4 ms·

> It's for open source maintainers, by open source maintainers. > Google > Red Hat (IBM) Marketing in this manner is deceptive. Saying it’s “by and for” open

> It's for open source maintainers, by open source maintainers. > Google > Red Hat (IBM) Marketing in this manner is deceptive. Saying it’s “by and for” open source maintainers gives the impression this is a grass roots effort, when in reality this is a corporate initiative.

aeturnum 5y ago
There are still independent developers who contribute to passion projects in their spare time, of course, but if you've been using open source software because you believe corporations aren't substantial contributors I think you should update your priors.
- CyberRabbi 5y ago
  So you think their grassroots marketing is appropriate?
  - aeturnum 5y ago
    I don't think saying something is built "by and for open source maintainers" is implying it's a grassroots project. All it means is that it's designed with the intent of supporting the integration of patches from members of the public, which has very little to do with it being run by a corporation or unpaid individuals.
    - CyberRabbi 5y ago
      > which has very little to do with it being run by a corporation On what basis can you say that? It’s clear that a corporation that accepts legal liability for the software they run in production or ship would have a strong incentive to create a process around determining the origin of said software.
      - deleted 5y ago
        [deleted]
      - aeturnum 5y ago
        I feel like everyone who runs software has a strong incentive to determine the origin of it? Do you not feel that way? It's true that different open source projects care about different things (and some may genuinely not care about who contributes), but there are plenty of prominent open source software projects (the linux kernel, various programming languages, apache, etc) who deal with people who would like to submit vulnerabilities or simply cannot code well enough to avoid problems. It seems like all projects would like to avoid those outcomes, even if their legal situation is different, and providing a verifiable certificate chain could be a method of achieving that (either in contributions or in distribution).
        CyberRabbi 5y ago
        > I feel like everyone who runs software has a strong incentive to determine the origin of it? Do you not feel that way? Strong incentive no. In fact, most volunteer open source developers release their software with no legal liability at all (cf. MIT license).
        aeturnum 5y ago
        I guess I was thinking incentive beyond the legal - like, people often do things because they have desires outside of the legal code. For example - even though the GPL contains, to the extent legally possible, an "as-is" clause like the MIT liscence, it's extremely common for GPL projects to publish information (ex: hashes, known good package repos, etc) that help people ensure they've gotten the software they expect. Sigstore seems like it's driving towards the same goal.
jacques_chester 5y ago
They are still open source maintainers, regardless of who they do or don't work for.
- CyberRabbi 5y ago
  Sure, perhaps. Maybe I’m wrong but maintainer gives the impression of a volunteer.
  - atonse 5y ago
    If they are doing this as a side project I’d be more hesitant to adopt it. The fact that it’s backed by an entity that is more eternal is actually a plus. Any concerns about bait and switch profit are addressed in the OSS license they pick. I haven’t looked at the license but I’d hope it’s permissive (Apache, MIT, etc) otherwise, wouldn’t touch it.
kook_throwaway 5y ago
I seem to recall something on HN a few months back where google wanted to require full names for FOSS code, but can't find it now. (If anyone remembers that I'd appreciate a link.) This smells like it's trying to do the same thing and let google try to attain the control over the foss ecosystem that it has over the web.
- decodebytes 5y ago
  One of the founders here, this is completely untrue. It's a project funded under the Linux Foundation and the service will be completely run by the Linux Foundation, the exact same mode as used for Let's Encrypt.
  - kook_throwaway 5y ago
    Thanks for the reply. I'm (hopefully understandably) pretty skeptical of anything google puts their name on nowadays. That said, my speculations were about Google's intentions (not sigstore's) and if you think they are "completely untrue" then you are being misled and should potentially reevaluate the entire project. Banning anonymous and pseudonymous contributors and requiring real names be provided to a trusted party is an explicitly stated goal of Google's[1] and one of the reasons they contribute to the sigstore project in the first place[2]. If I was going to try to make that happen, sigstore is a great way to lay down the infrastructure to implement something like that at a later point. Additionally, anything that will centralize FOSS development (as being a root signing key for software would do) is probably not in it's best interests long term, because at that point the difference between a good and bad actor is a matter of policy and not a technical question. I believe that you have the best of intentions, but others involved in the project clearly don't. [1] https://security.googleblog.com/2021/02/know-prevent-fix-framework-for-shifting.html https://security.googleblog.com/2021/02/know-prevent-fix-fra... [2] https://news.ycombinator.com/item?id=26603661 https://news.ycombinator.com/item?id=26603661
    - decodebytes 5y ago
      Perhaps this this will put you at rest a little. The project was founded in Red Hat along Purdue University (Santiago, part of Arch Linux security team) and Google joined via GOST (The google open source security team). GOST are funded to help improve Open Source Security, they are not there to create products (they are the team that are funding the rust module work in the linux kernel). They were happy to join sigstore as Red Hat were already there first as stewards of it being open source / community centric. I also know Dan Lorenc who heads up the team and he is a great guy and very knowledgable about FOSS and Open Source. If there were any evil intent, I am telling you know, I would be kicking up a storm. Sorry about the "completely untrue" statement, that was not helpful. It's just we face so much unneeded FUD all the time.
webmobdev 5y ago
Thanks for pointing this out - seems like another step by corporates towards stepping up control over open source software. I'd rather have someone like the Free Software Foundation and EFF to be in charge of these kinds of things.
- CyberRabbi 5y ago
  Imagine having to register with a certificate authority run by Google just to submit a patch.
  - atonse 5y ago
    Except nowhere is this even implied. The legal entity here is the Linux Foundation. As they’ve said, this seems like LetsEncrypt for software signing. I found out about this project 30 mins ago and honestly it sounds great. it would be awesome for us to roll this out even for our internal libraries.
    - deleted 5y ago
      [deleted]
    - CyberRabbi 5y ago
      Okay allow me to revise my comment: Imagine having to register with a certificate authority run by the Linux Foundation just to submit a patch.
decodebytes 5y ago
It's under the Linux Foundation, a non profit org and you also missed the third founder Purdue University for whatever reason. We also have community members from NYU, Arch Linux, Debian an Alpine Linux (plus folks from the rust community, python etc). Red Hat and Google helps to show that money will be behind running the service (funded through the Linux Foundation) This is the same set up with Let's Encrypt . Linux Foundation > ISRG > Let's Encrypt with money funded by corporate sponsors. Money needs to come from somewhere when you run a critical service.

