14 ms·

Mozilla Awards Over Half a Million to Open Source Projects

348 points by r3bl 9y ago

wakamoleguy 9y ago
This is great! While the headline uses the absolute dollar amount to attract eyes and look big, I am more impressed by the list of results in the article. Previous awards from Mozilla have led directly to improvements in Tor, Python documentation, Kea DHCP, and security audits of NTP services. As someone who donates a small amount to Mozilla monthly, this makes me feel good about my choice.
- flyingcoder 9y ago
  They have also contributed a lot to Django
  - vanni 9y ago
    https://www.djangoproject.com/weblog/2015/dec/11/django-awarded-moss-grant/ https://www.djangoproject.com/weblog/2015/dec/11/django-awar... https://blog.mozilla.org/blog/2015/12/10/mozilla-open-source-support-first-awards-made/ https://blog.mozilla.org/blog/2015/12/10/mozilla-open-source...
- gertef 9y ago
  The headline doesn't mention "dollars" at all.
  - jjnoakes 9y ago
    Not even implicitly?
  - wakamoleguy 9y ago
    That's true. If we are being pedantic, though, it does mention an amount ("half a million"), which turns out to be the number of dollars they awarded ($539,000). So I will stand by statement that the headline mentions the "dollar amount." :-)
- accidentalrebel 9y ago
  This is interesting. Is there a list somewhere of all projects that Mozilla has helped in the past? Huge respect to them.
  - cadecairos 9y ago
    There's a "Past Recipients" section on the MOSS page: https://www.mozilla.org/moss/ https://www.mozilla.org/moss/
    - ReverseCold 9y ago
      I'm sad about pears search, the IRC channel is dead and there's been no meaningful activity in the repo for a while.
    - aorth 9y ago
      Hmm, it looks like the Caddy web server got $50,000 at one point (in 2016 apparently). They were the ones who recently decided (in mid 2017) that it was a good idea to add HTTP headers advertising the names of their sponsors to their open source version. Then, when someone forked their project, they filed a GitHub issue one hour later accusing the fork of trademark infringement! See the discussion here: https://news.ycombinator.com/item?id=15237923 https://news.ycombinator.com/item?id=15237923 As to this year's MOSS recipients, Ushahidi received almost $200,000. They're a Kenya-based startup that was the darling of the Nairobi tech scene a few years ago but have increasingly come under criticism for their leadership during a recent sexual harassment scandal: https://qz.com/1026890/kenyas-ushahidi-is-investigating-sexual-harassment-claims-against-a-senior-employee/ https://qz.com/1026890/kenyas-ushahidi-is-investigating-sexu... Furthermore, one of their affiliated startups, who was making a "rugged" router powered by OpenWRT, was violating the GPL and was being quite dismissive and condescending to those of us who pointed out that they should be releasing the source code of their product. I covered this on my personal blog at the time: https://mjanja.ch/2015/05/brck-in-violation-of-the-gpl/ https://mjanja.ch/2015/05/brck-in-violation-of-the-gpl/
      - jamespo 9y ago
triptych 9y ago
Phaser.io is worthy project and the folks on the team are dedicated to creating something useful and amazing for the web.
ovrdrv3 9y ago
What does the money go to? cdns and hosting? Or to main contributors? That's pretty cool nonetheless.
- sova 9y ago
  It must depend on the specific project. Hopefully to more traction bearing and birthing elements than just hosting
- deleted 9y ago
  [deleted]
sova 9y ago
From the article: "The biggest amount ($194,000) went toUshahidi, an open source software platform for crowdsourcing, monitoring, visualizing, and responding to reports from people caught up in political turmoil or subject to governmental or vigilante abuse. They are working on making it easier to securely submit reports, and documentation on how to deploy Ushahidi while minimising risk to the hosts." Wireless mesh fully distributed world here we come! :)
- r3bl 9y ago
  There's more where that came from: A $2 Million Prize to Decentralize the Web. https://blog.mozilla.org/blog/2017/06/21/2-million-prize-decentralize-web-apply-today/ https://blog.mozilla.org/blog/2017/06/21/2-million-prize-dec... [Disclaimer] Mozilla Foundation employee as of recently.
  - sova 9y ago
    Thank you for being part of such excellent endeavors! Wow this is actually really cool; it's a contest?
sandov 9y ago
>$100,000 to RiseUp, a coordination platform used by activists across the political spectrum, to improve the security of their email service; However, RiseUp has shown to be leftist several times[1]. If I was a right wing activist or something similar, I would not use RiseUp, because of the serious conflict of interest of the owners of the platform. There's nothing wrong with RiseUp being leftist, but I expect Mozilla to be neutral politically, except when something related to free software is at stake in politics. [1]Apart from their logo being a reference to the anarcho-communist flag, they've said "[...] We do this by providing communication and computer resources to allies engaged in struggles against capitalism and other forms of oppression." (https://www.counterpunch.org/2017/09/01/responding-to-antifa-and-riseup-on-revolutionary-politics-and-non-violence/ https://www.counterpunch.org/2017/09/01/responding-to-antifa...) I'm sure I'd find other similar quotes if I looked it up.
