4 ms·

Lookie here, another foundation with work groups, directors and a bureaucratic apparatus! Years of fruitful work! "Open" source is being drowned in bureaucracy

Lookie here, another foundation with work groups, directors and a bureaucratic apparatus! Years of fruitful work! "Open" source is being drowned in bureaucracy by talkers.

scovetta 6y ago
Please join us, and help us do things. Seriously, our biggest challenge is that we need more folks like you, who will roll up your sleeves and help us get something tangible done "right now". Attend a working group and tell us that we're not moving fast enough, or that we're not working on the most important things, or that your idea is better than ours and we should do your thing instead. Give it a shot, you might be surprised. Or we might be. Either way, one of us is getting better.
- sprash 6y ago
  If I want to publish a security bug why do I need a Foundation to do that? I'd act as an individual and be just fine. Those Foundations are all highly infiltrated by corporate and intelligence interest. This is especially true for the Linux foundation which sponsores the OSSF. There is no reason to trust them.
  - detaro 6y ago
    Nothing here suggests that you should need them to publish a security bug.
- bostik 6y ago
  I have a suggestion for ground rules as far tooling is concerned. 1. If it requires a GUI, at any stage at all, it's broken. 2. Unless it's controllable through scripting, it's unfit for purpose. 3. If it doesn't support real-time observability and control via an API, it's useless. This space doesn't need any more "products". We need a good suite of composable tools, not more C-suite bingo sheets.
- jacques_chester 6y ago
  I'm having trouble finding a calendar (after very shallow searching). Perhaps you could add a link someplace prominent?
  - scovetta 6y ago
    Sorry, should have posted the link directly: https://calendar.google.com/calendar?cid=czYzdm9lZmhwNWk5cGZsdGI1cTY3bmdwZXNAZ3JvdXAuY2FsZW5kYXIuZ29vZ2xlLmNvbQ https://calendar.google.com/calendar?cid=czYzdm9lZmhwNWk5cGZ...
- the_biot 6y ago
  I know you mean well, but i've tried so very very hard to work with Linux Foundation-driven projects like this. The lesson I learned was that as an independent developer, you simply have no place in an organization like this.
  - scovetta 6y ago
    I'm sorry you had a bad experience with LF projects. We absolutely need independent developers in the OpenSSF - if the only voices that are heard are the "enterprise" voices, we're going to come up solutions that work primarily for enterprises. If you're willing to try again, I'd be happy to have a chat with you about where you could contribute/collaborate with us. You're also welcome to join any of the working groups (mine meets next on Wednesday, 3/31); calendar: https://calendar.google.com/calendar?cid=czYzdm9lZmhwNWk5cGZsdGI1cTY3bmdwZXNAZ3JvdXAuY2FsZW5kYXIuZ29vZ2xlLmNvbQ https://calendar.google.com/calendar?cid=czYzdm9lZmhwNWk5cGZ...
    - bigiain 6y ago
      From my perspective, try sounding less like a uniform beige bureaucratic committee and meeting machine, and make it way more clear why some under appreciated oss project maintainer might see some worthwhile benefit from what you’re doing. Attending meetings with workgroups and advisory committees filled with people from Microsoft/Google/Redhat/JPMorgan is not the sort of thing that fills most oss devs I’ve ever met with joy...
  - caniszczyk 6y ago
    can you give some examples All Linux Foundation projects separate business/funding governance (you pay to get a vote on how the money is spent) from technical governance (you do the work you get a seat at the table). If you show up and do the work, you should be fine.
