4 ms·

Thanks that the OSS value is $12 trillion, but only packagers, security experts and SaaS companies get any of that. Rebuilt to Last? It is a Google project, so

Thanks that the OSS value is $12 trillion, but only packagers, security experts and SaaS companies get any of that. Rebuilt to Last? It is a Google project, so I give it two years.

esafak 1y ago
1. That is two years better than nothing. 2. It will likely be well architected. 3. It is open source, so others can fork it when Google abandons it. https://github.com/google/oss-rebuild https://github.com/google/oss-rebuild
- gostsamo 1y ago
  > 1. That is two years better than nothing. This means two migrations in two years.
ezekg 1y ago
There are some initiatives to help change that: https://osspledge.com https://osspledge.com
- blitzar 1y ago
  Once there are as many private jets available for open source devs as there are for google employees then we are making progress.
  - ezekg 1y ago
    I think that's the wrong way to frame it. OSS is not meant to make you rich, and expecting that is going to bring more pain than joy. However, I do think businesses should use their success to fund their dependencies in a way that makes sense for them.
    - pessimizer 1y ago
      > businesses should use their success to fund their dependencies in a way that makes sense for them. They already do, and always have. It doesn't make any sense to most of them to fund their OSS dependencies at all, because they're available for free. They should do more than what makes sense for them, and they should have to pay professional consequences if they don't. Programmers should have enough unity to bring pressure against companies that make a lot of money from software they don't pay for. Or rather, should have had, because LLMs have changed anything.
chubot 1y ago
At first I thought this might be promising, given without burden on upstream maintainers Then I see This is not an officially supported Google product on https://github.com/google/oss-rebuild https://github.com/google/oss-rebuild And then I also see oss-rebuild uses a public Cloud KMS key to validate attestation signatures. Anonymous authentication is not supported so an ADC credential must be present. $ gcloud init $ gcloud auth application-default login I would not use this with a dependency on Google Cloud, or the gcloud command line tool. Mainly because Google has horrible customer support. It would be more interesting if they came up with something hosted on third party infrastructure. Last I heard, Google Cloud is run by Oracle executives --- e.g. in particular the Unisuper incident led me to believe that a lot of operational stuff is being outsourced, and is of poor quality UniSuper members go a week with no account access after Google Cloud misconfig https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=unisuper&sort=byPopularity&type=story https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu... Google accidentally deleted a $125 billion pension fund's account https://qz.com/google-cloud-pension-fund-unisuper-1851472990 https://qz.com/google-cloud-pension-fund-unisuper-1851472990 I would not say this is unrelated, because operations in the underlying cloud can be a weak link in security Although I'd certainly be interested in an argument otherwise

Thanks that the OSS value is $12 trillion, but only packagers, security experts and SaaS companies get any of that. Rebuilt to Last? It is a Google project, so I give it two years.

esafak 1y ago

1. That is two years better than nothing. 2. It will likely be well architected. 3. It is open source, so others can fork it when Google abandons it. https://github.com/google/oss-rebuild https://github.com/google/oss-rebuild

gostsamo 1y ago
> 1. That is two years better than nothing. This means two migrations in two years.

ezekg 1y ago

There are some initiatives to help change that: https://osspledge.com https://osspledge.com

blitzar 1y ago
Once there are as many private jets available for open source devs as there are for google employees then we are making progress.
- ezekg 1y ago
  I think that's the wrong way to frame it. OSS is not meant to make you rich, and expecting that is going to bring more pain than joy. However, I do think businesses should use their success to fund their dependencies in a way that makes sense for them.
  - pessimizer 1y ago
    > businesses should use their success to fund their dependencies in a way that makes sense for them. They already do, and always have. It doesn't make any sense to most of them to fund their OSS dependencies at all, because they're available for free. They should do more than what makes sense for them, and they should have to pay professional consequences if they don't. Programmers should have enough unity to bring pressure against companies that make a lot of money from software they don't pay for. Or rather, should have had, because LLMs have changed anything.

chubot 1y ago

At first I thought this might be promising, given without burden on upstream maintainers Then I see This is not an officially supported Google product on https://github.com/google/oss-rebuild https://github.com/google/oss-rebuild And then I also see oss-rebuild uses a public Cloud KMS key to validate attestation signatures. Anonymous authentication is not supported so an ADC credential must be present. $ gcloud init $ gcloud auth application-default login I would not use this with a dependency on Google Cloud, or the gcloud command line tool. Mainly because Google has horrible customer support. It would be more interesting if they came up with something hosted on third party infrastructure. Last I heard, Google Cloud is run by Oracle executives --- e.g. in particular the Unisuper incident led me to believe that a lot of operational stuff is being outsourced, and is of poor quality UniSuper members go a week with no account access after Google Cloud misconfig https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=unisuper&sort=byPopularity&type=story https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu... Google accidentally deleted a $125 billion pension fund's account https://qz.com/google-cloud-pension-fund-unisuper-1851472990 https://qz.com/google-cloud-pension-fund-unisuper-1851472990 I would not say this is unrelated, because operations in the underlying cloud can be a weak link in security Although I'd certainly be interested in an argument otherwise