Stepping Down as Libxml2 Maintainer
78 points
by zdw
8 hours ago
| 6 comments
| discourse.gnome.org
| HN
knowitnone2
4 hours ago
[-]
"he would love to mentor new maintainers for libxml2, ""but there simply aren't any candidates""

I know some folks from China, Russia, and North Korea who would love to become maintainers. No pay needed. I recommend Jia Tan - he has vast experience maintaining opensource software.

reply
ivolimmen
3 hours ago
[-]
Maybe my human interaction interfacing software has a glitch but I am having a hard time parsing this content. Do I detect a hint of sarcasm? Please add a '/s' at the end of your future posts to aid my very archaic and vintage brain matter.
reply
yupyupyups
2 hours ago
[-]
Jia Tan was the alias of the hacker(s) who infiltrated xz to plant a backdoor. He/They were in the project for 2 years I believe, and so had "significant experience" "maintaining" open source software.
reply
ivolimmen
4 minutes ago
[-]
Thanks for the info; I read the news but did not remember the name of the person.
reply
tsimionescu
2 hours ago
[-]
"Jia Tan" was the name of the person (or group) who became a maintainer of libxz and sneaked in a vulnerability targeting OpenSSH.
reply
mid-kid
1 hour ago
[-]
*liblzma
reply
rjh29
1 hour ago
[-]
Maybe _my_ software has a glitch but was your comment also sarcastic? Be sure to add an /s next time...
reply
ivolimmen
5 minutes ago
[-]
No I had a hard time understanding as I was not aware of the person in question, no sarcasm.
reply
bombcar
11 minutes ago
[-]
All Internet comments are to be assumed sarcastic until proven otherwise. Bombcar’s law.
reply
traversaro
3 hours ago
[-]
reply
codethief
4 minutes ago
[-]
This should be higher up and seems very relevant to understanding what's going on. Looks like the (former) maintainer does not actually want to abandon libxml2.
reply
AndyKelley
2 hours ago
[-]
If you think you need libxml2, think again. XML is a complex beast. Do you really need all those features? Maybe a much smaller, more easily maintained library would suit your needs while performing better at the same time!

For instance, consuming XML and creating it are two very different use cases. Zooming into consuming it, perhaps your input data has more guarantees than libxml2 assumes, such as the nonexistence of meta definition tags.

reply
mort96
2 hours ago
[-]
I kinda want something which just treats XML as a dumb tree definition language... give me elements with attributes as string key/value pairs, and children as an array of elements. And have a serialiser in there as well, it shouldn't hurt.

Basically something behaves like your typical JSON parser and serialiser but for XML.

To my knowledge, this is what TinyXML2 does, and I've used TinyXML2 for this before to great effect.

reply
cHaOs667
1 hour ago
[-]
That's what you call a DOM Parser - the problem with them is, as they serialize all the elements into objects, bigger XML files tend to eat up all of your RAM. And this is where SAX2 parsers come into play where you define tree based callbacks to process the data.
reply
mort96
1 hour ago
[-]
The solution is simple: don't have XML files that are many gigabytes in size.
reply
cHaOs667
1 hour ago
[-]
Depending on the XML structure and the servers RAM - it can already happen while you approach 80-100 MB file sizes. And to be fair, in the Enterprise context, you are quite often not in a position to decide how big the export of another system is. But yes, back in 2010 we built preprocessing systems that checked XMLs and split them up in smaller chunks if they exceeded a certain size.
reply
iberator
54 minutes ago
[-]
A lot of teleco stuff dumps multi-gb stuff of xml hourly. Per BTS. Processing few TB of XML files on one server daily

It's doable, just use the right tools and hacks :)

Processing schema-less or broken schema stuff is always hilarious.

Good times.

reply
stuaxo
1 hour ago
[-]
Some formats are this and they are historical formats.
reply
lyu07282
1 hour ago
[-]
Tell that to wikimedia, I've used libxml's SAX parser in the past to parse 80GB+ xml dumps.
reply
jeroenhd
2 hours ago
[-]
XML is used in countless standards. You can't just not use it if you interact with the outside world. Every XML feature is still in the many XML libraries because someone has a need for it, even things like external entities.

Maybe you don't need libxml2 specifically (good luck finding an alternative to parse XML in C and other such languages though), but "I don't like the complex side of XML so let's pretend it doesn't exist" doesn't solve the problem most people pick libxml2 for. It's the de-facto standard because it supports everything you could possibly need.

reply
dontlaugh
54 minutes ago
[-]
Exactly. For example if you need to integrate SAML, you have to support a significant subset of several XML specs. It may be possible to write a SAML-only library that supports less, but it's not clear it would be any simpler.
reply
lyu07282
1 hour ago
[-]
You shouldn't be down voted, its just the truth no matter how unfortunate.
reply
EvanAnderson
2 hours ago
[-]
Gratuitous use of XML does sometimes smell like a "now you have two problems" kind of affair.
reply
gnabgib
4 hours ago
[-]
Related Libxml2's "no security embargoes" policy (298 points, 84 days ago, 270 comments) https://news.ycombinator.com/item?id=44381093
reply
0xbadcafebee
3 hours ago
[-]
Thanks, this is really interesting.

