Lunduke
News • Science & Tech
"If this one guy got hit by a bus, the world's software would fall apart."
(Funny? Yes. But the reality is far worse...)
April 04, 2024
post photo preview
  • How many critical software packages are maintained by a small, unpaid team (or, worse, a single person)?
  • What happens when that person gets bored with the project... or decides to do something malicious (as in the case with a recent backdoor in the XZ compression tool)... or... gets hit by a bus?

These are not only fair questions to ask... but critical as well.

The reality is that we're not simply talking about a handful of key software packages here -- the entirety of our modern computing infrastructure is built on top of thousands of projects (from software packages to online services) that are built, maintained, and run entirely by one person (or, when we're lucky, 2 or 3 people).

One wrong move and the Jenga tower that is modern computing comes crashing down.

Source: xkcd

Just to give you an idea of how widespread -- and dire -- this situation truly is, I would like to call your attention to two projects that most people don't even think about... but that are critical to nearly every computer system in use today.

The TZ Database

Dealing with Timezones in software can be tricky.  Many rules, many time zone details.  As luck would have it, a standard database (TZ Database) was built to make it easier for software projects to get those details right.

And, every time those timezone details (across the world) are changed -- something which can happen several times per year, often with only a few days notice -- that database needs to be updated.

What happens if those details are not updated... if the timezone data is incorrect?

At best?  A few minor scheduling inconveniences.  At worst?  Absolute mayhem... computer-wise.  Times can become significantly out of sync between systems.  Which can mess up not only scheduling (an obvious issue), but security features as well (as some encryption tools require closely synced time).

To give you an idea of how widespread the TZ Database is, here is just a teeny tiny fraction of the number of software projects which rely upon it:

  • Every BSD system: FreeBSD, OpenBSD, Solaris
  • macOS & iOS
  • Linux
  • Android
  • Java, PHP, Perl, Ruby, Python, GCC, Javascript
  • PostrgreSQL, MongoDB, SQL Server

Yeah.  It's basically a list of "all software".  And that's just a sample of the software which heavily relies on the TZ Database for making sure timing (and everything that is time-critical) is correct.

Now.  With something this absolutely critical, surely a highly paid team of people -- from multiple companies -- is responsible for keeping it updated... right?

Oh, heavens, no.

Two people.  Two!

While the database itself has been officially published on ICANN (the "Internet Corporation for Assigned Names and Numbers") servers for the last few years, only 2 people actually maintain the TZ Database.

SQLite

Did you know that SQLite is the most used database system in the entire world?  More than MySQL, MS SQL Server, and all the rest of them.  Good odds, SQLite is used on more systems than all other database systems in the world... combined.

In fact, SQLite is a critial component in the following systems:

  • Android, iOS, macOS, & Windows
  • Firefox, Chrome, & Safari
  • Most set top boxes and smart TVs
  • An absolutely crazy number of individual software packages (from Dropbox to iTunes)

Now, ready for the fact you knew was coming?

SQLite is maintained by... 3 guys.

Not "3 lead developers who oversee an army of open source contributors"... just 3 guys.  Total.  And they don't accept public patches or fixes.

"SQLite is open-source, meaning that you can make as many copies of it as you want and do whatever you want with those copies, without limitation. But SQLite is not open-contribution."

A piece of software that is practically the cornerstone of modern computing.  Trillions of dollars worth of systems relying upon it -- every second of every day.  3 guys.

Corporations rest on the shoulders of... a couple volunteers

Add those two projects together.  5 guys, in total, are responsible for Timezones and SQLite databases.  Software and data used on practically every computer on the planet.

And that's just the tip of the iceberg.  Critical projects -- often with small teams of (more often than not) unpaid voluneers -- form the core of the vast majority of major software projects.  Including commercial ones.

ImagemagickXZFFmpeg?

You'll find those at the heart of more systems than you can count.  Good odds you use all three, every day, and don't even notice it.

And, as the small team behind FFmpeg pointed out in a recent X post, getting those large corporations to contribute -- in any meaningful way -- can be like pulling teeth:

The xz fiasco has shown how a dependence on unpaid volunteers can cause major problems. Trillion dollar corporations expect free and urgent support from volunteers.

 

Microsoft / Microsoft Teams posted on a bug tracker full of volunteers that their issue is "high priority"

 

 

After politely requesting a support contract from Microsoft for long term maintenance, they offered a one-time payment of a few thousand dollars instead.

 

This is unacceptable. 

