Friend who is not a software person sent me this tweet, which amused me as it did them. They asked if “runk” was real, which I assume not.
But what are some good examples of real ones like this? xz became famous for the hack of course, so i then read a bit about how important this compression algorithm is/was.
Paul Eggart is the primary maintainer for tzdb, and has been for the past 20 years.
Tzdb is the database that maintains all of the information about timezones, timezone changes, leap whatever’s and everything else. It’s present on just about every computer on the planet and plays an important role in making sure all of the things do time correctly.If he gets hit by a bus, ICANN is responsible for finding someone else to maintain the list.
Sqlite is the most widely used database engine, and is primarily developed by a small handful of people.
ImageMagick is probably the most iconic example. Primarily developed by John Cristy since 1987, it’s used in a hilarious number of places for basic image operations. When a security bug was found in it a bit ago, basically every server needed to be patched because they all do something with images.
I’m surprised that no one seems to have brought up curl, which is maintained by Daniel Stenberg who is Just Some Guy™
Eh, bagder is more than “just some guy” to a lot of people! To me he’s kinda been my tech idol for 20 years lol, he also was a core part of building Rockbox (open source firmware for MP3 players) which was the first open source project I got seriously involved in as a kid ☺️
“Just some guy” doesn’t mean they aren’t amazing. I would argue the opposite. It just means they didn’t use their abilities to become rich and famous like some other assholes. They’re almost certainly more capable than them, not less.
I think that would be a great situation to be in.
You have created a cool thing a lot of people use, by being good at something. You’ve done something.
Also, people have no idea who you are. Nobody is digging through your trash, harassing the people you love, taking pictures of you wherever you go including on your bad hair days, etc. You’re just some guy.
Fair point! I think that’s part of why I admire him, humble greatness
Holy shit Rockbox was amazing. I might still be subscribed to the mailing list. I used that on a few different MP3 players as a kid. I had no idea. Fuck I am old.
Edit: For a list of what he has worked on - https://daniel.haxx.se/opensource.html
I second Rockbox here, it’s fucking great.
Holy shit, I remember Rockbox… Big time nostalgia on that one!
There is a guy named Arthur David Olson who maintains a small database of all the time zones in the world, including things like leap seconds and such. It’s used by everybody and it is updated several times a year. See here:
I bet he’s paid nothing to do it. Then one day, when a timing attack happens that can be traced to the DB, some knobhead CTOs and tech influencers will start talking about “securing the supply chain”. They’ll want other such bullshit and responsibilities to be shoved unto volunteers.
Two quotes come to mind “Fuck you, pay me” and “Open source maintainers owe you nothing”.
It would make sooo much more sense for the ISO to set something up, and make governments each responsible for keeping it updated, since they’re the ones doing the changing.
Require all participants to amend their law/regulations, so there’s a note to prompt whoever is in power and changes it next.
I’m sure some places would still neglect to do it… Haha
It has organizational support from ICANN, so it’s not done in total isolation.
Oh neato, then all good!
If we could all just stop making changes to time zones, that would make my job very slightly easier.
Perhaps we’ll move to UTC+10¼, and then move forward 45 minutes in the summer.
If the day number is a prime, then we’ll go back π hours.
Hope that will help!
It’s also worth pointing out that this was sued in a copyright lawsuit some time ago. The wikipedia article mentions it, but here’s the slashdot discussion if you want to feel like stepping into a time machine: https://m.slashdot.org/story/158778
It caused a momentary panic when everyone realized that this thing runs the system clocks for everything everywhere, and if it got taken down by a copyright suit it would be disastrous for, well, everybody.
Wasn’t there also very recently a whole thing about the single guy who maintains the NTP spec threatened to retire so he could get a “real” job, which caused a gigantic internet-wide panic as pretty much everything we do relies on computer’s clocks being perfectly synced?
