Programming

Log4j was a fun one to watch unfold everywhere when things went haywire

cURL was one of these for a while (according to my limited understanding)

It was made in the 90s and it didn't get commercial support until a few years ago.

Werner Koch, the guy who created, and who has maintained for 25 years now, pretty much all by himself, GnuPG, the modern email encryption replacement for PGP.

Just the other day, I realized I actually live just a few kms away from the guy, here in Germany ... very tempted to reach out to him someday and actually buy him an actual coffee.

Sci-Hub anyone?

Alexandra Elbakyan manages this truly awesome source of scientific papers completely on her own. She got sued twice and lost, had to change the URL multiple times due to takedowns and only gets along by donations.

Left pad https://arstechnica.com/information-technology/2016/03/rage-quit-coder-unpublished-17-lines-of-javascript-and-broke-the-internet/

Had GPT summarize what happened.

The "left pad" incident refers to a controversy that arose in 2016 when a developer named Azer Koçulu removed his JavaScript package called "left-pad" from the NPM (Node Package Manager) registry. This caused a ripple effect, breaking numerous projects that relied on this package and highlighting the potential risks of relying on external dependencies. The incident sparked a debate about the stability and trustworthiness of the open-source ecosystem and led to discussions about best practices for managing dependencies in software development.

Public NTP time servers have occasionally been that piece of infrastructure.

NTP is used for synchronizing computer clocks, ultimately using highly-accurate time sources such as atomic clocks. The most authoritative public time servers tend to be run by research universities, national labs, and so on.

Multiple home router vendors have sold devices configured to poll university NTP servers vastly excessively; effectively running a denial-of-service attack against public infrastructure. In a few cases, public time servers have closed down because of abuse by misconfigured consumer devices.

https://en.wikipedia.org/wiki/NTP_server_misuse_and_abuse

The core-js library is used by 1000s of top websites and is maintained by one guy
https://github.com/zloirock/core-js

TzData is basically maintained by 2 guys. Pretty much every computer, phone and language relies on this database for timezone information.

A developer maintained a NodeJS package called left-pad that would add leading whitespace to strings. He unpublished the package and broke basically the entire Node ecosystem until the repo owner forcibly republished it against the author's wishes.

https://www.theregister.com/2016/03/23/npm_left_pad_chaos/

Node frameworks are famous for this purely because of a lack of standard library. I feel like most languages have a standard library that balance being generic but still providing utilities of common used stuff. So a company that doesn’t want to rely on a random guy’s library can build their own with only the features they want. But with Node, any complicated feature is using a tree of hundreds of random packages that you have no idea who created them.

Who maintains ffmpeg?

Basically every Windows sysadmin is indebted to Mark Russinovich and SysInternals. Fortunetly, PowerToys has come a long way because I'm pretty sure sysinternals haven't been updated since Windows XP.

Not a package but FilleZilla is developed by Tim Kosse for over 20 years. I know that there are a lot of other FTP-Clients but FilleZilla is my favorite. Easy to use and very very stable. There is a pro version sure, but most of the time the regular one does the job. My company throws thousands of dollars a month at Adobe, Microsoft and others. But they would never even think about giving anything to Tim Kosse and others, even though I've probably saved days of work with tools like this.

In the same kind of vein as imagemagick, Dave Coffin's dcraw tool at least partly underlies almost every non-proprietary RAW image decoder, and some of the commercial ones (if they don't use code, they use constant matrices and such).

He's not a sole maintainer to any of his major projects anymore, but honorable mention to Fabrice Bellard who initiated both ffmpeg and qemu among other notable activities.

IIRC the Expat XML parser that's embedded everywhere was basically on spare-time maintenance by Clark Cooper and Fred Drake for a couple decades, but I think they have a little more resources now.

SQLite is a BDFL situation more than single-maintainer, but D. Richard Hipp still has his hands on everything, and there are only a relatively small number of folks with commit access.

OpenSSL / Heartbleed was the event when this comic came out IIRC.

I didn't even know about core-js until the dev complained about all the sites which use it. https://github.com/zloirock/core-js/blob/master/docs/2023-02-14-so-whats-next.md

Edit: maybe it was core js. I don't remember the name exactly.

Standard JS. It's a library maintained by one guy in Russia who went to jail for some car accident (I don't have the full context). He needed money and had trouble getting it. Then the Ukraine invasion happened and that only made it more difficult for him to get money. Also he was harassed by less technical people seeing his code on websites thinking it was malicious.

It's really a sad story to me.

Would you like to hear an OpenSSL joke?

It's 64k letters long and you can repeat it back to me when I'm done.

It's "A".

https://www.heartbleed.com/

FORM https://en.wikipedia.org/wiki/FORM_(symbolic_manipulation_system)

Recent news article: https://www.wired.com/story/a-crucial-particle-physics-computer-program-risks-obsolescence/

Salvatore Sanfilippo - creator of Redis.

Well, he actually received many appreciations from the community. But it's worth knowing IMO.

https://www.eu-startups.com/2011/01/an-interview-with-salvatore-sanfilippo-creator-of-redis-working-out-of-sicily/

Look up a machine called Therac-25. great example of this. Terrifying.