6 ms·

This is a mistake. The Apache foundation doesn't sell $250/hour consulting gigs for its primary source of revenue. Neither does the Linux Foundation, the SQLite

This is a mistake. The Apache foundation doesn't sell $250/hour consulting gigs for its primary source of revenue. Neither does the Linux Foundation, the SQLite Consortium, or other massive, mission-critical open source products. This is the wrong funding model. It keeps money in OpenSSL developer's pockets, but there is no financial incentive for any OpenSSL developer to work on foundational improvements to OpenSSL. He said himself: there is over $100,000 in open contracts for competent developers to work on non-foundational improvements to the project. If you are an enterprising developer with good C skills and a knack for crypto projects and you apply to work for the OpenSSL foundation, are you going to start servicing that $100,000 pool of contracts or are you going to pretend that money doesn't exist and live on ramen? If nearly all of OpenSSL's revenue comes from clients that want OpenSSL to meet their particular needs, then none of that money is going to developers to strengthen OpenSSL's foundation. This is why OpenSSL looks like a hodgepodge of hacks upon hacks in order to accomplish narrow goals with limited impact testing. It should be no surprise to anyone else: clients are literally paying OpenSSL developers for this, and nothing else. Who is paying OpenSSL for developers to clean up the code base and remove ancient #IFDEFs? Who is paying OpenSSL for developers to analyze code paths and do case analysis? Who is paying OpenSSL for developers to write unit tests or even have a test harness at all? No one will pay an hourly rate to accomplish these tasks. Google is not going to pay by the hour for a developer to stare at a function until they grok it; they want a feature. Joe Company will not pay for developers to write unit tests, they want OpenSSL to handle $QUIRK from a vendor's system, or to know how to make their code handle it. This model needs to go away. Competent OpenSSL developers time is too valuable to waste on client asks. Their project is too important, and as long as the money is flowing only for novel features and not structural improvement, then that money will dictate that only new features are developed.