I feel like it adds more weight to my feeling that we should have a software building code. When you have software that's critical infrastructure, with a nutso security policy like "no embargoes / 0day me bruh", we should have some regulations in place to require the software be maintained properly (that is to say, in a sane manner) or you can't use it commercially or for safety-critical things. Which would inevitably force commercial entities to pay for the maintenance so it could be done right.... which they should be doing already, the same way any company that builds safety-critical infrastructure has to pay to do it right.

If we want society to be safe, we have to make a law that enforces it. That's how that shit works.

(as an aside: holy shit, you're a prolific HN submitter, and all from different sources. where do you get it all?)

reply
Snild
3 hours ago
[-]
> we should have a software building code

This made my brain go "Oh no, not this again. Open source projects don't owe you..." etc etc.

> or you can't use it commercially or for safety-critical things

Oh. Yeah, okay, absolutely! For safety-critical, I would like to think the responsibility already lies with the integrator/seller, but making it explicitly so can't hurt.

reply
WJW
55 minutes ago
[-]
> or you can't use it commercially or for safety-critical things

The license for libxml2 (like the license for almost any kind of open source software) already states "THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT." I don't see how you can put the responsibility even more on the integrator/seller than that. It literally states the devs don't even guarantee it works correctly.

reply
elcritch
2 hours ago
[-]
Safety critical fields like aviation already have strict requirements. Usually there's very few software dependencies used in those projects.

Expanding that to more fields would be interesting, but difficult and expensive across the board. Particularly any sort of requirements like that generally incur significant regulatory and certification overhead.

However, if it was done similar to PCISS as an industry forum it might work better. Especially if certain fields like anything connecting with the electric grid we're required to use certified software.

reply
pcdavid
2 hours ago
[-]
Isn't this what the european Cyber Resilience Act (CRA) is about? See https://orcwg.org/cra/ and the work of the Open Regulatory Compliance Working Group in general.
reply
rcxdude
51 minutes ago
[-]
More or less, though the CRA is pretty minimal: it has a few basic requirements and hobby/unpaid open source software is not covered. A company integrating open source software is essentially responsible for covering those requirements themselves.
reply
jeroenhd
45 minutes ago
[-]
The company being responsible for the open source components they integrate should solve the biggest dependency problems, though. From a security perspective, it doesn't really matter if a company fixes the bugs themselves or if they pay someone to fix it for them.
reply
tinco
2 hours ago
[-]
People building "safety critical" systems already pay for a "secure" ecosystem. It's called Microsoft. We don't need regulations to have Microsoft exist. Do you think some random med tech startup is going to pay to have libxml2 maintained? They'll see the regulation and go "oh ok, Windows licenses it is".

It's not the "safety critical" software that needs this fixed, it's all software in general. There's a million software systems that have important privacy sensitive data or safety relevant processes that fly under the "safety critical" radar.

reply
fergie
1 hour ago
[-]
Its a shame that xslt seems to be struggling so much at the moment. If xslt 3 support was fully implemented in libxml2 (and therefore xsltproc and browsers) then it would be by far the most sensible option for designing anything to do with getting text onto the web.

* XSLT is still the only native templating option for HTML pages that runs natively in the browser (but just now you are limited to XSLT v1.0 which as a number of drawbacks and limitations)

* XSLT/XML is still best at text markup. In particular interpolation. There is no simple way to represent marked up text in, say, JSON.

* Content federation (atom, rss) is still very dependent on XML.

Surely somebody somewhere has money to pay for a greybeard to fix XSLT for us? It seems far to fundamental to be left to wither on the vine.

reply
omcnoe
23 minutes ago
[-]
Rather than struggling/withering, it's actively being killed. Efforts are underway to completely remove XSLT support from browsers, due to the poor state of libxml2 and a lack of any new maintainer stepping up.
reply
darkamaul
2 hours ago
[-]
Nick Wellnhofer is stepping away from libxml2 after a decade of unpaid maintenance. He’s forking it under the AGPL, but that will probably scare off most corporate users.

Meanwhile libxml2 is still everywhere. Without someone with real backing, a core piece of infrastructure is about to go unmaintained.

Once again, the open-source funding problem is laid bare: the internet runs on the unpaid evenings of a few people until they burn out (add relevant reference from XKCD, obviously).

reply
jeroenhd
2 hours ago
[-]
With not enough time to develop an alternative and too many application ecosystems relying on this library, I think it's a matter of time before a large company forks the library to fix security issues with it now that they have no choice but to do the work themselves. At least until IBM and Google figure out a way to move away from this library.
reply
ChrisArchitect
2 hours ago
[-]
reply