 

We didn't make it up, this is what Microsoft actually did:
https://trac.ffmpeg.org/ticket/10341#comment:4

 

The lesson from the xz fiasco is that investments in maintenance and sustainability are unsexy and probably won't get a middle manager their promotion but pay off a thousandfold over many years.

 

But try selling that to a bean counter

In short: Microsoft wanted to benefit from the (free) work done by FFmpeg... but was only willing -- at most -- to toss a few peanuts at the team.  And, even then, that (mildly insulting) offer of meager support was only done when Microsoft needed assistance.

A few parting thoughts...

There are valuable lessons to be learned from all of this -- including the need for real, meaningful support (by large corporations) of the projects they rely so heavily upon.

But, for now, I'd like to leave you with a few observations.

  1. Corporations don't hesitate to throw large sums of money at Tech Trade Organizations (such as The Linux Foundation -- which brings in hundreds of Millions every year from companies like Microsoft)... yet they are hesitant to provide significant funding to projects they rely directly upon to ship their own, often highly profitable, products (see the projects listed earlier in this article).
  2. How many of these smaller projects -- which Linux desktops and servers rely entirely upon -- receive regular funding from The Linux Foundation (or companies which fund The Linux Foundation)?  I'll answer that question for you: Next to none.
  3. Even high profile Open Source projects -- such as KDE or GNOME -- struggle to bring in enough funding to afford two full time developers on payroll.
  4. We have avoided catastrophe, thus far, through dumb luck.  The recent XZ backdoor, for example, was found by a lone developer who happened to notice a half second slowdown... and happened to have the time (and interest... and experience) to investigate further.  The odds of that being discovered before significant harm was done... whew!... slim.  So much dumb luck.

Go take a look at that XKCD comic at the begining of this article again.  Funny right?  And it makes a solid point.

You know what's terrifying, though?  The reality is far more precarious. 

There's not simply one project -- by one guy -- holding all of modern computing up.

There's thousands of projects.  Each made by one guy.  And hundreds of those projects (at least) are load-bearing.

Dumb luck only lasts for so long.

community logo
Join the Lunduke Community
To read more articles like this, sign up and join my community today
18
What else you may like…
Videos
Podcasts
Posts
Articles
February 13, 2025
Fedora's Code of Conduct: 200 Day Response Time, Only Protects You if Red Hat Likes You

Lunduke tests Fedora Linux's Code of Conduct. The results are just as ridiculous as you'd expect.

00:17:20
February 13, 2025
Lunduke Journal's New Self-Hosted Forum, Telnet BBS

So many ways to enjoy The Lunduke Journal now -- X, YouTube, Rumble, Substack, Podcast & more -- plus two new (self-hosted) ways to interact with the community.

More from The Lunduke Journal:
https://lunduke.com/

00:17:09
February 12, 2025
Codeberg Announces "Fight Against Far-Right"

The Git source code hosting organization, in response to anonymous spam, declares war on "Right-Wing Forces", encourages others to do the same.

00:17:56
November 22, 2023
The futility of Ad-Blockers

Ads are filling the entirety of the Web -- websites, podcasts, YouTube videos, etc. -- at an increasing rate. Prices for those ad placements are plummeting. Consumers are desperate to use ad-blockers to make the web palatable. Google (and others) are desperate to break and block ad-blockers. All of which results in... more ads and lower pay for creators.

It's a fascinatingly annoying cycle. And there's only one viable way out of it.

Looking for the Podcast RSS feed or other links? Check here:
https://lunduke.locals.com/post/4619051/lunduke-journal-link-central-tm

Give the gift of The Lunduke Journal:
https://lunduke.locals.com/post/4898317/give-the-gift-of-the-lunduke-journal

The futility of Ad-Blockers
November 21, 2023
openSUSE says "No Lunduke allowed!"

Those in power with openSUSE make it clear they will not allow me anywhere near anything related to the openSUSE project. Ever. For any reason.

Well, that settles that, then! Guess I won't be contributing to openSUSE! 🤣

Looking for the Podcast RSS feed or other links?
https://lunduke.locals.com/post/4619051/lunduke-journal-link-central-tm

Give the gift of The Lunduke Journal:
https://lunduke.locals.com/post/4898317/give-the-gift-of-the-lunduke-journal

openSUSE says "No Lunduke allowed!"
September 13, 2023
"Andreas Kling creator of Serenity OS & Ladybird Web Browser" - Lunduke’s Big Tech Show - September 13th, 2023 - Ep 044

This episode is free for all to enjoy and share.

Be sure to subscribe here at Lunduke.Locals.com to get all shows & articles (including interviews with other amazing nerds).