Runk means masturbation in Icelandic so that adds another layer of hilarity to this
Same in Swedish
I’m from the west coast of Canada, a euphemism for jerking off where/when I grew up is “pulling the pud.” Moving to the UK had some funny bits…like Christmas Pud…as in pudding(dessert). Pronounced slightly different, but my inner 6 year old had a laugh anyway.
I’ve heard “shaking hands with the unemployed”.
https://www.etymonline.com/word/pudendum
It’s a more general English phrase. Could come up with a good insult for transphobes with this though. “Pud CHUDs?”
Well…that’s kinda disappointing 😞.
I think we can workshop something out of Pud for transphobes. But it’s going to have to be tomorrow for me.
Well, what is it?
If I’m remembering correctly, this phrase was immortalized in a Primus track at one point. There’s a weird, short track (or maybe an intro to a longer song?) on “Sailing the Seas of Cheese” that’s just one guy singing along with running water, and as I remember them, the lyrics are: “As I stand here in the shower, singing opera and such/pondering the possibility that I pull the pud too much/there’s a scent that fills the air; is it flatus? just a touch/and it makes me think of you.”
Which apparently is still in my brain, even though I didn’t think I’ve listened to that album since the 90’s. My brain is weirdly prone to storing old audio, though.
Based on my cheatsheet, GNU Coreutils, sed, awk, ImageMagick, exiftool, jdupes, rsync, jq, par2, parallel, tar and xz utils are examples of commands that I frequently use but whose developers I don’t believe receive any significant cashflow despite the huge benefit they provide to software developers. The last one was basically taken over in by a nation-state hacking team until the subtle backdoor for OpenSSH was found in 2024-03 by some Microsoft guy not doing his assigned job.
And those are only fully packaged user-facing software.
I’d guess almost all of the Rust code for low level hardware access is maintained by a single person. Most of them once joined forces and created a standard, it had 4 developers last time I checked. The only usable cryptography library for C# has a single developer, and while on crypto, that meme got widespread because of OpenSSL, that had a single developer who spent most of his time on OpenSSH and other BSD user-facing software.
Also, while we are on crypto, the modern algorithms were all created by a single researcher, that got famous for a work on how to decide if you can trust a crypto algorithm. Almost everybody uses his code.
Anyway, that meme first appeared because of Javascript, when a developer removed his library (with ~10 lines of code) from the language’s repository and almost every Javascript software broke.
I heard about that last one on a podcast and it was the first thing I thought of when I saw this post. Genuinely interesting story (if you’re into that sort of thing). The pod was saying how it’s both a flaw of open source that it could happen that way and an advantage because it was discoverable due to the fact that the code is open source.
Which podcast? Sounds like something I’d be interested in listening to
Also replied to another comment, sounds like this one here: https://opensourcesecurity.io/2024/04/01/xz-bonus-spectacular-episode/
Do you have a link to the podcast?
Sounds like the open source security podcast. Specifically this episode: https://opensourcesecurity.io/2024/04/01/xz-bonus-spectacular-episode/
Kurt and Josh are great, one of my favourites.
remember heartbleed?
Mark Russanovich was just some guy who had trouble fixing Windows computers so he wrote systernals from scratch including widely used psexec and other required tools if you are forced to be a windows admin. He has since grown up into a very hansom man who runs Azure which sucks.
“He has since grown up into a very hansom man who runs Azure which sucks.”
Thanks for this. Really brightened my day.
I’d say ffmpeg is a good example, it’s used by almost every piece of software that has to manipulate audio or video (including messaging applications), yet not many people know about its existance.
And Fabrice Bellard, the original author of ffmpeg, went on to create qemu which pretty much made open-source virtualization possible. Also TCC (even if I don’t think that one is widely used), he established a world record for computing decimals of Pi using a single machine that had ~2000× less FLOPS than the previous record, and so much more…
Fabric Bellard’s body of work is fairly strong evidence for time travel having happened already.
Or just genius.
Sqlite isn’t quite one person, but it is a very small team and is extremely widely used. https://www.sqlite.org/mostdeployed.html
And their website is quirky
As is their code of ethics.
