• xlash123@sh.itjust.works
    link
    fedilink
    arrow-up
    257
    ·
    9 months ago

    Commit 77a294d

    Update maintainer and author info. The other maintainer suddenly disappeared.

    Lmao, that’s putting it lightly.

    • 7eter@feddit.de
      link
      fedilink
      arrow-up
      160
      ·
      9 months ago

      the other maintainer now has a special place:

      Special author: Jia Tan was a co-maintainer in 2022-2024. He and the team behind him inserted a backdoor (CVE-2024-3094) into XZ Utils 5.6.0 and 5.6.1 releases. He suddenly disappeared when this was discovered.

    • kadu@lemmy.world
      link
      fedilink
      arrow-up
      230
      arrow-down
      1
      ·
      edit-2
      9 months ago

      I agree we should support him, but you know who should be more concerned with giving him and other open source maintainers money? The billion dollar corporations that rely on these critical projects and use them absolutely for free. Amazon, Microsoft, Sony, Samsung, Google, Siemens, Motorola, God knows how many more.

      • aard@kyu.de
        link
        fedilink
        arrow-up
        35
        ·
        9 months ago

        He probably needs a comaintainer. We could select one of us and then try pressuring him into accepting that.

      • Possibly linux@lemmy.zip
        link
        fedilink
        English
        arrow-up
        16
        ·
        9 months ago

        We need more non profits who can set aside funds for these projects. It not like these companies don’t want to help its just jot entirely clear how they can help.

          • Strit@lemmy.linuxuserspace.show
            link
            fedilink
            arrow-up
            5
            ·
            9 months ago

            Sure. But if the project in question only has one or two donation methods and none of those are supported by the company, then the company can’t easily donate anything. Companies usually have a strict way of how they can donate and it usually entails Paypal or some other costly solution, while projects like that likely just has a patreon or LibrePay option and perhaps a crypto wallet. Most companies can’t work with that.

            • catnash [she/her, ae/aer]@lemmy.blahaj.zone
              link
              fedilink
              English
              arrow-up
              1
              ·
              9 months ago

              In my opinion it is a terrible choice for a company to rely on a dependency like XZ, especially maintained by one person as a hobby, without being able to meaningfully contribute to the maintenance themselves. I just don’t think I can be sympathetic to a company having to maybe bend a rule or two to donate.

            • catnash [she/her, ae/aer]@lemmy.blahaj.zone
              link
              fedilink
              English
              arrow-up
              1
              ·
              9 months ago

              This is one of the problems, these companies and other groups just use a dependency maintained by one person (Lasse) without meaningfully contributing to its survival themselves.

              • Possibly linux@lemmy.zip
                link
                fedilink
                English
                arrow-up
                2
                ·
                9 months ago

                We just need more non profits to manage projects. If a maintainer burns out they should be able to contact some organization to find help.

        • TdotMatrix@lemmy.ml
          link
          fedilink
          arrow-up
          4
          arrow-down
          1
          ·
          edit-2
          9 months ago

          I gotta hand it to Samsung that they outline all the open source licences they use, at least in their Galaxy smartphone products:

          • someacnt_@lemmy.world
            link
            fedilink
            arrow-up
            1
            ·
            9 months ago

            Ofc I exaggerated, samsung is not a monolithic entity. I mean most, if not all, on the managerial position would not care at all. Also, does being android-like mean they are receptive to OSS?

            • BreakDecks@lemmy.ml
              link
              fedilink
              English
              arrow-up
              1
              ·
              9 months ago

              © 2024 Tizen Project, a Linux Foundation Project. All Rights Reserved. Linux is a registered trademark of Linus Torvalds.

    • MenigPyle@feddit.dk
      link
      fedilink
      arrow-up
      13
      ·
      9 months ago

      I wrote to ask him but I never heard back. To be fair he’s probably quite stressed at the moment.

  • Yondoza@sh.itjust.works
    link
    fedilink
    arrow-up
    59
    arrow-down
    24
    ·
    9 months ago

    Can someone provide a summary on what this means? I thought there were malicious exploits in this. Why is it back up and the perpetrator unbanned?