4 ms·

If it's publicly funded, it should be subject to standard public sector oversight. I don't think open-source wants this.

richardwhiuk 3y ago
Some issues: - Why we would we fund Matrix when XMPP and IRC already exists? - Software developers earn way more than most public sector workers - is this justifiable?
- Arathorn 3y ago
  > Why we would we fund Matrix when XMPP and IRC already exists? Because empirically Matrix is what governments appear to be using - e.g. https://tchap.beta.gouv.fr/ https://tchap.beta.gouv.fr/ for France; https://messenger.bwi.de/bundesmessenger https://messenger.bwi.de/bundesmessenger for Germany; Delta for Ukraine; equivalent for UK & US, etc. Matrix also has a completely different featureset to XMPP or IRC: E2EE by default; conversation history as a first class citizen; HTTPS+JSON APIs by default; E2EE Group VoIP (almost) integrated; etc. > Software developers earn way more than most public sector workers - is this justifiable? This feels like a false dichotomy. The implication is that public sector software developers are paid less than average private sector software developers. This may well be the case in some places - but the answer there is SURELY to pay public sector software developers the average going rate, rather than conclude that funding private sector FOSS maintenance is not justifiable(!)
  - MattJ100 3y ago
    I don't think this is a competition, but to clarify: XMPP has long been used in the public sector (via suppliers such as Isode) since before Matrix was conceived, and continues to be still. I've spoken with multiple organizations for whom the Matrix data model was not a good fit. As you say, they are quite different and each has strengths and weaknesses.
    - Arathorn 3y ago
      Yup - XMPP clearly has a lot of public sector traction too (e.g. in NATO's Federated Mission Networking), and each protocol has its merits. I was just trying to explain that the current "how can Governments better fund Matrix" is borne out of a glut of Governmental Matrix deployments as a WhatsApp/Teams replacement.
      - richardwhiuk 3y ago
        No, it's born out of Element not funding Matrix, and Matrix being desparate for funding.
        neiljohnson 3y ago
        The OP is calling out the need for any large org that depends on a FOSS project to contribute to its maintenance. Currently we don’t have good mechanisms to make this happen. The post uses Matrix as an example but it applies equally to any project deemed as critical infrastructure which would of course include XMPP, IRC and plenty of others. To solve this, FOSS projects must work together to advocate for practical funding mechanisms. This is not a zero sum game.
- avtar 3y ago
  > Why we would we fund Matrix when XMPP and IRC already exists? A common sentiment I’ve come across, here and other corners of the internet, is dismay that more organizations have been adopting closed communication platforms such as Discord and Slack. These platforms (probably Discord more so) make it easier for online communities to be set up and offer relatively polished user experience compared to Matrix, IRC, or XMPP. There was a post shared on HN a few weeks ago by a technical user and their onboarding experience with Matrix https://blog.koehntopp.info/2024/02/13/the-matrix-trashfire.html https://blog.koehntopp.info/2024/02/13/the-matrix-trashfire.... As someone who uses Matrix, I’m hoping they bridge the UX gap sooner than later. XMPP and IRC are even further away from being viable alternatives.
  - Arathorn 3y ago
    Yup. No question that UX is critical for Matrix, and many clients are racing to fix that right now.
  - richardwhiuk 3y ago
    If we funded XMPP, we could fix the UX on XMPP, rather than reinventing the wheel with Matrix
Arathorn 3y ago
I dunno; if an open source project wants to take public sector funding, then some kinds of public sector oversight (e.g. public sector requiring security audits, or SBOMs, etc which they pay for) could be very desirable indeed. If your implication is that the government who's funding it might then try to leverage the project somehow (e.g. insert a backdoor or whatever), then we're back with the original problem of needing to protect FOSS projects from malicious actors wherever they come from. I'd argue that the benefits of actually being funded massively outweigh the risks of the funder going rogue, given you can use the funding to build checks & balances to protect against malicious activity no matter the source.
- bee_rider 3y ago
  IMO we should start an Office of Digital Infrastructure if we want things like software BOM and software oversight. If the government wants secure code they should write the code in a controlled environment. They can run it similarly to an open source project (take pull requests from the general public) but it should be clear that the responsibility lays 100% at their feet. I don’t think most open source projects really inspect their dependencies that well. Lots of these projects are community/hobby things, they should be treated as such.
  - neiljohnson 3y ago
    I found this post to be interesting discussion on how a not profit organisation could practically operate to support FOSS maintenance. It still has risks surrounding infiltration by bad actors, but mitigation is easier since staffers are paid. https://www.tbray.org/ongoing/When/202x/2024/04/01/OSQI https://www.tbray.org/ongoing/When/202x/2024/04/01/OSQI
bee_rider 3y ago
Just a sidenote: some publicly funded code is produced as a side-effect of the government funding scientific research. The government is buying the research, not the code, so it should not have oversight on the coding process except inasmuch as it impacts the research. This could require open sourcing, but there ought not be an expectation that the code is particularly bulletproof. IMO we should have an organization to produce publicly funded code (boring infrastructure stuff not R&D), but it should be neither achieved by co-opting existing community projects nor cannibalizing research projects. It should be a new thing. Making an analogy to physical infrastructure: it would be crazy if we relied on groups of hobbyists to build a bridge, or if we just grabbed a bridge directly out of somebody’s PhD in civil engineering. (I mean the analogy looks ridiculous because the situation is!)
- Arathorn 3y ago
  > Making an analogy to physical infrastructure: it would be crazy if we relied on groups of hobbyists to build a bridge, or if we just grabbed a bridge directly out of somebody’s PhD in civil engineering. Except this is precisely what is happening… because it turns out the engineering hobbyists often build useful things. At which point, if the government goes and uses it as the foundations of a publicly constructed bridge, it might make sense for the government to invest a bit in ensuring the foundations are maintained.
  - richardwhiuk 3y ago
    If we required that government invested in open-source to use it, the only thing that would happen is that projects would be outsourced to the private sector (either explicitly by the government tendoring, or implicitly by the government offering tax incentives to build the project), and the private sector wouldn't fund it.
  - nitia 3y ago
    > Except this is precisely what is happening… So Arathorn, pray tell, when will you be fixing the well-documented, years old bugs in the matrix-bifrost?

