←back to thread

An analysis of the Keycloak authentication system

(security.humanativaspa.it)
189 points udev4096 | 2 comments | 14 Nov 24 13:32 UTC | HN request time: 0.397s | source
Show context
mickael-kerjean ◴[14 Nov 24 14:57 UTC] No.42136723[source]▶
What if instead of publicly blaming an OSS product, you try to get a support contract with some of the engineers behind it? If your company is too cheap for that, maybe a PR would have been nice?

Having very high expectations when using the software without contributing anything else than public shaming on something that clearly state in the license: "Licensor provides the Work ... WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND" shouldn't be ok, this is quite literally how you make open source developer to burn out

replies(7): >>42136837 #>>42136872 #>>42136966 #>>42137033 #>>42137338 #>>42137517 #>>42137650 #
1. its-summertime ◴[14 Nov 24 16:14 UTC] No.42137650[source]▶
> maybe a PR would have been nice?

They did.

> 28/03/2024 – First communication sent with all details and a proposed fix.

And for the second one, a fix existed 2 days after first communication, doing a PR doesn't magically make that go faster.

For the third, a fix was done within a month, but once again was delayed, and didn't land until several months later.

- - -

RH does not provide support contracts for any affordable price. CNCF does not provide support contracts at all.

replies(1): >>42138977 #
2. hinkley ◴[14 Nov 24 17:54 UTC] No.42138977[source]▶
That was a very articulate and nice way of saying, “what if instead of using the tired old deflection you looked at the facts?”