’t just open source, but public domain. I think you’d end up with a big mess of licensing horror if you tried to get money or official relationships involved. It’s why sqlite is public domain, since it was developed at the behest of the US.
Mostly just context for what you said. NASA isn’t being arrogant, they’re being gigantic. Doing their due diligence in-house while another branch goes down a checklist, sees they don’t have a form and pops of an email and embarrassing the hell out of the first group.
The time limit thing is weird, but it’s a common practice in bureaucracies, public or private. You stick a timeline on the request to convey your level of urgency and the establish some manner of timeline for the other person to work with. Read the line again, but extremely literally: “we have a time frame of 5 days for a response”. “Our audit timeline guessed that it would take a business week for you to reply, so if you take longer we’re behind schedule”. The threatening version is “your response is required on or before five business days from the date of this message”.
The presumption is that the person on the other end is also working through a task queue that they don’t have much personal investment in, and is generally good natured, so you’re telling them “I don’t expect you to jump on this immediately, but wherever you can find a moment to reply this week would keep anyone from bothering me, and me from needing to send another email or trying to find a phone number”
curl is most definitely not developed solely by one person though, it has thousands of contributors. in fact, there is so much red tape around curl that you can’t even discuss making a change to it without first writing an RFC and having it approved by a committee.
Libcurl is at the foundation of almost all networking.
That’s not remotely true, but it is nevertheless outstanding work and very much deserving of recognition and support.
I mean, it was either Richard Stallman or Dennis Ritchie that created grep in an evening so that a buddy of his could do research on volumes of text that wouldn’t fit in the RAM of a PDP-11 (or similar machine. I’m telling this story from memory). It’s designed to do what you would do with the ancient text editor ed using the commands Global, Regular Expression, and Print. g re p. grep. Probably the most important piece of software ever written in a couple hours.
Relevant, for those interested in the history of grep. Computerphile
Mark Russanovich was just some guy who had trouble fixing Windows computers so he wrote systernals from scratch including widely used psexec and other required tools if you are forced to be a windows admin. He has since grown up into a very hansom man who runs Azure which sucks.
“He has since grown up into a very hansom man who runs Azure which sucks.”
Thanks for this. Really brightened my day.
I believe the quintessential example is curl Also here’s the relevant xkcd: https://xkcd.com/2347/
The curl author writes a lot about his struggles, but he’s also employed to maintain curl, so not really a good example
Based on my cheatsheet, GNU Coreutils, sed, awk, ImageMagick, exiftool, jdupes, rsync, jq, par2, parallel, tar and xz utils are examples of commands that I frequently use but whose developers I don’t believe receive any significant cashflow despite the huge benefit they provide to software developers. The last one was basically taken over in by a nation-state hacking team until the subtle backdoor for OpenSSH was found in 2024-03 by some Microsoft guy not doing his assigned job.
I heard about that last one on a podcast and it was the first thing I thought of when I saw this post. Genuinely interesting story (if you’re into that sort of thing). The pod was saying how it’s both a flaw of open source that it could happen that way and an advantage because it was discoverable due to the fact that the code is open source.
Which podcast? Sounds like something I’d be interested in listening to
And those are only fully packaged user-facing software.
I’d guess almost all of the Rust code for low level hardware access is maintained by a single person. Most of them once joined forces and created a standard, it had 4 developers last time I checked. The only usable cryptography library for C# has a single developer, and while on crypto, that meme got widespread because of OpenSSL, that had a single developer who spent most of his time on OpenSSH and other BSD user-facing software.
Also, while we are on crypto, the modern algorithms were all created by a single researcher, that got famous for a work on how to decide if you can trust a crypto algorithm. Almost everybody uses his code.
Anyway, that meme first appeared because of Javascript, when a developer removed his library (with ~10 lines of code) from the language’s repository and almost every Javascript software broke.
The
core-jsstory always makes me sad. Sure, he’s developing an open source project and no one HAS to pay him. But the meager amount of donations and the tons of hate he receives isn’t justifiable.I had seen the hate before and foolishly just assumed he was deserving of it. Its a horrible situation he’s in and he is being cast in a bad light because he reached out for help.
It’s especially sadder when a substantial amount of the donations vanished when Open Collective and others stopped operating to Russians.
Oh dear, that post from the core-js guy made my blood boil. He’s been taken advantage of by the whole world.
