News for hackers. Stuff that matters.
Re:Making Open Source software safer and more secure by candiddevmike on Thursday January 13, 2022 @04:41PM (#29927267)
Coming soon to kill your open source project: a current chain of custody and audit certificate that all corporations will require in your repo (along with that MIT license!). Too expensive for you to procure because this is a hobby side project? Don't worry, some other company will fork it and take control--most companies would rather have an OSS library from some other corporation than github.com/fortnitedude anyways. Thank you for your OSS contribution, we'll take it from here.
Re:Making Open Source software safer and more secure by Grismar on Thursday January 13, 2022 @04:52PM (#29927390)
Which is it: you want them to use the software or not? What do you care if it carries the added label? If they secure your software, stick a label on it and you get to add their changes back to your project if you like them, what's the problem? Normal open source process, in a good way - or do you want open source to be open, but just to people you like?

The only thing you might complain about is the already existing problem that it's damn hard to get paid for writing good open source software, unless you work for a business like these - this doesn't really make that worse though, or at least not for the wrong reasons.

Re:Making Open Source software safer and more secure by Grismar on Thursday January 13, 2022 @04:54PM (#29927412)
(unless your problem was with someone sticking an MIT license on it in the first place, but that's hardly Google's fault in this case?)
Re:Making Open Source software safer and more secure by animal_spirits on Thursday January 13, 2022 @04:42PM (#29927293)
I'd rather have a maintained and secure fork of some library from a corporation than an unmaintained and deteriorating library from someone who can't afford to upkeep it.
Re:Making Open Source software safer and more secure by buscoquadnary on Thursday January 13, 2022 @04:50PM (#29927368)
Or they charge you to upgrade to the latest version and then lock you out of the software if you aren't up to date because it isn't secure. That could happen to.
Re:Making Open Source software safer and more secure by animal_spirits on Thursday January 13, 2022 @04:56PM (#29927449)
If it is open source then we can just fork off of the last free version. Lets at least take advantage of the corporations who also want successfully maintained software.
Re:Making Open Source software safer and more secure by heavyset_go on Thursday January 13, 2022 @05:15PM (#29927691)
Corporations don't have to maintain open source software under open source licenses if, for example, that software was released under MIT or BSD licenses. They could very well take an project with an MIT license and make it proprietary, and there won't be any free versions to fork from.
Re:Making Open Source software safer and more secure by dragonwriter on Thursday January 13, 2022 @05:20PM (#29927759)
> Corporations don't have to maintain open source software under open source licenses if, for example, that software was released under MIT or BSD licenses.

If they own the copyright and control the only source code available, they can change the license regardless of whether it is permissive or copyleft currently.

If they do only the second, they can shut down the repo regardless of the license, even if they don't change the license, and unless it's something like AGPL continue internal use.

If they don't control the only archive of source code, then even if they can change the license going forward, other people can continue to distribute and fork off from the last Free version (again, irrespective of whether permissive or restrictive.) Unless they both own the copyright and have the legal power to retract the license offer for the earlier code (contrary to the usual express terms of license grants, which may be possible if it is a gratuitous license, but even if it is may not be fully effective in all cases because of promissory estoppel.)

Re:Making Open Source software safer and more secure by nolok on Thursday January 13, 2022 @05:09PM (#29927627)
Does the license permit it ? If yes then they're not doing anything that the author didn't want them to do.
Re:Making Open Source software safer and more secure by Teever on Thursday January 13, 2022 @05:13PM (#29927677)
They license may permit it but the author may not have envisioned this kind of nefarious use that the license permitted.

If you're outside sweeping your steps and I walk by and ask to see your broom for a second and then I beat you to death with your broom you aren't to blame because you handed me your broom.

Re:Making Open Source software safer and more secure by nolok on Friday January 14, 2022 @07:17AM (#29933561)
Your broom example is flawed and in no way a match to the situation.

If you build a broom and I ask if I can see it and you say yes you can see it and you are free to make another one like it for yourself and make more to sell for everyone else, then you can't complain about them doing it.

As for the "they didn't envision", then it's entirely their fault. If they put their code online using default copyright law, this wouldn't be allowed, they specifically picked a license that allow it.

Re:Making Open Source software safer and more secure by smasher164 on Thursday January 13, 2022 @05:11PM (#29927648)
> can't afford to upkeep it

Address the cause, not the symptom. Make it so these individuals are more capable of upkeeping their projects. Otherwise, over the long term, you'll end up with projects disincentivized to do the maintenance, leading to a weaker open-source community.

