5 ms·

Coming soon to kill your open source project: a current chain of custody and audit certificate that all corporations will require in your repo (along with that

Coming soon to kill your open source project: a current chain of custody and audit certificate that all corporations will require in your repo (along with that MIT license!). Too expensive for you to procure because this is a hobby side project? Don't worry, some other company will fork it and take control--most companies would rather have an OSS library from some other corporation than github.com/fortnitedude anyways. Thank you for your OSS contribution, we'll take it from here.

animal_spirits 5y ago
I'd rather have a maintained and secure fork of some library from a corporation than an unmaintained and deteriorating library from someone who can't afford to upkeep it.
- sam_lowry_ 5y ago
  You'll have the worst of both worlds.
  - animal_spirits 5y ago
    Can you explain?
    - pvarangot 5y ago
      Not OP but they probably mean you don't get the competitive advantage of owning your own purpose specific codebase, but your library also doesn't have an agile community that's working on it "for free".
    - teddyh 5y ago
      What you’ll have is an unmaintained insecure fork held in place by a company who doesn’t have to do any maintenance, since they, and their code, are declared “secure” by fiat.
      - animal_spirits 5y ago
        I don't see how that's any different than where we started from? Google can't just take over an open source library and declare no one can work on it any more.
        teddyh 5y ago
        If it’s MIT or otherwise permissively licensed, they absolutely can take it over by forking, putting enough work into it that it’s not worth continuing the original version, and then not releasing it openly, or with complicated entanglements. If it’s GPL or similar, the process is slower. They will probably immediately start a grand redesign which will, incidentally, not use the GPL library. In the short run, they will start a replacement implementation of the GPL library, incidentally permissively licensed. Both will take time, but usually gets there. Both of these cases are seen all the time.
- buscoquadnary 5y ago
  Or they charge you to upgrade to the latest version and then lock you out of the software if you aren't up to date because it isn't secure. That could happen to.
  - animal_spirits 5y ago
    If it is open source then we can just fork off of the last free version. Lets at least take advantage of the corporations who also want successfully maintained software.
    - heavyset_go 5y ago
      Corporations don't have to maintain open source software under open source licenses if, for example, that software was released under MIT or BSD licenses. They could very well take an project with an MIT license and make it proprietary, and there won't be any free versions to fork from.
      - dragonwriter 5y ago
        > Corporations don't have to maintain open source software under open source licenses if, for example, that software was released under MIT or BSD licenses. If they own the copyright and control the only source code available, they can change the license regardless of whether it is permissive or copyleft currently. If they do only the second, they can shut down the repo regardless of the license, even if they don't change the license, and unless it's something like AGPL continue internal use. If they don't control the only archive of source code, then even if they can change the license going forward, other people can continue to distribute and fork off from the last Free version (again, irrespective of whether permissive or restrictive.) Unless they both own the copyright and have the legal power to retract the license offer for the earlier code (contrary to the usual express terms of license grants, which may be possible if it is a gratuitous license, but even if it is may not be fully effective in all cases because of promissory estoppel.)
  - nolok 5y ago
    Does the license permit it ? If yes then they're not doing anything that the author didn't want them to do.
- smasher164 5y ago
  > can't afford to upkeep it Address the cause, not the symptom. Make it so these individuals are more capable of upkeeping their projects. Otherwise, over the long term, you'll end up with projects disincentivized to do the maintenance, leading to a weaker open-source community.
buscoquadnary 5y ago
I am really worried that this is where the focus around "security" is going to end up leading, and in so doing kill the spirit of hacking around. Kill any competitor or software startup by requiring a long checklist of "security" items before any software can be sold, or used. And most of it will be security theater that looks good but does little to actually support secure computing because at the end of the day Bob is going to plug in a USB that Mallory drops in the parking lot that says "XXX Pics".
- heavyset_go 5y ago
  Agreed. Most of the "security" I see coming out of these companies serves to secure their own revenue streams, and then it's pitched to users as existing for their own benefit.
- voakbasda 5y ago
  Yup, regulatory capture is coming for your software.
Grismar 5y ago
Which is it: you want them to use the software or not? What do you care if it carries the added label? If they secure your software, stick a label on it and you get to add their changes back to your project if you like them, what's the problem? Normal open source process, in a good way - or do you want open source to be open, but just to people you like? The only thing you might complain about is the already existing problem that it's damn hard to get paid for writing good open source software, unless you work for a business like these - this doesn't really make that worse though, or at least not for the wrong reasons.
- Grismar 5y ago
  (unless your problem was with someone sticking an MIT license on it in the first place, but that's hardly Google's fault in this case?)
tw04 5y ago
> Coming soon to kill your open source project: a current chain of custody and audit certificate that all corporations will require in your repo (along with that MIT license!). Why would that kill your project? Presumably you’re maintaining it for your own use if it’s a hobby project. Who cares if some for-profit company who wasn’t contributing code or financial support doesn’t use it?
lapsedacademic 5y ago
Honestly, sounds amazing. If I have code where that isn't literally free labor for my business/project, I'll keep it closed source. If I have code where that's free labor but also competes with or commodifies my business/project, I'll keep it closed source or use GPL. This sort of boils down to "only use MIT if you really mean it", right?
- MangoCoffee 5y ago
  IBM botched RedHat/CentOS, i won't trust a for profit corporation on open source software
  - lapsedacademic 5y ago
    So don't merge their forks?
heavyset_go 5y ago
> Coming soon to kill your open source project: a current chain of custody and audit certificate that all corporations will require in your repo (along with that MIT license!). For anyone that thinks this is hyperbole, this is already close to the current standard for shipping any executable to Windows or macOS machines today. If you want your app to run on either operating system, you first must buy certificates every year and sign your apps with them, and then you must remain in good standing with Microsoft or Apple if you don't want those certificates revoked or if you want them to be renewed.
deleted 5y ago
[deleted]
coliveira 5y ago
It is already like that for closed OSs: Mac and iOS have required "signed" binaries for years now, which force the developer to register with Apple, use Apple hardware, and pay an annual fee. Similarly for Android. And Windows is on the same track.
SkyMarshal 5y ago
> most companies would rather have an OSS library from some other corporation than github.com/fortnitedude anyways. I think any project that's not a hobby project and is responsible for providing a quality, reasonably secure product to paying customers would prefer this. Be it a mega-evil-corp or a scrappy startup or anything in between. But if you're a founder of such an open-source project that is getting interest from big companies, that sounds like an opportunity to get funding and turn your hobby project into a startup. Pretty sure most of those mega-evil-corps and scrappy startups would rather pay the project founder and originator than some fork.