- throwawayjava 9y ago
  > but I expect Mozilla to be neutral politically Why? > except when something related to free software is at stake in politics. They're the Mozilla Foundation, not the Free Software Foundation. The free software movement has always been intertwined with more or less radical political movements to lesser or greater extents over time. It's only relatively recently that "open source" is primarily the thing you do so you have a GitHub profile that will land you a 100k paycheck.
  - sandov 9y ago
    Because there are people of various political ideologies that contribute to Mozilla and to free software. If tomorrow Mozilla decided "we support X ideology", then the organization would lose credibility and support from a lot of people. If the Mozilla CEO wants to do that, then fine, we'll find another organization to support and to look up to. >And requesting the latter to be politically neutral is... well. I don't see any incompatibility between free software and any political ideology.
    - throwawayjava 9y ago
zo1 9y ago
Just looking at it at a glance, 50% of the money went to what appear to be political/activist projects/websites "masquerading" as "Open-Source", namely "Ushahidi" (194k/35%) and "RiseUp" (100k/18%). The latter only really putting their "help site" on github: https://github.com/riseupnet https://github.com/riseupnet. I don't personally count "open-source" or "any one can contribute" websites/platforms as actual open-source. Both the above donations are individually much larger in monetary amounts than what Mozilla gave the last time around to actual "code" open-source projects (amounts: 10k, 25k, 30k, 50k) such as Tor/LLVM/etc. Honestly, I was really excited to see what open-source projects were going to be getting some (I would assume "much needed") funding behind them, but I was disappointed with yet more politics. Except for Webpack, definitely kudos to Mozilla for funding their work on WebAssembly.
- mintplant 9y ago
  https://labs.riseup.net/code/ https://labs.riseup.net/code/
nextos 9y ago
These are cool projects. I wish they also contributed to some of the addon projects that make Firefox so unique. Greasemonkey and Vimperator come to mind. But surely others have good suggestions too.
Sephr 9y ago
I'd much rather they limited their donations to organizations with still-breathing warrant canaries (e.g. not RiseUp). Maybe I'm cynical, but I think that non-profit organizations with dead national security warrant canaries cannot accomplish technical or social activism as effectively as they might have in the past.
- dublinben 9y ago
  This has been explained: https://riseup.net/en/about-us/press/canary-statement https://riseup.net/en/about-us/press/canary-statement
  - tinalumfoil 9y ago
    I don't understand how an organization so concerned with privacy can hand over private unencrypted user data to the FBI and then nonchalantly pass it off as OK because those users violated the "letter and the spirit" of their "social contract". This is a massive design failure on RiseUp's part and should not be taken lightly.
    - jrochkind1 9y ago
      Did you read the thing whose link you are responding to? The design has indeed been altered: > We have taken action to ensure that Riseup never again has access to a user’s stored email in plaintext. Starting today, all new Riseup email accounts will feature personally encrypted storage on our servers, only accessible by you. I'm not thrilled with the action that was taken, complying with the sealed warrant. I suspect Riseup isn't either. But I also think it would be ridiculous to expect Riseup admins to go to jail to protect people using their service to extort others. I definitely wouldn't have been willing to either if I were in their place.
- slim 9y ago
  The canary is alive
  - deleted 9y ago
yosito 9y ago
> In neither of these cases did we find an issue more severe than Medium. What does that mean?
- mcpherrinm 9y ago
  There's a somewhat loosely standardized set of severity levels in security audits: informational, low, medium, high, critical. So no high or critical issues were found. That means probably nothing exploitable.
  - yosito 9y ago
    Got it. Thanks! The capital M made me think they were somehow referring to medium.com
joshsyn 9y ago
All written in rust :P
zazibar 9y ago
A wonderful surprise to see Phaser on that list!
cJ0th 9y ago
Incidentally, does Thunderbird still receive money from mozilla?
- r3bl 9y ago
  The latest update from May this year on Thunderbird's status: https://blog.mozilla.org/thunderbird/2017/05/thunderbirds-future-home/ https://blog.mozilla.org/thunderbird/2017/05/thunderbirds-fu...
martell 9y ago
It would be awesome if we could get some security audit funding focused towards rust projects. For example an audit of rustls pki and co, so we can start pushing the rust ecosystem forward without having to depend on c/c++ projects like openssl for production use. Fingers Crossed :D

