×
Businesses

Why Netflix's Stock Dropped 41% in Two Months (cnn.com) 156

"Netflix's stock has tumbled 41% from the all-time high it hit just two months ago," reports CNN Business.

"It's gaining subscribers at a painfully slow pace. Competition is heating up. The company's answer to all that: It just raised prices on North American customers." Netflix ended 2021 with 221.8 million subscribers. That's significantly more than others in the streaming marketplace, including Disney, one of its closest competitors. Disney had 118.1 million subscribers as of October, and it grew subscriptions 60% between October 2020 and October 2021. During that same period, Netflix grew just 9%. Disney hasn't yet reported its financial results for the last three months of 2021. But Netflix's growth slowed even further in the fourth quarter to just 8%. (And Disney's growth last quarter spooked Wall Street too....)

The problem with relying exclusively on subscriptions for revenue is: after a while, you run out of people who haven't subscribed. That's bad news for Wall Street investors who are mostly concerned with companies' abilities to grow. Zak Shaikh, vice president of programming at research-based media firm Magid, believes that Netflix's fall is more of "a Wall Street thing" rather than "something that reflects the business is in trouble.... They still added subs, and they still have the same high usage and viewing metrics," he added. However, even Shaikh pointed out that in the long term, "Netflix will have to deal with the fact that you can't keep adding subscribers."

One way the company has tried to offset its slowing growth is by investing in other verticals, such as gaming. Another way is to raise prices, but that could prove difficult as fierce competition ramps up. Although price increases will probably help to offset its sluggish sign ups, they could also lead to more stagnation for Netflix. For some consumers, price increases — even small ones — are a lot to ask considering that so many competitors are at Netflix's gates.

Michael Nathanson, a media analyst at MoffettNathanson, specifically predicted to CNN Business that 2022 will be a year "of concern about growth and competition for Netflix."
Bitcoin

Starving Afghans Use Crypto To Sidestep US Sanctions, Failing Banks, and the Taliban (theintercept.com) 104

NGOs looking to provide emergency aid to Afghanistan are turning to cryptocurrency. From a report: When the Taliban took over Afghanistan in August of last year, Fereshteh Forough feared that the group would close her school in Herat, the country's third-largest city. Code to Inspire, an NGO Forough founded, was teaching computer programming to young Afghan women, and the Taliban oppose secondary education for women. Months later, the picture is much different -- and worse -- from what Forough imagined. The school survived, becoming mostly virtual, but has transformed from a coding boot camp into a relief organization. The biggest risk for Forough's students wasn't lack of education, it was hunger. Forough looked for a way to provide emergency checks to the women but was stymied by banks that don't want to risk violating severe U.S. sanctions.

JPMorgan Chase repeatedly blocked her attempts to transfer money, she said, and she grew increasingly alarmed by students who said they couldn't access cash at local Afghan banks -- many of which have closed or imposed strict withdrawal limits. In response, she turned to cryptocurrency to provide monthly emergency payments to help students afford enough food to survive. [...] There are several advantages to using crypto: Afghans fleeing the Taliban can take their assets with them without risk. Humanitarian agencies seeking to bypass banks and discreetly avoid the Taliban can provide cash directly to those in need. Smugglers and intermediaries who may steal or try to resell aid packages can be circumvented if aid is given directly through a digital transaction.

Youtube

YouTube Will Stop Making Most Original Shows (theverge.com) 43

YouTube will scale back a significant portion of YouTube Originals, which produced original content including scripted series, educational videos, and music and celebrity programming. Chief business officer for YouTube Robert Kyncl announced the changes today in a statement on Twitter. From a report: Going forward, the company will only fund originals in the YouTube Kids Fund and the Black Voices Fund, a program created in 2020 that committed $100 million to "amplify" Black creators on the platform. "With rapid growth comes new opportunities and now our investments can make a greater impact on even more creators when applied towards other initiatives, like our Creator Shorts Fund, Black Voices Fund, and Live Shopping programming to name a few," the statement reads. YouTube Originals has changed approaches throughout the years.
Security