deleted 13y ago
[deleted]
uuid_to_string 13y ago
This is one of the better comments I have seen on OpenSSL in the past week. Well said. "This is why OpenSSL looks like a hodgepodge of hacks upon hacks in order to accomplish narrow goals with limited impact testing." It doesn't just look like a hodgepodege of accumulated hacks, it is a hodgepodge of accumulated hacks. :) "It should be no surprise to anyone else: clients are literally paying OpenSSL developers for this, and nothing else." One could say this with respect to many popular open source projects, including ones with corporate sponsorship. The complexity just keeps building over time and there is no such thing as "finished, accepting bug fixes only". "Who is paying OpenSSL for developers to clean up the code base and remove ancient #IFDEFs? Who is paying OpenSSL for developers to analyze code paths and do case analysis? Who is paying OpenSSL for developers to write unit tests or even have a test harness at all?" Those are rhetorical questions. We know the answers. Alas, when the people who pay for (open source) software and consulting pay to have "features" removed instead of added, "pigs will fly". Doug McIllroy is quoted as saying, "The hero is the negative coder". (Just in case this need explanation: Prof. McIllroy is the mind behind UNIX pipes and one of computer science's most prominant contributors. "Negative coder" means someone who removes code instead of constantly adding, or "committing", new code.) We could really use some more heros. And as we switch away from OpenSSL there will be a lot of links to libssl to remove. Meanwhile some people have been writing and testing small, auditable and usable open source crypto, more or less for "free". http://tweetnacl.cr.yp.to http://tweetnacl.cr.yp.to My guess (and hope) is that pathological requests for "features" to be added would be met with heavy scrutiny. The authors already have day jobs in academia.
- dfc 13y ago
  > Meanwhile some people have been writing and testing small, auditable and usable open source crypto, more or less for "free". With all due respect that is complete bullshit. I do not care that you put quotes around free. Writing "free" will never be considered to include sums in the hundreds of thousands of dollars. More importantly blatant lies like this muddy the debate and set outrageous expectations. The Nacl project gives the following description of funding: NaCl was initiated by the CACE (Computer Aided Cryptography Engineering) project funded by the European Commission\'s Seventh Framework Programme (FP7), contract number ICT- 2008-216499. CACE activities were organized into several Work Packages (WPs). NaCl was the main task of CACE WP2, \"Accelerating Secure Networking,\" led by Tanja Lange (at Technische Universiteit Eindhoven) and Daniel J. Bernstein (at the University of Illinois at Chicago, currently visiting Eindhoven). CACE nished at the end of 2010 but NaCl is a continuing project. ...Many of the algorithms used in NaCl were developed as part of Daniel J. Bernstein\'s High-Speed Cryptography project funded by the U.S. National Science Foundation, grant number ITR-0716498. I found the funding information for ITR-0716498. djb is listed as the PI for the project.[^1] I could only find the high level funding of ICT-2008-216499.[^2] (wtf EU?) CACE WP2 is only one component of the project. I would love it if someone with better knowledge of EU funding can find the funding for the WP2 line item. The figures are: NSF ITR-0716498 funding: (USD) 400,000.00 EU 2008-216499 funding: (EUR) 4,733,078.00 ***NEED WP2 line item*** The tweetnacl implementation lists two more funding sources. As above it was easy to locate the NSF funding but I totally struck out for the nwo funding: NSF 1018836 funding: (USD) $436,203.00[^3] NWO grant 639.073.005 funding: ??????????? Don't get me wrong, I have a lot of respect for djb and I think he and his coworkers deserve every fractional euro/dollar of funding that they received but they did not work for free. Most importantly they should not be expected to work for free. [^1]: http://www.nsf.gov/awardsearch/showAward?AWD_ID=0716498 http://www.nsf.gov/awardsearch/showAward?AWD_ID=0716498 [^2]: http://cordis.europa.eu/projects/rcn/85344_en.html http://cordis.europa.eu/projects/rcn/85344_en.html [^3]: http://www.nsf.gov/awardsearch/showAward?AWD_ID=1018836 http://www.nsf.gov/awardsearch/showAward?AWD_ID=1018836 NB: This is the nwo funding site: http://www.nwo.nl/en/funding http://www.nwo.nl/en/funding I think the english version may have a reduced set of features. I can not find the this grant information on the site.
atmosx 13y ago
Reminds me on an article about how short-term, market-driven university research is killing innovation in abstract fields with no apparent financial ROI (e.g. mathematics, physics, chemistry and biology). If research was market-driven in 1859 Riemann might not had time to play with zeta functions because at the time no one knew what to do with them. Same for Bayes and so many others. It's not that those man had a better environment around them than current researchers, it's mostly that we're getting results slower than we might as a human kind.
bhitov 13y ago
> This is the wrong funding model. It's only the wrong funding model if there is a superior alternative. It's a non-ideal funding model, but as is the main point of the article, they are and have been actively looking for alternative sources of funding without success. I hope your gripe is not directed at OpenSSL but at those who could be supporting it financially.
rwallace 13y ago
It's true that their funding model is imperfect, but then other funding models are imperfect in different ways, and their model should be perfectly workable: spend six months of the year working on contract jobs and the other six months making general improvements to the code. The reason it's not working is that their rates are far too low. This is, for whatever reason, a classic mistake of technical people. If you're turning down work for lack of time, you need to increase your rates until this stops happening.
antirez 13y ago
They say they have 100 pending contracts... I believe their funding strategy could be fixed by hiring people to do the contract hours for a salary (those don't need to be OpenSSL core hackers, just good enough with the core of OpenSSL to help customers and provide viable work when a modification is requested). With the money you earn you also pay the core team members to just work at OpenSSL with the right priorities: this is where you improve security, do refactoring, and trow away #ifdefs.
dllthomas 13y ago
One approach, if you're coordinating development through the foundation, might be for the foundation to require some percentage of the funds go to foundational improvements.

deleted 13y ago

[deleted]

uuid_to_string 13y ago

This is one of the better comments I have seen on OpenSSL in the past week. Well said. "This is why OpenSSL looks like a hodgepodge of hacks upon hacks in order to accomplish narrow goals with limited impact testing." It doesn't just look like a hodgepodege of accumulated hacks, it is a hodgepodge of accumulated hacks. :) "It should be no surprise to anyone else: clients are literally paying OpenSSL developers for this, and nothing else." One could say this with respect to many popular open source projects, including ones with corporate sponsorship. The complexity just keeps building over time and there is no such thing as "finished, accepting bug fixes only". "Who is paying OpenSSL for developers to clean up the code base and remove ancient #IFDEFs? Who is paying OpenSSL for developers to analyze code paths and do case analysis? Who is paying OpenSSL for developers to write unit tests or even have a test harness at all?" Those are rhetorical questions. We know the answers. Alas, when the people who pay for (open source) software and consulting pay to have "features" removed instead of added, "pigs will fly". Doug McIllroy is quoted as saying, "The hero is the negative coder". (Just in case this need explanation: Prof. McIllroy is the mind behind UNIX pipes and one of computer science's most prominant contributors. "Negative coder" means someone who removes code instead of constantly adding, or "committing", new code.) We could really use some more heros. And as we switch away from OpenSSL there will be a lot of links to libssl to remove. Meanwhile some people have been writing and testing small, auditable and usable open source crypto, more or less for "free". http://tweetnacl.cr.yp.to http://tweetnacl.cr.yp.to My guess (and hope) is that pathological requests for "features" to be added would be met with heavy scrutiny. The authors already have day jobs in academia.

