The most useful posts in this topic, by likes from the community.
skerry is a small C library that parses JSON. it is maybe four thousand lines. it is also, as far as I can tell from the download numbers and the angry emails, inside a lot of things you use: routers, a payment terminal, at least two cars, and the backend of companies whose quarterly profit is larger than the GDP of the town I live in. I have maintained it for fourteen years. I have two co-maintainers who help when…
since HashiCorp moved Terraform and its other tools to the Business Source License in 2023, and Redis changed its license in 2024, I get asked roughly monthly whether skerry will "go commercial". short answer: no. long answer, because the question deserves a real one and the topic is full of hot takes with no cost attached. what these companies actually did HashiCorp (2023) moved from the Mozilla Public License to…
a story from a few years back that still annoys me in a specific, instructive way. skerry is permissively licensed on purpose, you can do almost anything with it, including fork it. I knew that when I chose the license. so this is not a legal complaint. it is a story about the difference between what you are allowed to do and what you should do. a consultancy took skerry, forked it, renamed it something close enough…
this is opinion, not reporting, and I am one of the people the EU Cyber Resilience Act is about, so take it with that bias in mind. the CRA's intent is good and overdue: products with digital parts sold in the EU should not be insecure by default, should get security updates, and someone should be accountable when they ship a backdoor in a car. after XZ and Log4Shell, "the manufacturer is responsible for the…
since this topic is usually about maintainers behaving badly or companies being awful, here is the opposite, because it deserves saying out loud. last year I was fuzzing C JSON parsers for fun (yes, that is my idea of fun) and I found a heap buffer overflow in skerry, the little parser Karl maintains and that, as his bio says, half your companies vendor and never thank. a malformed deeply nested input could write…
a few months ago someone opened an issue on skerry that I have thought about a lot since, because it is the purest example I have of the thing that is wrong. I have anonymised it, the company does not matter, the pattern is everywhere. Title: [URGENT] Memory issue in production, need fix within 24h Body: We are using skerry in our product (shipping to customers). We have found a memory issue under high load. This is…
I complain a lot in this topic, so here is the counterweight, because it is just as true and I do not want anyone reading my rants to think contributing to open source is a trap. most of it is fine. some of it is the best part of my week. this is one of those. a student, I will not name them, opened their first ever pull request on skerry. it was small, a fix to a confusing error message, the kind of thing I had…
the issue says "doesnt work". no version, no OS, no reproducer, no error, no what you expected. CONTRIBUTING.md asks for all five and it is 40 lines long. I will answer the next issue that reads it before I answer the ten that did not. nej.