aeturnum 5y ago

There are still independent developers who contribute to passion projects in their spare time, of course, but if you've been using open source software because you believe corporations aren't substantial contributors I think you should update your priors.

CyberRabbi 5y ago
So you think their grassroots marketing is appropriate?
- aeturnum 5y ago
  I don't think saying something is built "by and for open source maintainers" is implying it's a grassroots project. All it means is that it's designed with the intent of supporting the integration of patches from members of the public, which has very little to do with it being run by a corporation or unpaid individuals.
  - CyberRabbi 5y ago
    > which has very little to do with it being run by a corporation On what basis can you say that? It’s clear that a corporation that accepts legal liability for the software they run in production or ship would have a strong incentive to create a process around determining the origin of said software.
    - deleted 5y ago
      [deleted]
    - aeturnum 5y ago
      I feel like everyone who runs software has a strong incentive to determine the origin of it? Do you not feel that way? It's true that different open source projects care about different things (and some may genuinely not care about who contributes), but there are plenty of prominent open source software projects (the linux kernel, various programming languages, apache, etc) who deal with people who would like to submit vulnerabilities or simply cannot code well enough to avoid problems. It seems like all projects would like to avoid those outcomes, even if their legal situation is different, and providing a verifiable certificate chain could be a method of achieving that (either in contributions or in distribution).
      - CyberRabbi 5y ago
        > I feel like everyone who runs software has a strong incentive to determine the origin of it? Do you not feel that way? Strong incentive no. In fact, most volunteer open source developers release their software with no legal liability at all (cf. MIT license).
        aeturnum 5y ago
        I guess I was thinking incentive beyond the legal - like, people often do things because they have desires outside of the legal code. For example - even though the GPL contains, to the extent legally possible, an "as-is" clause like the MIT liscence, it's extremely common for GPL projects to publish information (ex: hashes, known good package repos, etc) that help people ensure they've gotten the software they expect. Sigstore seems like it's driving towards the same goal.

jacques_chester 5y ago

They are still open source maintainers, regardless of who they do or don't work for.

