3 ms·
JM Keynes said: “A ‘sound’ banker, alas, is not one who sees danger and avoids it, but one who, when he is ruined, is ruined in a conventional and orthodox way
by joe_the_user 5y ago
JM Keynes said: “A ‘sound’ banker, alas, is not one who sees danger and avoids it, but one who, when he is ruined, is ruined in a conventional and orthodox way along with his fellows, so that no one can really blame him.” and same applies to software managers.
We're had lots of nasty security breaches lately. These breaches overall have nothing directly to do with free software but it's pretty easy to see what they have in common.
Security breaches grow like hardy weeds on the ground of "I don't have to face the consequences of bad security, my customers do". The Solar Winds and Log4j breach/hole came from wildly different software types but each had the quality of paying for security at the rate that it might harm you, not at the rate it might do harm in general. And comes because security is inherently expensive - since "security is a process, not feature", done right costs the entire organization time and money rather than simply involving a purchase.
Which to say: "Everyone is mad there’s no money in writing free/os software, but if there was money it wouldn’t be free/os software. It would just be like what we do at our day jobs." seems totally incorrect.
QT makes money selling open source software. Red Hat makes money selling open source soft. If there was a market for tightly secure, verified open source software, people would be working writing (and especially testing) that. But companies whatever crap onto their machines, whether barely maintained java or dubious closed source stuff.
- jaredklewis 5y agoI see what you're saying, but just to be clear I'm using "free" here in the very idiosyncratic way the article does. Things like Red Hat, GitLab, or MongoDB from a license perspective are free/open source. But these types of projects are a totally different beast than "real" (for lack of a better word) open source projects like the linux kernel, emacs, ruby on rails, or lucene.
- joe_the_user 5y ago1) Most people doing open source don't share the author's definition so this discussion winds-up not being about their 2) Tremendous effort and money goes into making the Linux Kernel secure. The fact that you fail to draw a good line between paid open source and "real" open open is indication that this idiosyncratic definition is fallacious and disingenuous. 3) Which brings me back to what I think the real, reasonable line is. The line is between cheap software, software that involves the minimal effort to squeeze out a feature and a full, carefully secured software process. Open source is virtually irrelevant. If some people didn't volunteer to produce free apps that got duplicated everywhere, you'd have a low-paid smuck doing somewhere, probably producing worse quality. Oppositely, highly secure software should be open source or source-available - the eyes the better. Linux, notably, benefits from many, many people testing it and that benefits the very heavy users of Linux who do employ people developing it. good quality software where people pay for the quality.
- jaredklewis 5y agoI think your points are fine, just orthogonal to the article.