Linux Malware Sees 35% Growth During 2021 (bleepingcomputer.com) 71

The number of malware infections targeting Linux devices rose by 35% in 2021, most commonly to recruit IoT devices for DDoS (distributed denial of service) attacks. BleepingComputer reports: A Crowdstrike report looking into the attack data from 2021 summarizes the following:

- In 2021, there was a 35% rise in malware targeting Linux systems compared to 2020.
- XorDDoS, Mirai, and Mozi were the most prevalent families, accounting for 22% of all Linux-targeting malware attacks observed in 2021.
- Mozi, in particular, had explosive growth in its activity, with ten times more samples circulating in the wild the year that passed compared to the previous one.
- XorDDoS also had a notable year-over-year increase of 123%.
[...]
The Crowstrike findings aren't surprising as they confirm an ongoing trend that emerged in previous years. For example, an Intezer report analyzing 2020 stats found that Linux malware families increased by 40% in 2020 compared to the previous year. In the first six months of 2020, a steep rise of 500% in Golang malware was recorded, showing that malware authors were looking for ways to make their code run on multiple platforms. This programming, and by extension, targeting trend, has already been confirmed in early 2022 cases and is likely to continue unabated.

Programming

GitHub Restores Account of Developer Who Intentionally Corrupted His Libraries (thenewstack.io) 193

What happened after a developer intentionally corrupted two of their libraries which collectively had more than 20 million weekly downloads and thousands of dependent projects?

Mike Melanson's "This Week in Programming" column reports: In response to the corrupted libraries, Microsoft quickly suspended his GitHub access and reverted the projects on npm.... While this might seem like an open and shut case to some — the developer committed malicious code and GitHub and npm did what it had to do to protect its users — a debate broke out around a developer's rights to do what they wish with their code, no matter how many projects and dependencies it may have.

"GitHub suspending someone's account for modifying their own code in a project they own however they want spooks me a lot more than NPM reverting a package," [tweeted one company's Director of Engineering & Technology]. "I kind of love what Marak did to make a point and protest to be honest."

An article on iProgrammer further outlines the dilemma present in what might otherwise seem like a clear-cut case.... "Yes, it is open source in that you can fork it and can contribute to it but does this mean that GitHub is justified in denying you the right to change or even destroy your own code?"

As of last night, however, it would appear that the entire affair is merely one for intellectual debate, as GitHub has indeed lived up to what some might view as its end of the bargain: the developer's account is active, he has been allowed to remove his faker.js library on GitHub (depended upon as it might be), and has since offered an update that he does "not have Donkey Brains".

Television

Netflix Raises Monthly Subscription Prices in US, Canada (reuters.com) 36

Netflix has raised its monthly subscription price by $1 to $2 per month in the United States depending on the plan, the company said on Friday, to help pay for new programming to compete in the crowded streaming TV market. From a report: The standard plan, which allows for two simultaneous streams, now costs $15.49 per month, up from $13.99, in the United States. Prices also went up in Canada, where the standard plan climbed to C$16.49 from C$14.99. The price increases, the first in those markets since October 2020, took effect immediately for new customers. Existing members will see the new prices in the coming weeks when they receive their monthly bills.
China

China To Create Own NFT Industry Based on State-backed Blockchain Infrastructure (scmp.com) 20

China's state-backed Blockchain Services Network (BSN) plans to roll out infrastructure at the end of this month to support the deployment of non-fungible tokens (NFTs), a major step to creating a Chinese NFT industry that is not linked to cryptocurrencies. From a report: Although Beijing has banned cryptocurrencies, He Yifan, chief executive of Red Date Technology, which provides technical support to BSN, told the South China Morning Post that NFTs "have no legal issue in China" as long as they distance themselves from cryptocurrencies like bitcoin. The infrastructure, named the BSN-Distributed Digital Certificate (BSN-DDC), to differentiate it from crypto-transacted NFTs, will offer application programming interfaces for businesses or individuals so they can build their own user portals or apps to manage NFTs. Only Chinese yuan is allowed for purchases and service fees. "NFTs in China will see annual output in the billions in the future," He said in an interview.
Programming

Ask Slashdot: Why Do Programmers Make So Many Mistakes? (codinghorror.com) 391

A technical question occurred to Slashdot reader OneHundredAndTen when filling out forms online. "Are the programmers responsible for them stupid, incompetent, lazy, or all rolled into one?"