Have something to share?
Lmao yo wtf
Jesus Christ
I see you like the first rule.
SQLite devs are trolls to their suppliers that’s great 😂
They said they’re quite serious about it, actually. While it’s quirky, I don’t see anything wrong with it. It’s… weirdly charming? I’d never use anything like it, but it’s fun to see something different amidst a world of copy-pasted contributor covenants.
I mean, to make such a point that the only point of the page was simply to satisfy a requirement of someone else’s volition and yet creating that page and apparently saying what you’re saying—seems like there’s something misaligning here :P
Also I no doubt that they hate people who talk too much and hate making jokes — there’s some seriously unserious stuff inside of the rules they posted. They are serious folks who have zero tolerance for laughter apparently :D
My headcanon is they’re a bunch of people who have a super religious supplier with strict checkbox rules and they are fucking with them.
- Be a stranger to the world’s ways.
one out of 72 isn’t bad
It looks pretty decent to me, at least on mobile. Definitely better than 95% of websites.
Damn, I wanted to mention sqlite.
It’s not too late. Mention it!
It’s okay you can just say FFmpeg
Also Linux
Also CoreJS
Also
sure? i tried 8bit transparent grayscale png generation and it turns out imagemagick produces images the kindle can display and ffmpeg fucks them up majorly and they wont show on kindle. ffmpeg is nice though.
FFmpeg is basically the only piece of audio/video conversion software in widespread use. Everything uses it under the hood. Microsoft Teams used it to stream your webcam. VLC uses it to play video. If you’ve ever uploaded your video to an online service to convert it to a different file format or codec, chances are the server that processed it did so using FFmpeg.
I have also noticed that FFmpeg kind of sucks at generating stills for reasons I’m not sure about though.
i know. i use ffmpeg for grading, keying etc in scripts…love it. but it is not good at stills.
I remember reading a story here not too long ago about a guy who broke the internet by taking his code away because some big company forced to have his package’s name or something along those lines
That’s leftpad. The package name dispute was over something else, but they pulled all their packages from npm in protest. Turned out leftpad was a transient dependency for a huge swathe of all JavaScript.
And IMO Koçulu should have sued NPM for everything they had. What NPM did to Koçulu was in violation of everything they stood for. Koçulu was there first with the Kik name, he should have had 100% of the rights to keep it.
The do-nothings vs the did-somethings.
Curl comes to mind. Libcurl is at the foundation of almost all networking.
And they still get emails from randos when some program that uses curl doesn’t work (the Readme is top notch).
I cannot for the life of me find what you’re referencing. I only remember the
sqlite/etilqsfiasco with McAfee.https://github.com/mackyle/sqlite/blob/a009acaca1fe25d909d8b5180c0120af1abc2b82/src/os.h#L56-L79
https://bagder.github.io/emails/ has the email collection.
Here’s an example from NASA
I feel a bit split about this. Seems it is an actual law, and it kind of makes sense. You probably don’t want random components from unknown people and places in your multi million dollar space equipment. But it feels rather arrogant to just demand such things.
Is NASA actually a customer? Did they pay for a license to use curl (genuine question - I’m not familiar enough with it to know if enterprises and organisations require a paid license)? Are they planning on becoming a paying customer? Do they make donations to the project? If not, it feels kind of rude to send a demand letter to the lead developer of a free piece of software straight up demanding a formal letter stating where the free software is being developed and maintained (for free), or if outside the USA, that the free software has been tested in the USA. Oh, and a bonus demand that such information be returned within 5 business days (naturally with an implied “or else”, just to really make sure those pesky people maintaining open source software for free really get the memo)
In any case, why don’t all their scary 3 letter spy agencies go and figure it out on behalf of NASA themselves? It’s open source, they could just like, read the source, test the source, and audit the source themselves. Or fork it and make any modifications they’d like to ensure its safety
I don’t blame the person sending the emails, obviously, they’re just following orders, but the whole email reads as very entitled and arrogant, assuming NASA don’t provide any compensation to the project and projects maintainers for their use of curl
https://daniel.haxx.se/blog/2020/12/17/curl-supports-nasa/
https://daniel.haxx.se/blog/2023/02/07/closing-the-nasa-loop/
Their process for validating software doesn’t have a box for “open source”, and basically assumes it’s either purchased, or contracted. So someone in risk assessment just gets a list of software libraries and goes down it checking that they have the required forms.
