I’ve heard people mention curl and imagemagick. Any others that you know about?

    • axtualdave@lemmy.world
      link
      fedilink
      English
      arrow-up
      33
      ·
      2 years ago

      The neat thing about the log4j thing was even a cursory explanation of the vulnerability made anyone with a passing familiarity with security say, “Why the fuck would that even be a feature?!”

      • boonhet@lemm.ee
        link
        fedilink
        English
        arrow-up
        22
        ·
        2 years ago

        As a non-java company developer at the time, I think our biggest challenge was explaining to everyone that Log4j didn’t affect us. It took a non-zero amount of effort because a lot of customers panicked. To be fair, it was also an industry where confidentiality is important.

        • JackbyDev
          link
          fedilink
          English
          arrow-up
          7
          ·
          2 years ago

          Also a lot of people were pulling it transitively.

      • BinaryEnthusiast@beehaw.org
        link
        fedilink
        English
        arrow-up
        6
        ·
        2 years ago

        Oh man. I missed it by like a month. I graduated with my bachelors in December, and started in January. I was hearing horror stories from my new coworkers about how people had to cancel vacations to get stuff patched asap

      • argv_minus_one@beehaw.org
        link
        fedilink
        English
        arrow-up
        5
        ·
        2 years ago

        It was if none of your code used log4j. I remember being very grateful that I had chosen java.util.logging and Logback for my Java logging needs.

        • OneDimensionPrinter@lemm.ee
          link
          fedilink
          English
          arrow-up
          3
          ·
          2 years ago

          Lol, yeah for us we didn’t own any of the code that used it but depended on server software made internally that did. At the time we managed our own hosts, so it was a long week of deployments.

    • elrac@kbin.social
      link
      fedilink
      arrow-up
      6
      ·
      2 years ago

      That one was so annoying because you had to be using the log server to have any issues. If your network was locked down, the log server was disabled, or if you happened to be using a version that was from before the log server was added, then there were no issues. But clients just heard “log4j” and thought it was unsafe.

    • Haus@kbin.social
      link
      fedilink
      arrow-up
      1
      ·
      2 years ago

      Couldn’t remember which logging library it was, thanks for mentioning it, it would have low-key bugged me all day.

  • Eric_the_Cerise@fedia.io
    link
    fedilink
    arrow-up
    75
    ·
    edit-2
    2 years ago

    Werner Koch, the guy who created, and who has maintained for 25 years now, pretty much all by himself, GnuPG, the modern email encryption replacement for PGP.

    Just the other day, I realized I actually live just a few kms away from the guy, here in Germany … very tempted to reach out to him someday and actually buy him an actual coffee.

    • spartanatreyu
      link
      fedilink
      arrow-up
      2
      ·
      2 years ago

      That was the one I couldn’t remember, I got GPG and PGP confused but I remember it involved email encryption.

      This guy was the reason that every security dev had those personal public keys clearly posted next to their email address on every announcement and blog post they ever released.

  • Black616Angel@feddit.de
    link
    fedilink
    English
    arrow-up
    65
    arrow-down
    1
    ·
    2 years ago

    Sci-Hub anyone?

    Alexandra Elbakyan manages this truly awesome source of scientific papers completely on her own. She got sued twice and lost, had to change the URL multiple times due to takedowns and only gets along by donations.

    • SkyeStarfall@lemmy.blahaj.zone
      link
      fedilink
      English
      arrow-up
      19
      ·
      2 years ago

      It is a crime to humanity to lock knowledge behind a huge paywall. She does God’s work.

      And it’s not like the actual scientists/academics support knowledge being locked away either, or profit from it.

      • a_statistician
        link
        fedilink
        English
        arrow-up
        5
        ·
        2 years ago

        shit, scihub is easier to use than the library, so we’re all grateful to her too.

    • Gork@lemmy.ml
      link
      fedilink
      English
      arrow-up
      10
      ·
      2 years ago

      She’s the best thing that’s happened to the s scientific publishing field. I’m no longer a student but I still enjoy reading scientific papers and I’ll be damned if I have to pay $20 per article (which doesn’t go to the authors) since I no longer have access to a library that maintains relationships with these big publishers.

  • OneDimensionPrinter@lemm.ee
    link
    fedilink
    English
    arrow-up
    56
    arrow-down
    2
    ·
    edit-2
    2 years ago

    Left pad https://arstechnica.com/information-technology/2016/03/rage-quit-coder-unpublished-17-lines-of-javascript-and-broke-the-internet/

    Had GPT summarize what happened.

    The “left pad” incident refers to a controversy that arose in 2016 when a developer named Azer Koçulu removed his JavaScript package called “left-pad” from the NPM (Node Package Manager) registry. This caused a ripple effect, breaking numerous projects that relied on this package and highlighting the potential risks of relying on external dependencies. The incident sparked a debate about the stability and trustworthiness of the open-source ecosystem and led to discussions about best practices for managing dependencies in software development.

    • Torty@beehaw.org
      link
      fedilink
      English
      arrow-up
      17
      ·
      2 years ago

      This is the one I came to post about. The fact there’s a library for this is so stupid to me.

      I feel like it demonstrates how npm and modules have probably to some degree gotten out of hand.