Idk who needs to know this, but in Norwegian “runke” means to jerk off. “runk” is the word you add a prefix to in conjugation to get the different inflections
- runke - jerk off
- runker - jerking off
- runket - jerked off
Etc…
also the swedish meme subreddit is called r/unket
Hi, I’m a Finn. We also have a variation of this.
Ronald’s Universal Number Kounter sounds like someone did it on purpose.
There’s a lot of that in the software world. I’m thinking of gimp.
Graphics Image Manipulation Program, yeah right
Pretty much every basic terminal command for linux. Grep is the one that comes to mind.
The modern man uses
ripgrep👍But it’s three more letters. No deal.
Its going installed binary is
rg.I shall begrudgingly consider it then, with much begrudgement.
Is-even and is-odd on npm.
For a while, openssl was maintained by 1 or 2 people.
Like half of the npm is maintained by a single, arguably awful, person who writes his microprojects into large pieces of software to maximize how often his code gets installed.
Sindre Sorhus?
Jon Schlinkert, I believe. Sindre has a lot of stuff as well, but has a better reputation afaik
Just looked them up… holy hell. How does one have so many repos! And all the apps he’s made.
What’s the story on them?Edit: just looked it up myself. Seems to be a well liked person in the open source community. Idk. Regardless, props to them for the work they put in.
I would love this even more if one depended on the other and just did a “not even” for example.
Well good news! Time to let yourself love again!
I thought that was the case tbh, has it changed?
Edit: is-even depends on is-odd.
left-pad was the first thing that came to mind for me
Yeah that debacle still pisses me off. Especially the fact that someone could possibly trademark and enforce a trademark a name that’s already in use. It’s made even worse that the package that now uses the stolen name is defunct.
I hope all of the bad actors burn in Hell.
What pisses me off is that NPM thought it would be okay to remove something from their repository.
Azer did nothing wrong.
Laurie Voss made a bad call and should feel bad.
The principals of free software was, is, and always will be more important than every single dollar in silicon valley combined.
No arguments there, if you’re gonna depend on a piece of code, you better own it or have a rock solid plan b.
I think he overreacted a bit, not to having his package name forcibly taken from him, but to being asked to give it up in the first place. Kik explained to him that they have to fight this or lose their tradmark because thats how trademark law works. His response was basically “haha fuck you”. He probably could’ve asked for a couple thousand and just changed the name of his project and everything would’ve been fine.
being asked to give it up in the first place. Kik explained to him that they have to fight this or lose their tradmark because thats how trademark law works.
I’m not a lawyer but from what I know that’s a load of shit. There’s nothing stopping a trademark holder from granting licensing rights to third parties, without charge, to use their trademark in specific ways.
They chose not to because its easier, and most people won’t know better, so they roll over.
His response was basically “haha fuck you”. He probably could’ve asked for a couple thousand and just changed the name of his project and everything would’ve been fine.
This is the correct response, even if Kik would’ve given him money. It’s his package, he got the name first. Corpos can eat shit, just because its not the easy choice, or the choice you would’ve made doesn’t mean it was wrong. That package should’ve stayed down on principal.
Paul Eggart is the primary maintainer for tzdb, and has been for the past 20 years.
Tzdb is the database that maintains all of the information about timezones, timezone changes, leap whatever’s and everything else. It’s present on just about every computer on the planet and plays an important role in making sure all of the things do time correctly.If he gets hit by a bus, ICANN is responsible for finding someone else to maintain the list.
Sqlite is the most widely used database engine, and is primarily developed by a small handful of people.
ImageMagick is probably the most iconic example. Primarily developed by John Cristy since 1987, it’s used in a hilarious number of places for basic image operations. When a security bug was found in it a bit ago, basically every server needed to be patched because they all do something with images.
Furthermore, “RUNK” was originally made in the 1980s to take over from a program written on punch cards in the 1960s. Finally, it’s missing some important functions that the original 60s program had because "RUNK"s developer doesn’t see the purpose of those functions and refuses to add them; and no one has publically released a fork of “RUNK” that adds those functions back in, so you have to do it yourself. Thank God it’s open source.
Edit: oh yeah, and back in 2005 there was an effort to make a GUI for it, but “RUNK’s” sole developer got mad because “back in the 80s we didn’t need GUIs; command line is infinitely faster” and kept intentionally breaking support for the GUI with each bug fix, leading to the project eventually being abandoned.