They provided two real-world examples that inspired the question:

- "I made up a company name that happened to contain a digit. When I submitted the information I got a big fat error diagnostic about this box, to the effect that numerals are not allowed in a company name. So you know, people â" no digits allowed in your company's name, or else!"

- "In a free text box limited to 1,000 characters (already stupid, arguably) the caption explicitly banned the following characters in the "free text" because they can interfere with the correct processing of input..."

~!@#$%^&*()|'

This prompted a response from UnknownSoldier (Slashdot reader #67,820), who shared the humorous "Murphy's Computer Law" aphorisms from 1984, calling them "sadly still appropriate" and referring to one in particular: "There's never time to do it right, but always time to do it over." In general Web programmers tend to be extremely lazy (undisciplined.) They don't value correctness because that would take "work". I'm not just singling out web programmers here, look at how many programmers fuck up the TRIVIAL example of FizzBuzz.

For example, here are two examples where incompetent programmers make tons of assumptions.

* Falsehoods programmers believe about names
* Falsehoods programmers believe about time

As they say the devil is in the details, or edge case, as it may be. Programming is littered with edge cases so bad programmers "stick their head in the sand and ignore the problem hoping it will go away."

Doing it right costs time, money, and skill. Management is partially to blame. Bad programmers are to blame. Schools are to blame. There are many factors why we end up with shit software like the use case you just described.

And now you know why old programmers become grumpy. Modern software is slow, bloated, with layers of abstraction piled upon abstraction, library upon library. You spend more time "decoding" code and reverse engineering what was done because no one ever took the time to comment it properly for the next guy.

Use these examples of "stupid shit" to be a better programmer.

Agree? Disagree? Share your own thoughts in the comments.

Why do programmers make so many mistakes?
Space

Amazon Joins Lockheed Martin and Cisco to Send Alexa to Space, Offers NASA Tours for SchoolKids (geekwire.com) 25

"Alexa, when are we arriving at the moon?" quips GeekWire.

Long-time Slashdot reader theodp writes: This week brought news that Amazon is teaming up with Lockheed Martin and Cisco to put its Alexa voice assistant on NASA's Orion spacecraft for the (uncrewed) Artemis 1 round-the-moon mission....

On the heels of that announcement came news that Amazon Future Engineer (AFE) has partnered with Mobile CSP and the National Science Teaching Association (NSTA) on the Alexa for Astronauts program, which will provide students in grades 4-and-up with live WebEx by Cisco tours from NASA's Johnson Space Center. This program will also provide curriculum — NSTA's Using AI to Monitor Health and Mobile CSP's Alexa in Space — aimed at teaching high school Science and AP Computer Science Principles students "how to program their own Alexa skills that could help astronauts [and 'inexperienced space travelers, such as tourists'] solve problems in space and communities at home" using MIT's App Inventor.

App Inventor, some may recall, was developed at Google to bring programming to the masses only to be suddenly abandoned. App Inventor was later picked up by MIT and — with support from Google and millions in NSF funding — eventually found its way into curriculum developed for the new AP CSP course aimed at mainstreaming AP Computer Science.

Mozilla

Mozilla Actually Started Accepting Cryptocurrency Donations Back in 2014 (thenewstack.io) 39

Mike Melanson's "This Week in Programming" column looks at what happened after Mozilla founder Jamie "jwz" Zawinski slammed the group for accepting donations in cryptocurrency (which Zawinski called partnering "with planet-incinerating Ponzi grifters.") Peter Linss, one of the creators of the Gecko browser engine on which Mozilla Firefox is based, also stepped in to back up Zawinski, saying that he was 100% with him and that Mozilla was "meant to be better than this."

When Mozilla first announced it would accept Bitcoin donations in 2014, it cited Khan Academy, Electronic Frontier Foundation, United Way, Greenpeace, and Wikimedia Foundation among its moral and upstanding cryptocurrency-accepting compatriots. Of that list, just Greenpeace has since stopped accepting cryptocurrency donations, telling the Financial Times earlier this year that "as the amount of energy needed to run bitcoin became clearer, this policy [of accepting cryptocurrency donations] became no longer tenable."