- matkoniecz 6y ago
  > our biggest challenge is that we need more folks like you, who will roll up your sleeves and help us get something tangible done "right now" The perspective of working for free in initiative where all good outcomes will be used to promote Google and other corporate entities, is not something that encourages people to become involved. Especially hard working people who produce something useful. <self interest> Maybe fund some grant program accessible without tons of paperwork? And fund people who would be happy to create/continue creating/improve something useful and security related but are unable to justify doing this as a hobby? </self interest>
- detaro 6y ago
  So I admit that this is totally based on outside optics only, but everything I've seen signals "big corporate group thing" similar to many standard groups and other committees, which is fun and games if participating is your job: you get an opportunity to talk about about what you are doing on company time, with peers that are also there on company time and thus don't mind spending hours on participating in meetings (during work time, because it's work for everyone else), reading mailing-lists, ... But if you aren't paid for it, you either need to have effectively unlimited free time or be someone highly respected already to be able to participate on a meaningful level. If that's not the goal, you need to invest into a) ensuring that you actually do provide a useful environment for outside participants and b) communicating this, i.e. by having a public presence that clearly explains this and doesn't look like it's targeted at impressing middle management. Transparency into what is going on right now is key to this. "Linux Foundation" doesn't scream "community". See also other comments here specifically about Google's input, which reads a lot like "we've thought up some things we're now going to impose on everyone, just open-washed a bit". (Again, this is totally outside image, and not intended as an attack on any individual involved as having done anthing wrong, just trying to communicate what outside impression you are likely dealing with)
lifeisstillgood 6y ago
Put it a different way: Open Source now is in every single walk of life and is only going to become more critical to everyone online, their banking, their healthcare and so on. As such most people would want that software to be governed. Preferably with transparency, right to reply / be heard and have their needs taken into account. It might not have to be bereaucratic, long winded or inefficient, but it will have to be government. And it's going to need to be a government of international needs and concerns. The only good point is we might get to shape it for the next decade while it all starts up www.oss4gov.org/manifesto
bigiain 6y ago
Yeah, I gotta admit I read about Governing Bodies, Working Groups, and Technical Advisory Committees - and instantly pigeonholed this as “for academic tenure track or Big Corp evangelists and subject matter experts only”. Looks way too much like a bunch of suits and the occasional skunkworks greybeard deciding they want to tell open source project maintainers and contributors what to do. Maybe they’ll do some good, it doesn’t sound like a thing I’d ever want to be involved in (you know, unless IBM or Microsoft or whoever offer me a Distinguished Engineer role where I can choose to dabble here at my leisure on their great big firehouse of dimes...)