animal_spirits 5y ago

I'd rather have a maintained and secure fork of some library from a corporation than an unmaintained and deteriorating library from someone who can't afford to upkeep it.

sam_lowry_ 5y ago
You'll have the worst of both worlds.
- animal_spirits 5y ago
  Can you explain?
  - pvarangot 5y ago
    Not OP but they probably mean you don't get the competitive advantage of owning your own purpose specific codebase, but your library also doesn't have an agile community that's working on it "for free".
  - teddyh 5y ago
    What you’ll have is an unmaintained insecure fork held in place by a company who doesn’t have to do any maintenance, since they, and their code, are declared “secure” by fiat.
    - animal_spirits 5y ago
      I don't see how that's any different than where we started from? Google can't just take over an open source library and declare no one can work on it any more.
      - teddyh 5y ago
        If it’s MIT or otherwise permissively licensed, they absolutely can take it over by forking, putting enough work into it that it’s not worth continuing the original version, and then not releasing it openly, or with complicated entanglements. If it’s GPL or similar, the process is slower. They will probably immediately start a grand redesign which will, incidentally, not use the GPL library. In the short run, they will start a replacement implementation of the GPL library, incidentally permissively licensed. Both will take time, but usually gets there. Both of these cases are seen all the time.
buscoquadnary 5y ago
Or they charge you to upgrade to the latest version and then lock you out of the software if you aren't up to date because it isn't secure. That could happen to.
- animal_spirits 5y ago
  If it is open source then we can just fork off of the last free version. Lets at least take advantage of the corporations who also want successfully maintained software.
  - heavyset_go 5y ago
    Corporations don't have to maintain open source software under open source licenses if, for example, that software was released under MIT or BSD licenses. They could very well take an project with an MIT license and make it proprietary, and there won't be any free versions to fork from.
    - dragonwriter 5y ago
      > Corporations don't have to maintain open source software under open source licenses if, for example, that software was released under MIT or BSD licenses. If they own the copyright and control the only source code available, they can change the license regardless of whether it is permissive or copyleft currently. If they do only the second, they can shut down the repo regardless of the license, even if they don't change the license, and unless it's something like AGPL continue internal use. If they don't control the only archive of source code, then even if they can change the license going forward, other people can continue to distribute and fork off from the last Free version (again, irrespective of whether permissive or restrictive.) Unless they both own the copyright and have the legal power to retract the license offer for the earlier code (contrary to the usual express terms of license grants, which may be possible if it is a gratuitous license, but even if it is may not be fully effective in all cases because of promissory estoppel.)
- nolok 5y ago
  Does the license permit it ? If yes then they're not doing anything that the author didn't want them to do.
smasher164 5y ago
> can't afford to upkeep it Address the cause, not the symptom. Make it so these individuals are more capable of upkeeping their projects. Otherwise, over the long term, you'll end up with projects disincentivized to do the maintenance, leading to a weaker open-source community.