Thursday the Mozilla Foundation announced it was pausing cryptocurrency donations to review whether the idea "fits with our climate goals" — a fact the column also addresses: Mike Shaver, another Mozilla project founder, also tweeted his support, writing that he was "glad to see this reflection happening."

In a follow-up blog post to the ordeal, Zawinski doubled down on his condemnation of Mozilla's cryptocurrency acceptance, writing that "cryptocurrencies are not only an apocalyptic ecological disaster, and a greater-fool pyramid scheme, but are also incredibly toxic to the open web, another ideal that Mozilla used to support" — an idea also espoused in many of the comments on the initial Twitter thread.

Meanwhile, although Mozilla says that it is pausing the ability to donate cryptocurrencies during its review, the donations page still lists BitPay among its payment methods.

Python

TIOBE Announces that the Programming Language of the Year Was Python (thenextweb.com) 90

The programming language of the year has been announced by the TIOBE Index: Python!

But noting that the TIOBE index is based on the number of search results for a programming language across popular search engines, a headline at The Next Web asks: "What does this title even mean?" [TIOBE] takes services such as Google, QQ, Sohu, Amazon, and Wikipedia to calculate the results. TIOBE uses "+" programming" query and a special formula to devise these ratings that change every month. You can read more about the whole process here. The programming language of the year title is decided by the jump in ratings year-on-year. Python overtook C# by a margin of 0.13% — almost a photo finish.

The index doesn't indicate the best or most efficient programming language, nor does it measure the amount of code written in a language across the internet. It simply gives us a high-level understanding of resources and pages available on the web related to them.

There's a huge amount of criticism towards the TIOBE index, especially as it uses one query and doesn't consider non-English languages. The organization said that it's trying to introduce more parameters to calculate the ratings.

TIOBE's annual award is being called "prestigious" — by the announcement at TIOBE.com: The award is given to the programming language that has gained the highest increase in ratings in one year. C# was on its way to get the title for the first time in history, but Python surpassed C# in the last month.

Python started at position #3 of the TIOBE index at the beginning of 2021 and left both Java and C behind to become the number one of the TIOBE index. But Python's popularity didn't stop there. It is currently more than 1 percent ahead of the rest [with a "rating" of 13.58%]. Java's all time record of 26.49% ratings in 2001 is still far away, but Python has it all to become the de facto standard programming language for many domains. There are no signs that Python's triumphal march will stop soon.

In fact, this makes the second year in a row Python has won TIOBE's annual award.

But it's as good a conversation-starter as any. ZDNet reminds us that Microsoft hired Python creator Guido van Rossum in 2020 to work on improving Python's efficiency, while the second most popular language on TIOBE's annual list, C#, "is a language designed by Microsoft technical fellow Anders Hejlsberg for the .NET Framework and Microsoft's developer editing tool Visual Studio."

And ZDNet also spottted a few other patterns in TIOBE's year-end look at programming language popularity: There were several movers and shakers this year. Rust, a systems programming language that deals with memory safety flaws, is now in 26th position, ahead of MIT's Julia, and Kotlin, a language endorsed by Google for Android app development. Rust was a stand out language in 2021, gaining backing from Facebook, Amazon Web Services, Microsoft Azure and Google Cloud.

Apple's Swift for iOS and macOS app development jumped from 13th to 10th place, while Google's Go inched up from 14 to 13, according to Tiobe. Kotlin moved from 40th to 29th. Google's Dart dropped from 25th to 37th position, Julia fell from 23rd to 28th position, while Microsoft TypeScript dropped from from 42 to 49.

The top 10 languages in Tiobe's list for January 2022 were Python, C, Java, C++,C#, Visual Basic, JavaScript, Assembly Language, SQL, and Swift.

Earth

Road Salt Works. But It's Also Bad for the Environment. (nytimes.com) 128

As snowstorms sweep the East Coast of the United States this week, transportation officials have deployed a go-to solution for keeping winter roads clear: salt. From a report: But while pouring tons of salt on roads makes winter driving safer, it also has damaging environmental and health consequences, according to a growing body of research. As snow and ice melt on roads, the salt washes into soil, lakes and streams, in some cases contaminating drinking water reservoirs and wells. It has killed or endangered wildlife in freshwater ecosystems, with high chloride levels toxic to fish, bugs and amphibians, according to the Environmental Protection Agency. "It's an issue that requires attention now," said Bill Hintz, an assistant professor in the environmental sciences department at the University of Toledo and the lead author of a recent research review published in the journal Frontiers in Ecology and the Environment.