Lookie here, another foundation with work groups, directors and a bureaucratic apparatus! Years of fruitful work! "Open" source is being drowned in bureaucracy by talkers.

scovetta 6y ago

Please join us, and help us do things. Seriously, our biggest challenge is that we need more folks like you, who will roll up your sleeves and help us get something tangible done "right now". Attend a working group and tell us that we're not moving fast enough, or that we're not working on the most important things, or that your idea is better than ours and we should do your thing instead. Give it a shot, you might be surprised. Or we might be. Either way, one of us is getting better.

sprash 6y ago
If I want to publish a security bug why do I need a Foundation to do that? I'd act as an individual and be just fine. Those Foundations are all highly infiltrated by corporate and intelligence interest. This is especially true for the Linux foundation which sponsores the OSSF. There is no reason to trust them.
- detaro 6y ago
  Nothing here suggests that you should need them to publish a security bug.
bostik 6y ago
I have a suggestion for ground rules as far tooling is concerned. 1. If it requires a GUI, at any stage at all, it's broken. 2. Unless it's controllable through scripting, it's unfit for purpose. 3. If it doesn't support real-time observability and control via an API, it's useless. This space doesn't need any more "products". We need a good suite of composable tools, not more C-suite bingo sheets.
jacques_chester 6y ago
I'm having trouble finding a calendar (after very shallow searching). Perhaps you could add a link someplace prominent?
- scovetta 6y ago
  Sorry, should have posted the link directly: https://calendar.google.com/calendar?cid=czYzdm9lZmhwNWk5cGZsdGI1cTY3bmdwZXNAZ3JvdXAuY2FsZW5kYXIuZ29vZ2xlLmNvbQ https://calendar.google.com/calendar?cid=czYzdm9lZmhwNWk5cGZ...
the_biot 6y ago
I know you mean well, but i've tried so very very hard to work with Linux Foundation-driven projects like this. The lesson I learned was that as an independent developer, you simply have no place in an organization like this.
- scovetta 6y ago
  I'm sorry you had a bad experience with LF projects. We absolutely need independent developers in the OpenSSF - if the only voices that are heard are the "enterprise" voices, we're going to come up solutions that work primarily for enterprises. If you're willing to try again, I'd be happy to have a chat with you about where you could contribute/collaborate with us. You're also welcome to join any of the working groups (mine meets next on Wednesday, 3/31); calendar: https://calendar.google.com/calendar?cid=czYzdm9lZmhwNWk5cGZsdGI1cTY3bmdwZXNAZ3JvdXAuY2FsZW5kYXIuZ29vZ2xlLmNvbQ https://calendar.google.com/calendar?cid=czYzdm9lZmhwNWk5cGZ...
  - bigiain 6y ago
    From my perspective, try sounding less like a uniform beige bureaucratic committee and meeting machine, and make it way more clear why some under appreciated oss project maintainer might see some worthwhile benefit from what you’re doing. Attending meetings with workgroups and advisory committees filled with people from Microsoft/Google/Redhat/JPMorgan is not the sort of thing that fills most oss devs I’ve ever met with joy...
- caniszczyk 6y ago
  can you give some examples All Linux Foundation projects separate business/funding governance (you pay to get a vote on how the money is spent) from technical governance (you do the work you get a seat at the table). If you show up and do the work, you should be fine.
matkoniecz 6y ago
> our biggest challenge is that we need more folks like you, who will roll up your sleeves and help us get something tangible done "right now" The perspective of working for free in initiative where all good outcomes will be used to promote Google and other corporate entities, is not something that encourages people to become involved. Especially hard working people who produce something useful. <self interest> Maybe fund some grant program accessible without tons of paperwork? And fund people who would be happy to create/continue creating/improve something useful and security related but are unable to justify doing this as a hobby? </self interest>
detaro 6y ago
So I admit that this is totally based on outside optics only, but everything I've seen signals "big corporate group thing" similar to many standard groups and other committees, which is fun and games if participating is your job: you get an opportunity to talk about about what you are doing on company time, with peers that are also there on company time and thus don't mind spending hours on participating in meetings (during work time, because it's work for everyone else), reading mailing-lists, ... But if you aren't paid for it, you either need to have effectively unlimited free time or be someone highly respected already to be able to participate on a meaningful level. If that's not the goal, you need to invest into a) ensuring that you actually do provide a useful environment for outside participants and b) communicating this, i.e. by having a public presence that clearly explains this and doesn't look like it's targeted at impressing middle management. Transparency into what is going on right now is key to this. "Linux Foundation" doesn't scream "community". See also other comments here specifically about Google's input, which reads a lot like "we've thought up some things we're now going to impose on everyone, just open-washed a bit". (Again, this is totally outside image, and not intended as an attack on any individual involved as having done anthing wrong, just trying to communicate what outside impression you are likely dealing with)

lifeisstillgood 6y ago

Put it a different way: Open Source now is in every single walk of life and is only going to become more critical to everyone online, their banking, their healthcare and so on. As such most people would want that software to be governed. Preferably with transparency, right to reply / be heard and have their needs taken into account. It might not have to be bereaucratic, long winded or inefficient, but it will have to be government. And it's going to need to be a government of international needs and concerns. The only good point is we might get to shape it for the next decade while it all starts up www.oss4gov.org/manifesto

bigiain 6y ago

Yeah, I gotta admit I read about Governing Bodies, Working Groups, and Technical Advisory Committees - and instantly pigeonholed this as “for academic tenure track or Big Corp evangelists and subject matter experts only”. Looks way too much like a bunch of suits and the occasional skunkworks greybeard deciding they want to tell open source project maintainers and contributors what to do. Maybe they’ll do some good, it doesn’t sound like a thing I’d ever want to be involved in (you know, unless IBM or Microsoft or whoever offer me a Distinguished Engineer role where I can choose to dabble here at my leisure on their great big firehouse of dimes...)