348 points by r3bl 9y ago

This is great! While the headline uses the absolute dollar amount to attract eyes and look big, I am more impressed by the list of results in the article. Previous awards from Mozilla have led directly to improvements in Tor, Python documentation, Kea DHCP, and security audits of NTP services. As someone who donates a small amount to Mozilla monthly, this makes me feel good about my choice.

flyingcoder 9y ago
They have also contributed a lot to Django
- vanni 9y ago
  https://www.djangoproject.com/weblog/2015/dec/11/django-awarded-moss-grant/ https://www.djangoproject.com/weblog/2015/dec/11/django-awar... https://blog.mozilla.org/blog/2015/12/10/mozilla-open-source-support-first-awards-made/ https://blog.mozilla.org/blog/2015/12/10/mozilla-open-source...
gertef 9y ago
The headline doesn't mention "dollars" at all.
- jjnoakes 9y ago
  Not even implicitly?
- wakamoleguy 9y ago
  That's true. If we are being pedantic, though, it does mention an amount ("half a million"), which turns out to be the number of dollars they awarded ($539,000). So I will stand by statement that the headline mentions the "dollar amount." :-)
accidentalrebel 9y ago
This is interesting. Is there a list somewhere of all projects that Mozilla has helped in the past? Huge respect to them.
- cadecairos 9y ago
  There's a "Past Recipients" section on the MOSS page: https://www.mozilla.org/moss/ https://www.mozilla.org/moss/
  - ReverseCold 9y ago
    I'm sad about pears search, the IRC channel is dead and there's been no meaningful activity in the repo for a while.
  - aorth 9y ago
    Hmm, it looks like the Caddy web server got $50,000 at one point (in 2016 apparently). They were the ones who recently decided (in mid 2017) that it was a good idea to add HTTP headers advertising the names of their sponsors to their open source version. Then, when someone forked their project, they filed a GitHub issue one hour later accusing the fork of trademark infringement! See the discussion here: https://news.ycombinator.com/item?id=15237923 https://news.ycombinator.com/item?id=15237923 As to this year's MOSS recipients, Ushahidi received almost $200,000. They're a Kenya-based startup that was the darling of the Nairobi tech scene a few years ago but have increasingly come under criticism for their leadership during a recent sexual harassment scandal: https://qz.com/1026890/kenyas-ushahidi-is-investigating-sexual-harassment-claims-against-a-senior-employee/ https://qz.com/1026890/kenyas-ushahidi-is-investigating-sexu... Furthermore, one of their affiliated startups, who was making a "rugged" router powered by OpenWRT, was violating the GPL and was being quite dismissive and condescending to those of us who pointed out that they should be releasing the source code of their product. I covered this on my personal blog at the time: https://mjanja.ch/2015/05/brck-in-violation-of-the-gpl/ https://mjanja.ch/2015/05/brck-in-violation-of-the-gpl/
    - jamespo 9y ago

triptych 9y ago

Phaser.io is worthy project and the folks on the team are dedicated to creating something useful and amazing for the web.

ovrdrv3 9y ago

What does the money go to? cdns and hosting? Or to main contributors? That's pretty cool nonetheless.

sova 9y ago
It must depend on the specific project. Hopefully to more traction bearing and birthing elements than just hosting
deleted 9y ago
[deleted]

sova 9y ago

From the article: "The biggest amount ($194,000) went toUshahidi, an open source software platform for crowdsourcing, monitoring, visualizing, and responding to reports from people caught up in political turmoil or subject to governmental or vigilante abuse. They are working on making it easier to securely submit reports, and documentation on how to deploy Ushahidi while minimising risk to the hosts." Wireless mesh fully distributed world here we come! :)

r3bl 9y ago
There's more where that came from: A $2 Million Prize to Decentralize the Web. https://blog.mozilla.org/blog/2017/06/21/2-million-prize-decentralize-web-apply-today/ https://blog.mozilla.org/blog/2017/06/21/2-million-prize-dec... [Disclaimer] Mozilla Foundation employee as of recently.
- sova 9y ago
  Thank you for being part of such excellent endeavors! Wow this is actually really cool; it's a contest?

sandov 9y ago

>$100,000 to RiseUp, a coordination platform used by activists across the political spectrum, to improve the security of their email service; However, RiseUp has shown to be leftist several times[1]. If I was a right wing activist or something similar, I would not use RiseUp, because of the serious conflict of interest of the owners of the platform. There's nothing wrong with RiseUp being leftist, but I expect Mozilla to be neutral politically, except when something related to free software is at stake in politics. [1]Apart from their logo being a reference to the anarcho-communist flag, they've said "[...] We do this by providing communication and computer resources to allies engaged in struggles against capitalism and other forms of oppression." (https://www.counterpunch.org/2017/09/01/responding-to-antifa-and-riseup-on-revolutionary-politics-and-non-violence/ https://www.counterpunch.org/2017/09/01/responding-to-antifa...) I'm sure I'd find other similar quotes if I looked it up.