"There's plenty of scientific evidence to suggest that freshwater ecosystems are being contaminated by salt from the use of things like road salt beyond the concentration which is safe for freshwater organisms and for human consumption," Dr. Hintz said. Salt has been used to de-ice roads in the United States since the 1930s, and its use across the country has tripled in the past 50 years, Dr. Hintz said. More than 20 million metric tons of salt are poured on U.S. roads each winter, according to an estimate by the Cary Institute of Ecosystem Studies in New York, and the environmental costs are growing. Still, little has been done to address the environmental impact of road salt because it is cheap and effective, said Victoria Kelly, the environmental programming manager at the Cary Institute. By lowering the freezing temperature of water, salt prevents snow from turning to ice and melts ice that is already there.

Transportation

Honda Clocks Are Stuck 20 Years In The Past And There Isn't A Fix (jalopnik.com) 117

Honda and Acura owners around the world are reporting that their clocks and calendars are getting stuck at a certain time in the year 2002. "The spread is impressive, impacting Honda and Acura models as old as 2004 and as new as 2012," reports Jalopnik. "There is no fix for the current issue. Honda says it's investigating and if it does not find a fix, the clocks should correct themselves sometime in August." From the report: As a number of Honda and Acura owners have noted on these forums, their clocks read correctly until what appeared to have been the first time update of 2022. Then, their navigation systems turned into time machines, leaving them behind as they went back to 2002. I asked Honda about the cause of the issue and received this back: "American Honda is aware of a potential concern related to the clock display on certain older Acura and Honda models equipped with navigation systems. We are currently investigating this issue to determine possible countermeasures and have no additional details to share at this time." Owners have also reached out and received different responses.

If you have experience coding or troubleshooting software, the possible cause of this time warp probably popped into your head early on. Drive Accord forum user Jacalar went into the navigation system's diagnostic menu on Sunday and discovered that the GPS date was set to May 19, 2002, or exactly 1024 weeks in the past. Global Positioning Systems measure time from an epoch, or a specific starting point used to calculate time. The date is broadcasted including a number representing the week, coded in 10 binary digits. These digits count from 0 to 1023 then roll over on week 1024. GPS weeks first started on January 6, 1980 before first zeroing out on midnight August 21, 1999. It happened again April 6, 2019. The next happens in 2038.

If software isn't coded to account for the rollover, weird stuff can happen, like a calendar going back exactly 1024 weeks. It's impossible to know for sure without being able to look at Honda's programming, but these navigation systems might be programmed so that the start of their week counter is a date 19.6 years in the past, but not in-line with GPS epoch. Owners should be able to turn off the automatic update function and set the date and time manually, but they're finding that the functionality doesn't work right now. Likewise, the clock resets back to the incorrect time every time the car is started.

Games

You Can Now Play Video Games Developed Behind the Iron Curtain (vice.com) 15

An anonymous reader quotes a report from Motherboard: The Cold War couldn't stop gaming from thriving in the Eastern Bloc. From the late 1980s through the early 1990s, a generation of young people living behind the Iron Curtain designed and released their own video games and arcade cabinets. Now, you can play English translations of some of these lost classics of early gaming. One is a text adventure where a Soviet military officer hunts and kills Rambo. The translated games all come from Slovakia and are a collaboration between the Slovak Game Developers Association and the Slovak Design Museum.

According to Stanislav Hrda, one of the programmers who created the games on offer, making video games was something only kids did. "The games were not sold in shops and the authors were not entitled to remuneration," he said in the post explaining the project. "Therefore, practically no one could engage in video game programming as a business activity, and adult programmers worked at most in state institutions on large mainframe computers. Thus, video game programmers became mainly teenagers." The computing power was limited and the teenagers' technological knowhow almost non-existent so many of these early games were text adventures. "These could also be programmed in the simpler Basic language that every home computer had built in," Hrda said. "Text-based games offered the opportunity to imprint one's fantasies into a world of characters, locations, descriptions of reality or fantasy at will. That is why hundreds of such video games were created in the 1980s in Czechoslovakia. The authors from the ranks of teenagers portrayed their friends, but also heroes from films that were distributed on VHS tapes or from the pop-cultural world of the West from the occasionally available comics, films, TV series and books."