buscoquadnary 5y ago

I am really worried that this is where the focus around "security" is going to end up leading, and in so doing kill the spirit of hacking around. Kill any competitor or software startup by requiring a long checklist of "security" items before any software can be sold, or used. And most of it will be security theater that looks good but does little to actually support secure computing because at the end of the day Bob is going to plug in a USB that Mallory drops in the parking lot that says "XXX Pics".

heavyset_go 5y ago
Agreed. Most of the "security" I see coming out of these companies serves to secure their own revenue streams, and then it's pitched to users as existing for their own benefit.
voakbasda 5y ago
Yup, regulatory capture is coming for your software.

Grismar 5y ago

Which is it: you want them to use the software or not? What do you care if it carries the added label? If they secure your software, stick a label on it and you get to add their changes back to your project if you like them, what's the problem? Normal open source process, in a good way - or do you want open source to be open, but just to people you like? The only thing you might complain about is the already existing problem that it's damn hard to get paid for writing good open source software, unless you work for a business like these - this doesn't really make that worse though, or at least not for the wrong reasons.

Grismar 5y ago
(unless your problem was with someone sticking an MIT license on it in the first place, but that's hardly Google's fault in this case?)

tw04 5y ago

> Coming soon to kill your open source project: a current chain of custody and audit certificate that all corporations will require in your repo (along with that MIT license!). Why would that kill your project? Presumably you’re maintaining it for your own use if it’s a hobby project. Who cares if some for-profit company who wasn’t contributing code or financial support doesn’t use it?

lapsedacademic 5y ago

Honestly, sounds amazing. If I have code where that isn't literally free labor for my business/project, I'll keep it closed source. If I have code where that's free labor but also competes with or commodifies my business/project, I'll keep it closed source or use GPL. This sort of boils down to "only use MIT if you really mean it", right?

MangoCoffee 5y ago
IBM botched RedHat/CentOS, i won't trust a for profit corporation on open source software
- lapsedacademic 5y ago
  So don't merge their forks?

heavyset_go 5y ago

> Coming soon to kill your open source project: a current chain of custody and audit certificate that all corporations will require in your repo (along with that MIT license!). For anyone that thinks this is hyperbole, this is already close to the current standard for shipping any executable to Windows or macOS machines today. If you want your app to run on either operating system, you first must buy certificates every year and sign your apps with them, and then you must remain in good standing with Microsoft or Apple if you don't want those certificates revoked or if you want them to be renewed.

deleted 5y ago

[deleted]

coliveira 5y ago

It is already like that for closed OSs: Mac and iOS have required "signed" binaries for years now, which force the developer to register with Apple, use Apple hardware, and pay an annual fee. Similarly for Android. And Windows is on the same track.

SkyMarshal 5y ago

> most companies would rather have an OSS library from some other corporation than github.com/fortnitedude anyways. I think any project that's not a hobby project and is responsible for providing a quality, reasonably secure product to paying customers would prefer this. Be it a mega-evil-corp or a scrappy startup or anything in between. But if you're a founder of such an open-source project that is getting interest from big companies, that sounds like an opportunity to get funding and turn your hobby project into a startup. Pretty sure most of those mega-evil-corps and scrappy startups would rather pay the project founder and originator than some fork.