throwawayjava 9y ago
> but I expect Mozilla to be neutral politically Why? > except when something related to free software is at stake in politics. They're the Mozilla Foundation, not the Free Software Foundation. The free software movement has always been intertwined with more or less radical political movements to lesser or greater extents over time. It's only relatively recently that "open source" is primarily the thing you do so you have a GitHub profile that will land you a 100k paycheck.
- sandov 9y ago
  Because there are people of various political ideologies that contribute to Mozilla and to free software. If tomorrow Mozilla decided "we support X ideology", then the organization would lose credibility and support from a lot of people. If the Mozilla CEO wants to do that, then fine, we'll find another organization to support and to look up to. >And requesting the latter to be politically neutral is... well. I don't see any incompatibility between free software and any political ideology.
  - throwawayjava 9y ago

zo1 9y ago

Just looking at it at a glance, 50% of the money went to what appear to be political/activist projects/websites "masquerading" as "Open-Source", namely "Ushahidi" (194k/35%) and "RiseUp" (100k/18%). The latter only really putting their "help site" on github: https://github.com/riseupnet https://github.com/riseupnet. I don't personally count "open-source" or "any one can contribute" websites/platforms as actual open-source. Both the above donations are individually much larger in monetary amounts than what Mozilla gave the last time around to actual "code" open-source projects (amounts: 10k, 25k, 30k, 50k) such as Tor/LLVM/etc. Honestly, I was really excited to see what open-source projects were going to be getting some (I would assume "much needed") funding behind them, but I was disappointed with yet more politics. Except for Webpack, definitely kudos to Mozilla for funding their work on WebAssembly.

mintplant 9y ago
https://labs.riseup.net/code/ https://labs.riseup.net/code/

nextos 9y ago

These are cool projects. I wish they also contributed to some of the addon projects that make Firefox so unique. Greasemonkey and Vimperator come to mind. But surely others have good suggestions too.

Sephr 9y ago

I'd much rather they limited their donations to organizations with still-breathing warrant canaries (e.g. not RiseUp). Maybe I'm cynical, but I think that non-profit organizations with dead national security warrant canaries cannot accomplish technical or social activism as effectively as they might have in the past.

dublinben 9y ago
This has been explained: https://riseup.net/en/about-us/press/canary-statement https://riseup.net/en/about-us/press/canary-statement
- tinalumfoil 9y ago
  I don't understand how an organization so concerned with privacy can hand over private unencrypted user data to the FBI and then nonchalantly pass it off as OK because those users violated the "letter and the spirit" of their "social contract". This is a massive design failure on RiseUp's part and should not be taken lightly.
  - jrochkind1 9y ago
    Did you read the thing whose link you are responding to? The design has indeed been altered: > We have taken action to ensure that Riseup never again has access to a user’s stored email in plaintext. Starting today, all new Riseup email accounts will feature personally encrypted storage on our servers, only accessible by you. I'm not thrilled with the action that was taken, complying with the sealed warrant. I suspect Riseup isn't either. But I also think it would be ridiculous to expect Riseup admins to go to jail to protect people using their service to extort others. I definitely wouldn't have been willing to either if I were in their place.
slim 9y ago
The canary is alive
- deleted 9y ago

yosito 9y ago

> In neither of these cases did we find an issue more severe than Medium. What does that mean?

mcpherrinm 9y ago
There's a somewhat loosely standardized set of severity levels in security audits: informational, low, medium, high, critical. So no high or critical issues were found. That means probably nothing exploitable.
- yosito 9y ago
  Got it. Thanks! The capital M made me think they were somehow referring to medium.com

joshsyn 9y ago

All written in rust :P

zazibar 9y ago

A wonderful surprise to see Phaser on that list!

cJ0th 9y ago

Incidentally, does Thunderbird still receive money from mozilla?

r3bl 9y ago
The latest update from May this year on Thunderbird's status: https://blog.mozilla.org/thunderbird/2017/05/thunderbirds-future-home/ https://blog.mozilla.org/thunderbird/2017/05/thunderbirds-fu...

martell 9y ago

It would be awesome if we could get some security audit funding focused towards rust projects. For example an audit of rustls pki and co, so we can start pushing the rust ecosystem forward without having to depend on c/c++ projects like openssl for production use. Fingers Crossed :D