CyberRabbi 5y ago
Sure, perhaps. Maybe I’m wrong but maintainer gives the impression of a volunteer.
- atonse 5y ago
  If they are doing this as a side project I’d be more hesitant to adopt it. The fact that it’s backed by an entity that is more eternal is actually a plus. Any concerns about bait and switch profit are addressed in the OSS license they pick. I haven’t looked at the license but I’d hope it’s permissive (Apache, MIT, etc) otherwise, wouldn’t touch it.

kook_throwaway 5y ago

I seem to recall something on HN a few months back where google wanted to require full names for FOSS code, but can't find it now. (If anyone remembers that I'd appreciate a link.) This smells like it's trying to do the same thing and let google try to attain the control over the foss ecosystem that it has over the web.

decodebytes 5y ago
One of the founders here, this is completely untrue. It's a project funded under the Linux Foundation and the service will be completely run by the Linux Foundation, the exact same mode as used for Let's Encrypt.
- kook_throwaway 5y ago
  Thanks for the reply. I'm (hopefully understandably) pretty skeptical of anything google puts their name on nowadays. That said, my speculations were about Google's intentions (not sigstore's) and if you think they are "completely untrue" then you are being misled and should potentially reevaluate the entire project. Banning anonymous and pseudonymous contributors and requiring real names be provided to a trusted party is an explicitly stated goal of Google's[1] and one of the reasons they contribute to the sigstore project in the first place[2]. If I was going to try to make that happen, sigstore is a great way to lay down the infrastructure to implement something like that at a later point. Additionally, anything that will centralize FOSS development (as being a root signing key for software would do) is probably not in it's best interests long term, because at that point the difference between a good and bad actor is a matter of policy and not a technical question. I believe that you have the best of intentions, but others involved in the project clearly don't. [1] https://security.googleblog.com/2021/02/know-prevent-fix-framework-for-shifting.html https://security.googleblog.com/2021/02/know-prevent-fix-fra... [2] https://news.ycombinator.com/item?id=26603661 https://news.ycombinator.com/item?id=26603661
  - decodebytes 5y ago
    Perhaps this this will put you at rest a little. The project was founded in Red Hat along Purdue University (Santiago, part of Arch Linux security team) and Google joined via GOST (The google open source security team). GOST are funded to help improve Open Source Security, they are not there to create products (they are the team that are funding the rust module work in the linux kernel). They were happy to join sigstore as Red Hat were already there first as stewards of it being open source / community centric. I also know Dan Lorenc who heads up the team and he is a great guy and very knowledgable about FOSS and Open Source. If there were any evil intent, I am telling you know, I would be kicking up a storm. Sorry about the "completely untrue" statement, that was not helpful. It's just we face so much unneeded FUD all the time.

webmobdev 5y ago

Thanks for pointing this out - seems like another step by corporates towards stepping up control over open source software. I'd rather have someone like the Free Software Foundation and EFF to be in charge of these kinds of things.

CyberRabbi 5y ago
Imagine having to register with a certificate authority run by Google just to submit a patch.
- atonse 5y ago
  Except nowhere is this even implied. The legal entity here is the Linux Foundation. As they’ve said, this seems like LetsEncrypt for software signing. I found out about this project 30 mins ago and honestly it sounds great. it would be awesome for us to roll this out even for our internal libraries.
  - deleted 5y ago
    [deleted]
  - CyberRabbi 5y ago
    Okay allow me to revise my comment: Imagine having to register with a certificate authority run by the Linux Foundation just to submit a patch.

decodebytes 5y ago

It's under the Linux Foundation, a non profit org and you also missed the third founder Purdue University for whatever reason. We also have community members from NYU, Arch Linux, Debian an Alpine Linux (plus folks from the rust community, python etc). Red Hat and Google helps to show that money will be behind running the service (funded through the Linux Foundation) This is the same set up with Let's Encrypt . Linux Foundation > ISRG > Let's Encrypt with money funded by corporate sponsors. Money needs to come from somewhere when you run a critical service.