richardwhiuk 3y ago

Some issues: - Why we would we fund Matrix when XMPP and IRC already exists? - Software developers earn way more than most public sector workers - is this justifiable?

Arathorn 3y ago
> Why we would we fund Matrix when XMPP and IRC already exists? Because empirically Matrix is what governments appear to be using - e.g. https://tchap.beta.gouv.fr/ https://tchap.beta.gouv.fr/ for France; https://messenger.bwi.de/bundesmessenger https://messenger.bwi.de/bundesmessenger for Germany; Delta for Ukraine; equivalent for UK & US, etc. Matrix also has a completely different featureset to XMPP or IRC: E2EE by default; conversation history as a first class citizen; HTTPS+JSON APIs by default; E2EE Group VoIP (almost) integrated; etc. > Software developers earn way more than most public sector workers - is this justifiable? This feels like a false dichotomy. The implication is that public sector software developers are paid less than average private sector software developers. This may well be the case in some places - but the answer there is SURELY to pay public sector software developers the average going rate, rather than conclude that funding private sector FOSS maintenance is not justifiable(!)
- MattJ100 3y ago
  I don't think this is a competition, but to clarify: XMPP has long been used in the public sector (via suppliers such as Isode) since before Matrix was conceived, and continues to be still. I've spoken with multiple organizations for whom the Matrix data model was not a good fit. As you say, they are quite different and each has strengths and weaknesses.
  - Arathorn 3y ago
    Yup - XMPP clearly has a lot of public sector traction too (e.g. in NATO's Federated Mission Networking), and each protocol has its merits. I was just trying to explain that the current "how can Governments better fund Matrix" is borne out of a glut of Governmental Matrix deployments as a WhatsApp/Teams replacement.
    - richardwhiuk 3y ago
      No, it's born out of Element not funding Matrix, and Matrix being desparate for funding.
      - neiljohnson 3y ago
        The OP is calling out the need for any large org that depends on a FOSS project to contribute to its maintenance. Currently we don’t have good mechanisms to make this happen. The post uses Matrix as an example but it applies equally to any project deemed as critical infrastructure which would of course include XMPP, IRC and plenty of others. To solve this, FOSS projects must work together to advocate for practical funding mechanisms. This is not a zero sum game.
avtar 3y ago
> Why we would we fund Matrix when XMPP and IRC already exists? A common sentiment I’ve come across, here and other corners of the internet, is dismay that more organizations have been adopting closed communication platforms such as Discord and Slack. These platforms (probably Discord more so) make it easier for online communities to be set up and offer relatively polished user experience compared to Matrix, IRC, or XMPP. There was a post shared on HN a few weeks ago by a technical user and their onboarding experience with Matrix https://blog.koehntopp.info/2024/02/13/the-matrix-trashfire.html https://blog.koehntopp.info/2024/02/13/the-matrix-trashfire.... As someone who uses Matrix, I’m hoping they bridge the UX gap sooner than later. XMPP and IRC are even further away from being viable alternatives.
- Arathorn 3y ago
  Yup. No question that UX is critical for Matrix, and many clients are racing to fix that right now.
- richardwhiuk 3y ago
  If we funded XMPP, we could fix the UX on XMPP, rather than reinventing the wheel with Matrix