dfc 13y ago
> Meanwhile some people have been writing and testing small, auditable and usable open source crypto, more or less for "free". With all due respect that is complete bullshit. I do not care that you put quotes around free. Writing "free" will never be considered to include sums in the hundreds of thousands of dollars. More importantly blatant lies like this muddy the debate and set outrageous expectations. The Nacl project gives the following description of funding: NaCl was initiated by the CACE (Computer Aided Cryptography Engineering) project funded by the European Commission\'s Seventh Framework Programme (FP7), contract number ICT- 2008-216499. CACE activities were organized into several Work Packages (WPs). NaCl was the main task of CACE WP2, \"Accelerating Secure Networking,\" led by Tanja Lange (at Technische Universiteit Eindhoven) and Daniel J. Bernstein (at the University of Illinois at Chicago, currently visiting Eindhoven). CACE nished at the end of 2010 but NaCl is a continuing project. ...Many of the algorithms used in NaCl were developed as part of Daniel J. Bernstein\'s High-Speed Cryptography project funded by the U.S. National Science Foundation, grant number ITR-0716498. I found the funding information for ITR-0716498. djb is listed as the PI for the project.[^1] I could only find the high level funding of ICT-2008-216499.[^2] (wtf EU?) CACE WP2 is only one component of the project. I would love it if someone with better knowledge of EU funding can find the funding for the WP2 line item. The figures are: NSF ITR-0716498 funding: (USD) 400,000.00 EU 2008-216499 funding: (EUR) 4,733,078.00 ***NEED WP2 line item*** The tweetnacl implementation lists two more funding sources. As above it was easy to locate the NSF funding but I totally struck out for the nwo funding: NSF 1018836 funding: (USD) $436,203.00[^3] NWO grant 639.073.005 funding: ??????????? Don't get me wrong, I have a lot of respect for djb and I think he and his coworkers deserve every fractional euro/dollar of funding that they received but they did not work for free. Most importantly they should not be expected to work for free. [^1]: http://www.nsf.gov/awardsearch/showAward?AWD_ID=0716498 http://www.nsf.gov/awardsearch/showAward?AWD_ID=0716498 [^2]: http://cordis.europa.eu/projects/rcn/85344_en.html http://cordis.europa.eu/projects/rcn/85344_en.html [^3]: http://www.nsf.gov/awardsearch/showAward?AWD_ID=1018836 http://www.nsf.gov/awardsearch/showAward?AWD_ID=1018836 NB: This is the nwo funding site: http://www.nwo.nl/en/funding http://www.nwo.nl/en/funding I think the english version may have a reduced set of features. I can not find the this grant information on the site.

atmosx 13y ago

Reminds me on an article about how short-term, market-driven university research is killing innovation in abstract fields with no apparent financial ROI (e.g. mathematics, physics, chemistry and biology). If research was market-driven in 1859 Riemann might not had time to play with zeta functions because at the time no one knew what to do with them. Same for Bayes and so many others. It's not that those man had a better environment around them than current researchers, it's mostly that we're getting results slower than we might as a human kind.

bhitov 13y ago

> This is the wrong funding model. It's only the wrong funding model if there is a superior alternative. It's a non-ideal funding model, but as is the main point of the article, they are and have been actively looking for alternative sources of funding without success. I hope your gripe is not directed at OpenSSL but at those who could be supporting it financially.

rwallace 13y ago

It's true that their funding model is imperfect, but then other funding models are imperfect in different ways, and their model should be perfectly workable: spend six months of the year working on contract jobs and the other six months making general improvements to the code. The reason it's not working is that their rates are far too low. This is, for whatever reason, a classic mistake of technical people. If you're turning down work for lack of time, you need to increase your rates until this stops happening.

antirez 13y ago

They say they have 100 pending contracts... I believe their funding strategy could be fixed by hiring people to do the contract hours for a salary (those don't need to be OpenSSL core hackers, just good enough with the core of OpenSSL to help customers and provide viable work when a modification is requested). With the money you earn you also pay the core team members to just work at OpenSSL with the right priorities: this is where you improve security, do refactoring, and trow away #ifdefs.

dllthomas 13y ago

One approach, if you're coordinating development through the foundation, might be for the foundation to require some percentage of the funds go to foundational improvements.