Hrda loved American action movies and programmed the video game Satochin, a text adventure where a Soviet officer hunts John Rambo. "The game was very hard to win," Hrda told Ars Technica. "Whenever you made a small mistake, you would die. So before you win, you are killed ten times by Rambo." [...] The project has localized ten games for Western audiences, including Satochin, with plans to tackle more over the next few years. "The games translated over the next 2-3 years after the end of the project will represent almost the complete video game production from the period of 8-bit computers in Slovakia, with an emphasis on text adventure games," the site said. English versions are available here and can be played in the Fuse emulator. The Slovak versions can be played online through the project's website.

Technology

Ask Slashdot: New Year's Resolution For Tech Companies? 52

theodp writes: Slashdot has surveyed personal New Year's resolutions in the past. So this year, how about coming up with a list of New Year's resolutions you'd like to see tech companies keep in 2022?

As for me, I'd like to see the tech giants resolve to making their desktop software work in the Cloud (and not just for Business), include a programming language with their desktop and mobile OS, provide the capability to share 'meaningful' file names, and allow developers to cap their Cloud charges. Is that too much to ask for in 2022?
Open Source

Will It Take More Than Open Source Funding To Prevent the Next Log4j? (openssf.org) 110

"While the lack of funding in open source is certainly a problem, could funding have prevented the Log4j vulnerabilities?" asks Mike Melanson's "This Week in Programming" column. "Would funding actually prevent similar vulnerabilities in the future...?"

Or is that an oversimplification? In a blog post for the Linux Foundation's Open Source Security Foundation (OpenSSF), Brian Behlendorf argued that open source foundations must work together to prevent the next Log4Shell scramble, outlining seven points that OSS foundations could do to mitigate security risks. Among those seven points — which include security scanning, outside audits, dependency tracking, test frameworks, organization-wide security teams, and requiring projects to remove old, vulnerable code — not once was funding mentioned. Rather, Behlendorf precedes these points by saying that "Too many organizations have failed to apply raised funds or set process standards to improve their security practices, and have unwisely tilted in favor of quantity over quality of code."

Behlendorf continues after his list of seven suggested acts with a section that boils everything down perfectly:

"None of the above practices is about paying developers more, or channeling funds directly from users of software to developers. Don't get me wrong, open source developers and the people who support them should be paid more and appreciated more in general. However, it would be an insult to most maintainers to suggest that if you'd just slipped more money into their pockets they would have written more secure code. At the same time, it's fair to say a tragedy-of-the-commons hits when every downstream user assumes that these practices are in place, being done and paid for by someone else."

Behlendorf does go on to make some points about funds and fundraising, but his point is less on the lack of funding than the allocation of those funds and how they need to be focused on things like paid audits and "providing resources to move critical projects or segments of code to memory-safe languages, or fund bounties for more tests."

Behlendorf says that, in the new year, the OpenSSF will be working to "raise the floor" for security in open source.

"The only way we do this effectively is to develop tools, guidance, and standards that make adoption by the open source community encouraged and practical rather than burdensome or bureaucratic," he wrote. "We will be working with and making grants to other open source projects and foundations to help them improve their security game."

Behlendorf was a founding member of the Apache Group, which later became the Apache Software Foundation.

So as a long-time member of the Open Source community, he calls the Log4j vulnerabilities "a humbling reminder of just how far we still have to go."
Programming

Is Wolfram the Smartest Programming Language In the Room? (wolfram.com) 113

theodp writes: Out of the box, does your programming language support Chemical Formulas & Chemical Reactions? Making Videos from Images & Videos? Integrals? Real Numbers? Graph Trees? Leap Seconds? Bio Sequences? Flight Data? Vector Displacement Plots? Lighting? Machine Learning? Tracking Robots? Notebooks? Creating, Deploying and Grading Quizzes? Analysis of Email Threads? Access to 2,249 User-Defined Functions? NFTs?