Arathorn 3y ago

I dunno; if an open source project wants to take public sector funding, then some kinds of public sector oversight (e.g. public sector requiring security audits, or SBOMs, etc which they pay for) could be very desirable indeed. If your implication is that the government who's funding it might then try to leverage the project somehow (e.g. insert a backdoor or whatever), then we're back with the original problem of needing to protect FOSS projects from malicious actors wherever they come from. I'd argue that the benefits of actually being funded massively outweigh the risks of the funder going rogue, given you can use the funding to build checks & balances to protect against malicious activity no matter the source.

bee_rider 3y ago
IMO we should start an Office of Digital Infrastructure if we want things like software BOM and software oversight. If the government wants secure code they should write the code in a controlled environment. They can run it similarly to an open source project (take pull requests from the general public) but it should be clear that the responsibility lays 100% at their feet. I don’t think most open source projects really inspect their dependencies that well. Lots of these projects are community/hobby things, they should be treated as such.
- neiljohnson 3y ago
  I found this post to be interesting discussion on how a not profit organisation could practically operate to support FOSS maintenance. It still has risks surrounding infiltration by bad actors, but mitigation is easier since staffers are paid. https://www.tbray.org/ongoing/When/202x/2024/04/01/OSQI https://www.tbray.org/ongoing/When/202x/2024/04/01/OSQI

bee_rider 3y ago

Just a sidenote: some publicly funded code is produced as a side-effect of the government funding scientific research. The government is buying the research, not the code, so it should not have oversight on the coding process except inasmuch as it impacts the research. This could require open sourcing, but there ought not be an expectation that the code is particularly bulletproof. IMO we should have an organization to produce publicly funded code (boring infrastructure stuff not R&D), but it should be neither achieved by co-opting existing community projects nor cannibalizing research projects. It should be a new thing. Making an analogy to physical infrastructure: it would be crazy if we relied on groups of hobbyists to build a bridge, or if we just grabbed a bridge directly out of somebody’s PhD in civil engineering. (I mean the analogy looks ridiculous because the situation is!)

Arathorn 3y ago
> Making an analogy to physical infrastructure: it would be crazy if we relied on groups of hobbyists to build a bridge, or if we just grabbed a bridge directly out of somebody’s PhD in civil engineering. Except this is precisely what is happening… because it turns out the engineering hobbyists often build useful things. At which point, if the government goes and uses it as the foundations of a publicly constructed bridge, it might make sense for the government to invest a bit in ensuring the foundations are maintained.
- richardwhiuk 3y ago
  If we required that government invested in open-source to use it, the only thing that would happen is that projects would be outsourced to the private sector (either explicitly by the government tendoring, or implicitly by the government offering tax incentives to build the project), and the private sector wouldn't fund it.
- nitia 3y ago
  > Except this is precisely what is happening… So Arathorn, pray tell, when will you be fixing the well-documented, years old bugs in the matrix-bifrost?