As the referenced talk mentions, the people using the software understand that all the testing and everything is entirely on them, and that sending these messages is bothersome and unfair, and they’re working on it. Unfortunately, NASA is also a massive government bureaucracy and so process changes are slow, at best.
The TLAs don’t generally help NASA, and getting them involved would unfortunately only result in more messages being sent.As for contributions, I think that turns into an even worse can of worms, since generally software developed by or for the US government isn’t just open source, but public domain. I think you’d end up with a big mess of licensing horror if you tried to get money or official relationships involved. It’s why sqlite is public domain, since it was developed at the behest of the US.
Mostly just context for what you said. NASA isn’t being arrogant, they’re being gigantic. Doing their due diligence in-house while another branch goes down a checklist, sees they don’t have a form and pops of an email and embarrassing the hell out of the first group.
The time limit thing is weird, but it’s a common practice in bureaucracies, public or private. You stick a timeline on the request to convey your level of urgency and the establish some manner of timeline for the other person to work with. Read the line again, but extremely literally: “we have a time frame of 5 days for a response”. “Our audit timeline guessed that it would take a business week for you to reply, so if you take longer we’re behind schedule”. The threatening version is “your response is required on or before five business days from the date of this message”.
The presumption is that the person on the other end is also working through a task queue that they don’t have much personal investment in, and is generally good natured, so you’re telling them “I don’t expect you to jump on this immediately, but wherever you can find a moment to reply this week would keep anyone from bothering me, and me from needing to send another email or trying to find a phone number”
curl is most definitely not developed solely by one person though, it has thousands of contributors. in fact, there is so much red tape around curl that you can’t even discuss making a change to it without first writing an RFC and having it approved by a committee.
Libcurl is at the foundation of almost all networking.
That’s not remotely true, but it is nevertheless outstanding work and very much deserving of recognition and support.
I mean, it was either Richard Stallman or Dennis Ritchie that created grep in an evening so that a buddy of his could do research on volumes of text that wouldn’t fit in the RAM of a PDP-11 (or similar machine. I’m telling this story from memory). It’s designed to do what you would do with the ancient text editor ed using the commands Global, Regular Expression, and Print. g re p. grep. Probably the most important piece of software ever written in a couple hours.
I’m telling this story from memory
pun intended? ;D
Relevant, for those interested in the history of grep. Computerphile
It’s also, in my opinion, the most verb-able of all *NIX commands.
Yeah I’ve told someone to grep something despite knowing they had a windows server
I don’t know, rm being short for “remove” is very verbaceous.
Oh go fsck yourself (maybe that works better written…).
Verbaceous is a great word. I’m adding it onto my “favourite words” list ,(even if it isn’t technically a word "
Ah, pshaw, I don’t subscribe to the notion that there’s such a thing as “not a word.” Why bother having a system of root words, prefixes and suffixes if we’re not allowed to use that system to build the words we need? Especially for the fun of it. Verbaceous is adjectivacular.
If he hadn’t written it someone else would have. Searching through text is an obvious thing to want to do.
but thank fuck specifically he has cos now it’s a brilliant piece of software xD
Oh and then you get all the projects with recursive acronyms, like WINE Is Not Emulation, MAME Ain’t (an) Mp3 Encoder, and of course GNU’s Not Unix.
MAME Ain’t an MP3 Encoder
You’re thinking of LAME. MAME is the Multiple Arcade Machine Emulator.
See why those names are kinda dumb? You end up with a lot of fairly similar 4 letter words.
Noted. When I develop an essential piece of software, I will name it George.