These are just some of the feature upgrades Stephen Wolfram touched upon as announced the launch of Version 13 of Wolfram Language and Mathematica in a Dec. 13th blog post (for more, see What's New in Mathematica 13). Sign up for free access to Wolfram Cloud Basic here, kids! So, is Wolfram the "smartest programming language in the room"?

Open Source

Who's Paying to Fix Open Source Software? (dev.to) 142

The Log4Shell exploit "exposes how a vulnerability in a seemingly simple bit of infrastructure code can threaten the security of banks, tech companies, governments, and pretty much any other kind of organization," writes VentureBeat. But the incident also raises some questions: Should large deep-pocketed companies besides Google, which always seems to be heavily involved in such matters, be doing more to support the cause with people and resources?
Long-time Slashdot reader frank_adrian314159 shares a related article from a programming author on Dev.To, who'd read hot takes like "Open source needs to grow the hell up." and "Open source' is broken". [T]he log4j developers had this massive security issue dumped in their laps, with the expectation that they were supposed to fix it. How did that happen? How did a group of smart, hard-working people get roped into a thankless, high-pressure situation with absolutely no upside for themselves...?

It is this communal mythology I want to talk about, this great open source brainwashing that makes maintainers feel like they need to go above and beyond publishing source code under an open source license — that they need to manage and grow a community, accept contributions, fix issues, follow vulnerability disclosure best practices, and many other things...

In reality what is happening, is that open source maintainers are effectively unpaid outsourcing teams for giant corporations.

The log4j exploit was first reported by an engineer at Alibaba — a corporation with a market capitalization of $348 billion — so the article wonders what would happen if log4j's team had sent back a bill for the time they'd spend fixing the bug.

Some additional opinions (via the "This Week in Programming" column):
  • PuTTY maintainer Andrew Ducker: "The internet (and many large companies) are dependent on software maintained by people in their spare time, for free. This may not be sustainable."
  • Filippo Valsorda, a Go team member at Google: "The role of Open Source maintainer has failed to mature from a hobby into a proper profession... The status quo is unsustainable.... GitHub Sponsors and Patreon are a nice way to show gratitude, but they are an extremely unserious compensation structure."

Valsorda hopes to eventually see "a whole career path with an onramp for junior maintainers, including training, like a real profession."


Programming

Apple Releases Swift Playgrounds 4 (techcrunch.com) 8

Apple announced that it has officially released Swift Playgrounds 4. The tech giant first announced the upcoming launch of the new software at WWDC earlier this year. From a report: With this latest launch, the software now lets users build iPhone and iPad apps with SwiftUI directly on their iPad. It also allows you to preview apps in real time as you make changes to your app. Apple notes that developers are now able to upload their finished app to the App Store with its "App Store Connect" integration. "Swift Playgrounds is the best and easiest way to learn how to code," Apple said in a blog post. "Code is immediately reflected in the live preview as you build apps, and you can run your apps full screen to test them out. A new open project format based on Swift packages can be opened and edited in Swift Playgrounds for iPad, as well as within Xcode on Mac, offering you even more versatility to develop apps across iPad and Mac."
Programming

At EA, It Can Take a Whole Day To Change 3 Lines of Code (neowin.net) 145

New submitter segaboy81 writes: In 2001 the Manifesto for Agile Software Development was born, and it took the software engineering world by storm. Linux, Windows, Facebook, AAA games, and just about everything else, adheres to this manifesto in some form or another. It is a paradigm that allows teams to work collaboratively on projects in the most effective and streamlined way possible. However, EA may not have gotten the memo. According to a blogpost by former EA developer Adam Berg, different teams take very different approaches to development with one team in particular being especially slow to progress. Adam recounts his experience on the FIFA team where he worked on the Wii, PS Vita, and Nintendo 3DS ports of the game: "I often worked in the realm of competition logic. Testing changes here could mean progressing through several seasons of career mode in order to test out a change. No joke, it would take an entire day to change 3 lines of code and know that it actually worked correctly."

Slashdot Top Deals