Posts tagged #open-source on Dynamo Geeks: 13 posts from the community, most useful first.
spent the evening debugging a "skerry bug" that was someone passing a non null terminated buffer and lying to the length argument. the parser worked perfectly. jävlar. the C standard is not a suggestion and neither is the function signature.
the issue says "doesnt work". no version, no OS, no reproducer, no error, no what you expected. CONTRIBUTING.md asks for all five and it is 40 lines long. I will answer the next issue that reads it before I answer the ten that did not. nej.
I complain a lot in this topic, so here is the counterweight, because it is just as true and I do not want anyone reading my rants to think contributing to open source is a trap. most of it is fine. some of it is the best part of my week. this is one of those. a student, I will not name them, opened their first ever pull request on skerry. it was small, a fix to a confusing error message, the kind of thing I had…
this is opinion, not reporting, and I am one of the people the EU Cyber Resilience Act is about, so take it with that bias in mind. the CRA's intent is good and overdue: products with digital parts sold in the EU should not be insecure by default, should get security updates, and someone should be accountable when they ship a backdoor in a car. after XZ and Log4Shell, "the manufacturer is responsible for the…
since HashiCorp moved Terraform and its other tools to the Business Source License in 2023, and Redis changed its license in 2024, I get asked roughly monthly whether skerry will "go commercial". short answer: no. long answer, because the question deserves a real one and the topic is full of hot takes with no cost attached. what these companies actually did HashiCorp (2023) moved from the Mozilla Public License to…
Log4Shell (CVE-2021-44228, December 2021) is old news, but I keep seeing the same mistakes it should have cured, so here is the short version and what it was actually about. what happened Log4j is a Java logging library that is inside an enormous amount of the world's software. it had a feature where a logged string could trigger a lookup, and an attacker who could get a crafted string logged (a username, a user…
skerry is a small C library that parses JSON. it is maybe four thousand lines. it is also, as far as I can tell from the download numbers and the angry emails, inside a lot of things you use: routers, a payment terminal, at least two cars, and the backend of companies whose quarterly profit is larger than the GDP of the town I live in. I have maintained it for fourteen years. I have two co-maintainers who help when…
a story from a few years back that still annoys me in a specific, instructive way. skerry is permissively licensed on purpose, you can do almost anything with it, including fork it. I knew that when I chose the license. so this is not a legal complaint. it is a story about the difference between what you are allowed to do and what you should do. a consultancy took skerry, forked it, renamed it something close enough…
since this topic is usually about maintainers behaving badly or companies being awful, here is the opposite, because it deserves saying out loud. last year I was fuzzing C JSON parsers for fun (yes, that is my idea of fun) and I found a heap buffer overflow in skerry, the little parser Karl maintains and that, as his bio says, half your companies vendor and never thank. a malformed deeply nested input could write…
everyone remembers the XZ backdoor (CVE-2024-3094, March 2024) as "the thing that almost backdoored SSH on every Linux box". that part is true and it was caught by luck, a Microsoft engineer noticing a half second of latency. but if you only remember the clever technical part you learned the wrong lesson. here is the short technical shape of it, and this Seytonic video does the timeline well if you want the full…
a few months ago someone opened an issue on skerry that I have thought about a lot since, because it is the purest example I have of the thing that is wrong. I have anonymised it, the company does not matter, the pattern is everywhere. Title: [URGENT] Memory issue in production, need fix within 24h Body: We are using skerry in our product (shipping to customers). We have found a memory issue under high load. This is…
Bonjour. I am making a weird fishing game in Godot since almost 2 years. Before, I was 8 years in a big AAA studio in Montréal, and my personal projects were all in Unity. People ask me often why I switched, so voilà, the long answer. The short history, for the people who were not there 12 September 2023 : Unity announces the Runtime Fee. A fee per install, starting 1 January 2024, once your game passes a revenue…
