3 ms·

Still, high profile projects should be able to raise this type of money with ease. If they would say “Would match our ‘donation’ and donate $10 each year that

Still, high profile projects should be able to raise this type of money with ease. If they would say “Would match our ‘donation’ and donate $10 each year that we put in $1k in labor to this project?” that sounds like some commercial users would accept. But the first problem with medium scale OSS like this is that it’s no one’s hobby to manage projects or beg for money. It’s also a problem that OSS contribution/sponsorship isn’t normalized in corporations. I could much easier get permission to buy a $5k piece of software than donate $5 to an OSS project that powers out largest project and has been maintained for 10 years by a single person.

TeMPOraL 3y ago
But why should they raise this money? The unspoken assumption here is that code signing is a good thing. I question this assumption, particularly with how this works today. Microsoft, the cert issuers, and other companies involved in this are trying to create a reality in which software must always be attached to a specific legal entity, and then that entity must be vetted through the "corporate web of trust". That $629 (per year?) isn't paying to access/license a feature. It's a membership fee in that "corporate web of trust". It's a nice way to disempower users and individual developers, while effectively commercializing the entire Open Source space. "Want to have your open source project to have any users (on proprietary OS-es)? You need to start a company and sign a contract with one of our approved business friends."
- alkonaut 3y ago
  As the comments on the issue suggests, $629 is not the minimum price tag. It can be much cheaper without being more complicated. But I agree Microsoft could probably make it easier and cheaper but I can’t see why they would want that given they want to drive apps to stores and not self publishing. They want the bad method of publishing to have bad ergonomics. A letsencrypt style signing process would be possible and would let people base the trust on the ownership of company.com instead of a regular cert. And for most use cases this seems good enough.
  - TeMPOraL 3y ago
    > A letsencrypt style signing process would be possible and would let people base the trust on the ownership of company.com instead of a regular cert. And for most use cases this seems good enough. Except it seems that's not what they want at all. LetsEncrypt works because we've worked out it's sufficient for purposes of HTTPS to attest that "you" own the domain company.com, which is verified by making you do something that can be done only when "you" are in control of what company.com DNS points at. The nature of "you" is immaterial, out of scope - only demonstrating control over a domain matters. This lends itself to automation. What they want to do with code signing is to pin the code to a specific legal entity. That's crossing from data integrity/provenance straight to KYC/legal space - for users to be allowed to run your code, you must become an entity that can be easily served a lawsuit should the need arise. You can't automate that, for the same reason you can't automate renewing your national ID/passport or automate starting a company.
throwawaaarrgh 3y ago
> I could much easier get permission to buy a $5k piece of software than donate $5 to an OSS project that powers out largest project and has been maintained for 10 years by a single person. Because business has it's own logic. If you invest $5k in a product, you are expecting the return to be customer support, quality control, timely bug fixing, "enterprise" features, feature request priority, legal indemnification / due diligence, etc. You make a business case to justify the expense, with the expectation that this is going to provide a return (eventually) in the form of revenue, time/cost savings, etc. Donations in and of themselves don't provide any obvious return. If the project kept a "business case" page that includes what the donation goes to and shows the direct benefits that come from donation, it's much easier to justify the cost. And you might think "can't they just write off the donation?", but the project would need 501(c)(3) status, and it's apparently quite[1] hard[2] to get OSS approved as such. [1] https://web.archive.org/web/20221201141451/https://opensource.org/node/840 https://web.archive.org/web/20221201141451/https://opensourc... [2] https://www.mill.law/blog/more-501c3-rejections-open-source-software-edition https://www.mill.law/blog/more-501c3-rejections-open-source-...
- alkonaut 3y ago
  When the sole OSS maintainer says “I only got $23 in donations last year so I can’t spend as much time on bug fixes this year” that should be a case for donating $25. Especially if the end of maintenance would instantly cost five or six figures. The thing is that it’s hope that you get support for your $25. Not a contract guaranteeing it. In the end the easiest option for me is to donate a $25 personally on my employers behalf and be done with it.

TeMPOraL 3y ago

But why should they raise this money? The unspoken assumption here is that code signing is a good thing. I question this assumption, particularly with how this works today. Microsoft, the cert issuers, and other companies involved in this are trying to create a reality in which software must always be attached to a specific legal entity, and then that entity must be vetted through the "corporate web of trust". That $629 (per year?) isn't paying to access/license a feature. It's a membership fee in that "corporate web of trust". It's a nice way to disempower users and individual developers, while effectively commercializing the entire Open Source space. "Want to have your open source project to have any users (on proprietary OS-es)? You need to start a company and sign a contract with one of our approved business friends."

alkonaut 3y ago
As the comments on the issue suggests, $629 is not the minimum price tag. It can be much cheaper without being more complicated. But I agree Microsoft could probably make it easier and cheaper but I can’t see why they would want that given they want to drive apps to stores and not self publishing. They want the bad method of publishing to have bad ergonomics. A letsencrypt style signing process would be possible and would let people base the trust on the ownership of company.com instead of a regular cert. And for most use cases this seems good enough.
- TeMPOraL 3y ago
  > A letsencrypt style signing process would be possible and would let people base the trust on the ownership of company.com instead of a regular cert. And for most use cases this seems good enough. Except it seems that's not what they want at all. LetsEncrypt works because we've worked out it's sufficient for purposes of HTTPS to attest that "you" own the domain company.com, which is verified by making you do something that can be done only when "you" are in control of what company.com DNS points at. The nature of "you" is immaterial, out of scope - only demonstrating control over a domain matters. This lends itself to automation. What they want to do with code signing is to pin the code to a specific legal entity. That's crossing from data integrity/provenance straight to KYC/legal space - for users to be allowed to run your code, you must become an entity that can be easily served a lawsuit should the need arise. You can't automate that, for the same reason you can't automate renewing your national ID/passport or automate starting a company.

throwawaaarrgh 3y ago

> I could much easier get permission to buy a $5k piece of software than donate $5 to an OSS project that powers out largest project and has been maintained for 10 years by a single person. Because business has it's own logic. If you invest $5k in a product, you are expecting the return to be customer support, quality control, timely bug fixing, "enterprise" features, feature request priority, legal indemnification / due diligence, etc. You make a business case to justify the expense, with the expectation that this is going to provide a return (eventually) in the form of revenue, time/cost savings, etc. Donations in and of themselves don't provide any obvious return. If the project kept a "business case" page that includes what the donation goes to and shows the direct benefits that come from donation, it's much easier to justify the cost. And you might think "can't they just write off the donation?", but the project would need 501(c)(3) status, and it's apparently quite[1] hard[2] to get OSS approved as such. [1] https://web.archive.org/web/20221201141451/https://opensource.org/node/840 https://web.archive.org/web/20221201141451/https://opensourc... [2] https://www.mill.law/blog/more-501c3-rejections-open-source-software-edition https://www.mill.law/blog/more-501c3-rejections-open-source-...

alkonaut 3y ago
When the sole OSS maintainer says “I only got $23 in donations last year so I can’t spend as much time on bug fixes this year” that should be a case for donating $25. Especially if the end of maintenance would instantly cost five or six figures. The thing is that it’s hope that you get support for your $25. Not a contract guaranteeing it. In the end the easiest option for me is to donate a $25 personally on my employers behalf and be done with it.