"Andreas Kling creator of Serenity OS & Ladybird Web Browser" - Lunduke’s Big Tech Show - September 13th, 2023 - Ep 044

FUTO is putting on a “Don’t Be Evil” event during SXSW.

March 15th. Myself. Louis Rossman. Andreas Kling.

It’s going to be nerdy. And, guaranteed, it’s going to be talked about.

https://partiful.com/e/iI0zo1ewEu0YP4ii5XWF

post photo preview
post photo preview
post photo preview
February 13, 2025
For February: 50% off Subscriptions, 50% off DRM-Free Downloads, Lifetime Subscriptions available

2025 is off to an amazing start for The Lunduke Journal.

The number of people getting their Big-Tech-Free Tech News from The Lunduke Journal is shooting through the roof. Subscriptions (of every kind) are soaring.

And The Lunduke Journal is now available on a wide variety of platforms — with our core community area now consolidating on our own, self-hosted forum (which is exclusively available to subscribers).

With the tidal wave of new people — many of you wanting access to the new, exclusive Forum — I want to make it as easy as possible for everyone to become a part of what we are doing. Time to do something a bit crazy. Massive discounts on subscriptions (I mean… huge). For the entire month of February.

Yup. The whole gosh darned month.

If it’s February, the discounts below are all available. Choose whatever works best for you. Then feel awesome about supporting truly independent Tech Journalism.

50% Off Yearly Subscription:

50% off a Yearly subscription to The Lunduke Journal via both Locals and Substack. (This includes full access to the community Forum.)

That’s $2.25 per month. Pocket change.

50% Off DRM-Free, MP4 Downloads:

Want to be able to download every show The Lunduke Journal releases (and watch them on whatever device you like)? Yeah. You can do that. For 50% off.

Note: This DRM-Free download option does not include access to the Forum. This option is strictly for downloading the episodes.

The Famous Lifetime Subscription:

The "World Famous Lunduke Journal Lifetime Subscription" is exactly what it sounds like. Pay once and get full access to The Lunduke Journal. For life. A great way to support Big-Tech-Free Journalism.

(This includes full access to the community Forum.)

New Lifetime Subscriptions are available, for $200, from now through February 28th.

The Lifetime Subscription can be obtain via Locals, Substack, or using Bitcoin. All three options work great and are super easy.

How to get a Lifetime Subscription via Locals:

  1. Go to Lunduke.Locals.com/support.

  2. Select "Give Once".

  3. Enter "200" into the amount field.

  4. After checking out, Lunduke will toss you an email once your account is set to full lifetime status. (This usually happens within a few hours.)

How to get a Lifetime Subscription via Substack:

  1. Go to Lunduke.Substack.com/subscribe.

  2. Select the “Lifetime Subscription” option.

  3. After checking out, Lunduke will toss you an email once your account is set to full lifetime status. (This usually happens within a few hours.)

If you would also like full, Lifetime access to Lunduke.Locals.com (which is included):

  1. Make a free account on Lunduke.Locals.com.

  2. Email “bryan at lunduke.com” with the email address you use on both Substack and Locals (can be different email addresses).

  3. Lunduke will toss you an email once your account is set to full lifetime status on Locals.

How to get a Lifetime Subscription with Bitcoin:

And, finally, you can obtain a Lifetime Subscription via Bitcoin. Save a few bucks with this option, as Bitcoin processing has fewer fees associated with it.

bc1qyjakve8fywm8pz2v99v57yhjj0vzr2vjze6fcq

  • Email "bryan at lunduke.com" with the following information: What time you made the transaction, how much was sent (in Bitcoin), and the email address you use (or plan to use) on Locals.com.

The Lunduke Journal would not be possible without your support. Every subscriber, of every type, makes a massive difference in bringing Big-Tech-Free Tech Journalism to the world.

Thank you.

-Lunduke

Read full Article
February 09, 2025
post photo preview
The Great Tech Demographic Survey of 2025

There are a lot of questions we don't have good answers for.

  • Do Trump voters prefer EMacs or Vi?
  • Who is happier with their life... people who use Tabs or Spaces?
  • Does your age impact your choice of Web Browser?
  • Who is more likely to support censorship... Rust Programmers or C Programmers?

Do you know the answers to those questions?  No, I don't either.

Let's find out.

The Great Tech Industry Demographic Survey of 2025

This survey is massive -- containing questions on everything from Operating System preferences to religion and politicsProgramming languages and... workplace discrimination.  It even gets into Cryptocurrency and Text Editor preferences.

Seriously.