Git, by Linus? Maybe even linux itself? Ok actually Linus might just be Steve Wozniak without an annoying Steve Jobs guy next to him, while actually being a lot bigger than Apple maybe?
It’s really hard to imagine a world without Git. If it hadn’t been invented I think it would have been necessary to create it it’s one of those things that’s hard to imagine and then impossible to work out how you can survive without it.
Yet the vast majority of the world probably don’t even know what it is, and wouldn’t even understand it if it was explained to them.
Git is not the only version control software out there, and not the first one either.
Facebook for example is famous for not using git. Because their own modified copy of mercurial fits their needs better.
Microsoft didn’t use git until relatively recently either. They had to make some big contributions to make it work for their system.
their own modified copy of mercurial fits their needs better
The version I heard was that hg people were way nicer to them and very much willing to help compared to git.
I feel like Linus got a taste of his own medicine dealing with Gtk and Gnome people while developing Subsurface and that caused them to switch to Qt.
IIRC it’s both, sort of. They’ve contributed a lot to mercurial and, yes, that’s largely thanks to mercurial folks being more open and receptive to their desired changes compared to git. But they also have internal tools that build on top of mercurial, tools that you’re very unlikely to see used outside facebook projects.
That make sense mercurial is in python, building on top is easier than C that got is made from
I remember those days. I used mercurial and svn. And file locking in other solutions.
I’m so happy with git.
Man, I remember ancient gmod addons released using (iirc) turtle svn so they could auto update. Was a wild time.
Th devs at my current organization use turtle svn, but that seems to be more down to organizational politics combined with a misunderstanding that git is platform agnostic rather than anything based on merits
turtle svn
that’s a name I’ve not heard in a long, long time.
That’s a name I’ve never heard before. I have heard of Tortoise SVN though.
Meh, I knew what wizardbeard meant.
t’s really hard to imagine a world without Git
I’ve lived it.
- CriticalFile.vbs
- CriticalFile.V2.vbs
- CripicalFile.V2.5.vbs
- CriticalFile.DONOTEDIT.txt
- _Old.CriticalFile.aspx
- LinkToCriticalFilesFold.lnk
- GuideToDeploying.CriticalFliles.doc
- CritFil.bat
Lots of people still split latex documents into one section per file, because subversion used file locks and we only knew how one person could edit a file at a time.
The first job I had out of college was doing development on the production server with this method of version control. I still have nightmares.
Everybody would use Mercurial, since Fossil completely lost the race, and both Subversion and CVS are unfit for today’s needs.
What is too bad, because Fossil would be much more productive than Git or Mercurial if the software just finished running at all; and Mercurial is way easier to learn than Git.
It’s not like there was nothing at all in that space before git came along, e.g. we had svn before, and mercurial more or less in parallel.
And it all happened because botbicket decided to become greedy, to which Linus responded with taking a month break from Linux to make his own basic versioning tool, and here we are.
Without bitbuckets decisions, wer all still be stuck with SVn shudder
Not necessarily! Maybe we would live in a world of mercurial, or even some other alternative.
And it wasn’t bitbucket (botbicket?), but BitKeeper, which gave the Kernel folks a license to use BK, but with some restrictions. Among those was a “no reverse engineering” clause, which is what eventually lead to the revoking of that license—lots of interesting articles on this!—frustrating Linus for a few weeks, and finally the start of Git.
You’re completely right, I mixed up the name over the years. Either way, that action indeed led to git, which killed off bitkeeper
Minor correction, it was Bitkeeper/BitMover - not Bitbucket. They were proprietary software linux used w/ a community license, and they later removed that free tier.
Oh yeah, you’re right! It’s been a while.
Really easy to imagine that world to most people. Like me. Who inspite of using computers since my 386sx family pc, never got into software engineering.
I understand a little about it, but its just a name of a thing i dont know how to use lol
I just find it funny how its a kind of ignorance(for entirely understandable reasons)is bliss situation to me, but a horror to those who use it
Git has tons of contributors though.