    • AnonymousLlama@kbin.social
      link
      fedilink
      arrow-up
      6
      ·
      2 years ago

      From memory the NPM blokes had to have a think about how they handle important packages because of that. Didn’t they revert the changes to left pad to ensure everything else didn’t break?

      Fascinating to see the house of cards some of these solutions / libraries are built off

      • JackbyDev
        link
        fedilink
        arrow-up
        7
        ·
        2 years ago

        Yes. They added it back. The policy now is that you can’t remove packages that are depended on (or something to that extent, I don’t know the specifics).

  • spartanatreyu
    link
    fedilink
    English
    arrow-up
    50
    ·
    2 years ago

    cURL was one of these for a while (according to my limited understanding)

    It was made in the 90s and it didn’t get commercial support until a few years ago.

  • fubo@lemmy.world
    link
    fedilink
    English
    arrow-up
    46
    ·
    2 years ago

    Public NTP time servers have occasionally been that piece of infrastructure.

    NTP is used for synchronizing computer clocks, ultimately using highly-accurate time sources such as atomic clocks. The most authoritative public time servers tend to be run by research universities, national labs, and so on.

    Multiple home router vendors have sold devices configured to poll university NTP servers vastly excessively; effectively running a denial-of-service attack against public infrastructure. In a few cases, public time servers have closed down because of abuse by misconfigured consumer devices.

    https://en.wikipedia.org/wiki/NTP_server_misuse_and_abuse

  • jonne@infosec.pub
    link
    fedilink
    English
    arrow-up
    40
    ·
    2 years ago

    TzData is basically maintained by 2 guys. Pretty much every computer, phone and language relies on this database for timezone information.

  • muttley@kbin.social
    link
    fedilink
    arrow-up
    35
    arrow-down
    1
    ·
    2 years ago

    The core-js library is used by 1000s of top websites and is maintained by one guy
    https://github.com/zloirock/core-js

      • Highsight@kbin.social
        link
        fedilink
        arrow-up
        17
        ·
        2 years ago

        It’s honestly a fascinating read. We count so much on these kinds of people to keep our way of life intact, but when they ask for a little help in their own life, they get spat on.

        • gk99@kbin.social
          link
          fedilink
          arrow-up
          9
          ·
          2 years ago

          It’s really, really sad that this sort of stuff doesn’t get picked up and funded for the greater good. Stuff like the NLnet Foundation exists, which has helped fund some pretty major projects (including the development of Lemmy), but something this critical I feel should be consistently funded by even larger entities in order to keep things working right.

      • Baldur Nil
        link
        fedilink
        arrow-up
        3
        ·
        2 years ago

        This story got me sad. But also, the guy should know better as not to dedicate all of his time on that. This article talk a bit about this issue.

  • sasquash471@feddit.de
    link
    fedilink
    English
    arrow-up
    29
    arrow-down
    1
    ·
    edit-2
    2 years ago

    Not a package but FileZilla is developed by Tim Kosse for over 20 years. I know that there are a lot of other FTP-Clients but FileZilla is my favorite. Easy to use and very very stable. There is a pro version sure, but most of the time the regular one does the job. My company throws thousands of dollars a month at Adobe, Microsoft and others. But they would never even think about giving anything to Tim Kosse and others, even though I’ve probably saved days of work with tools like this.

    • ilovededyoupiggy@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      8
      ·
      2 years ago

      My company’s anti-malware started triggering on filezilla’s installer a few years ago because they started packaging apparently sketchy ads in it. Dunno if that’s still the case or not. I ended up switching to WinSCP instead. (Which I believe is actually another example of just one or two guys running that show too.)

  • pwshguy (mdowst)
    link
    fedilink
    English
    arrow-up
    26
    ·
    2 years ago

    Basically every Windows sysadmin is indebted to Mark Russinovich and SysInternals. Fortunetly, PowerToys has come a long way because I’m pretty sure sysinternals haven’t been updated since Windows XP.

    • GrishAix@feddit.de
      link
      fedilink
      English
      arrow-up
      16
      ·
      2 years ago

      Mark Russinovich now works for Microsoft and they own Sysinternals. Also the tools get updated quite regularly.

      • RustySharp
        link
        fedilink
        English
        arrow-up
        16
        ·
        2 years ago

        “Mark works for MS” is a massive understatement. He’s CTO of Azure now.

        And speaking of Sysinternals, arguably the most exciting update was when ProcessExplorer got a dark mode late last year :)

        • BaadC0de
          link
          fedilink
          English
          arrow-up
          7
          ·
          1 year ago

          Wait? ProcessExplorer has dark mode???!

  • PAPPP@lemmy.sdf.org
    link
    fedilink
    English
    arrow-up
    25
    ·
    2 years ago

    In the same kind of vein as imagemagick, Dave Coffin’s dcraw tool at least partly underlies almost every non-proprietary RAW image decoder, and some of the commercial ones (if they don’t use code, they use constant matrices and such).

    He’s not a sole maintainer to any of his major projects anymore, but honorable mention to Fabrice Bellard who initiated both ffmpeg and qemu among other notable activities.

    IIRC the Expat XML parser that’s embedded everywhere was basically on spare-time maintenance by Clark Cooper and Fred Drake for a couple decades, but I think they have a little more resources now.

    SQLite is a BDFL situation more than single-maintainer, but D. Richard Hipp still has his hands on everything, and there are only a relatively small number of folks with commit access.