  • All answers are 100% anonymous (no account is needed), no email address is collected.
  • All questions are optional (only answer the ones you feel comfortable with).
  • The questions are all presented in random order.
  • All of the (anonymous) results will be published.

The 2024 edition of this survey (last year) was taken by over 7,200 people across the entire IT industry -- an absolutely massive sample size (larger than most US Presidential Election polls).  For this new 2025 survey... we're aiming even higher.

Are you a computer nerd?  Do you work in the IT industry?

Set aside a few minutes and take the 2025 survey.

Then tell everyone about it.  The more people who take the survey -- across as many companies and communities as possible -- the better the data will be.

Read full Article
February 03, 2025
Fund Indie Tech Journalism. Lifetime Subs & Discounts available for 48 hours.

February is upon us! And — would you look at that — thanks to all of you, The Lunduke Journal is already fully funded through the end of February!

That means: We can continue to have zero sponsors, zero advertising and, even more importantly, zero influence from Big Tech.

Now. How amazing would it be if The Lunduke Journal could reach our funding goals through the end of March… almost two months ahead of time? Pretty freaking amazing. And absolutely doable.

Let’s do it.

Through Tuesday (February 4th), we’ve got a handful of discounts on Lunduke Journal subscriptions. Take a look. A huge thank you to everyone who has already subscribed — you make this all possible.

Every penny goes towards keeping truly independent journalism alive.

Lunduke Journal Discounts

For the next 2 days (through Tuesday, February 4th), in addition to regular subscriptions, you can grab two limited discounts:

  1. Discounted Lifetime Subscriptions (scroll down for details)

  2. DRM-Free, MP4 Downloads for 2024 & 2025 (combined) for 55% off.

There many ways to support The Lunduke Journal. Choose the option that makes you smile. It’s all listed below.

Where to grab a Monthly or Yearly Subscription:

These are regular price. But still awesome.

Lifetime Subscription Details:

  • Pay once, full subscription for life (on Locals, Substack, or both).

  • Available only until Tuesday, February 4th. Then the Lifetime Subscription option goes “back in the vault”.

  • Can be purchased via Locals, Substack, or with Bitcoin. Chose whichever works for you. Scroll down for steps.

Where to buy a DRM-Free, MP4 video yearly download pass:

Want to be able to download every show The Lunduke Journal releases (and watch them on whatever device you like)? Yeah. You can do that.

The Famous Lifetime Subscription via Locals:

The "World Famous Lunduke Journal Lifetime Subscription" is exactly what it sounds like. Pay once and get full access to The Lunduke Journal (with all the perks of subscription on Locals). For life.

New Lifetime Subscriptions are available, for $200, from now through February 4th. Then this option goes "back into the vault".

Here's how to grab one of these coveted bad boys for yourself:

  1. Go to Lunduke.Locals.com/support.

  2. Select "Give Once".

  3. Enter "200" into the amount field.

  4. After checking out, Lunduke will toss you an email once your account is set to full lifetime status. (This usually happens within a few hours.)

The Famous Lifetime Subscription via Substack:

You can also snag a Lifetime Subscription via Substack:

  1. Go to Lunduke.Substack.com/subscribe.

  2. Select the “Lifetime Subscription” option.

  3. After checking out, Lunduke will toss you an email once your account is set to full lifetime status. (This usually happens within a few hours.)

If you would like full, Lifetime access to Lunduke.Locals.com (which is included):

  1. Make a free account on Lunduke.Locals.com.

  2. Email “bryan at lunduke.com” with the email address you use on both Substack and Locals (can be different email addresses).

  3. Lunduke will toss you an email once your account is set to full lifetime status on Locals.

The Famous Lifetime Subscription (with Bitcoin discount):

And, finally, you can obtain a Lifetime Subscription via Bitcoin. Save a few bucks with this option, as Bitcoin processing has fewer fees associated with it.

  • Make sure you have a Lunduke.Locals.com account (a free account works just fine).

  • Send $190 worth of Bitcoin (or more) to the following address:

bc1qyjakve8fywm8pz2v99v57yhjj0vzr2vjze6fcq

  • Email "bryan at lunduke.com" with the following information: What time you made the transaction, how much was sent (in Bitcoin), and the email address you use (or plan to use) on Locals.com.

Once again, thank you. The Lunduke Journal would not be possible without your support.

You rule. Seriously.

-Lunduke

Read full Article
See More
Available on mobile and TV devices
google store google store app store app store
google store google store app tv store app tv store amazon store amazon store roku store roku store
Powered by Locals