Re:Making Open Source software safer and more secure by sam_lowry_ on Thursday January 13, 2022 @04:47PM (#29927343)
You'll have the worst of both worlds.
Re:Making Open Source software safer and more secure by animal_spirits on Thursday January 13, 2022 @04:49PM (#29927364)
Can you explain?
Re:Making Open Source software safer and more secure by pvarangot on Thursday January 13, 2022 @04:55PM (#29927424)
Not OP but they probably mean you don't get the competitive advantage of owning your own purpose specific codebase, but your library also doesn't have an agile community that's working on it "for free".
Re:Making Open Source software safer and more secure by teddyh on Thursday January 13, 2022 @04:57PM (#29927460)
What you’ll have is an unmaintained insecure fork held in place by a company who doesn’t have to do any maintenance, since they, and their code, are declared “secure” by fiat.
Re:Making Open Source software safer and more secure by animal_spirits on Thursday January 13, 2022 @05:00PM (#29927512)
I don't see how that's any different than where we started from? Google can't just take over an open source library and declare no one can work on it any more.
Re:Making Open Source software safer and more secure by teddyh on Friday January 14, 2022 @04:40AM (#29932436)
If it’s MIT or otherwise permissively licensed, they absolutely can take it over by forking, putting enough work into it that it’s not worth continuing the original version, and then not releasing it openly, or with complicated entanglements.

If it’s GPL or similar, the process is slower. They will probably immediately start a grand redesign which will, incidentally, not use the GPL library. In the short run, they will start a replacement implementation of the GPL library, incidentally permissively licensed. Both will take time, but usually gets there.

Both of these cases are seen all the time.

Re:Making Open Source software safer and more secure by lapsedacademic on Thursday January 13, 2022 @05:08PM (#29927603)
Honestly, sounds amazing.

If I have code where that isn't literally free labor for my business/project, I'll keep it closed source. If I have code where that's free labor but also competes with or commodifies my business/project, I'll keep it closed source or use GPL.

This sort of boils down to "only use MIT if you really mean it", right?

Re:Making Open Source software safer and more secure by MangoCoffee on Thursday January 13, 2022 @05:13PM (#29927672)
IBM botched RedHat/CentOS, i won't trust a for profit corporation on open source software
Re:Making Open Source software safer and more secure by lapsedacademic on Thursday January 13, 2022 @05:43PM (#29928043)
So don't merge their forks?
Re:Making Open Source software safer and more secure by buscoquadnary on Thursday January 13, 2022 @04:48PM (#29927358)
I am really worried that this is where the focus around "security" is going to end up leading, and in so doing kill the spirit of hacking around. Kill any competitor or software startup by requiring a long checklist of "security" items before any software can be sold, or used.

And most of it will be security theater that looks good but does little to actually support secure computing because at the end of the day Bob is going to plug in a USB that Mallory drops in the parking lot that says "XXX Pics".

Re:Making Open Source software safer and more secure by heavyset_go on Thursday January 13, 2022 @05:19PM (#29927740)
Agreed. Most of the "security" I see coming out of these companies serves to secure their own revenue streams, and then it's pitched to users as existing for their own benefit.
Re:Making Open Source software safer and more secure by voakbasda on Thursday January 13, 2022 @04:57PM (#29927469)
Yup, regulatory capture is coming for your software.
Re:Making Open Source software safer and more secure by tw04 on Thursday January 13, 2022 @04:59PM (#29927489)
> Coming soon to kill your open source project: a current chain of custody and audit certificate that all corporations will require in your repo (along with that MIT license!).

Why would that kill your project? Presumably you’re maintaining it for your own use if it’s a hobby project. Who cares if some for-profit company who wasn’t contributing code or financial support doesn’t use it?

Re:Making Open Source software safer and more secure by coliveira on Thursday January 13, 2022 @05:13PM (#29927669)
It is already like that for closed OSs: Mac and iOS have required "signed" binaries for years now, which force the developer to register with Apple, use Apple hardware, and pay an annual fee. Similarly for Android. And Windows is on the same track.
Re:Making Open Source software safer and more secure by SkyMarshal on Thursday January 13, 2022 @05:17PM (#29927716)
> most companies would rather have an OSS library from some other corporation than github.com/fortnitedude anyways.

I think any project that's not a hobby project and is responsible for providing a quality, reasonably secure product to paying customers would prefer this. Be it a mega-evil-corp or a scrappy startup or anything in between.

But if you're a founder of such an open-source project that is getting interest from big companies, that sounds like an opportunity to get funding and turn your hobby project into a startup. Pretty sure most of those mega-evil-corps and scrappy startups would rather pay the project founder and originator than some fork.

Re:Making Open Source software safer and more secure by heavyset_go on Thursday January 13, 2022 @05:12PM (#29927657)
> Coming soon to kill your open source project: a current chain of custody and audit certificate that all corporations will require in your repo (along with that MIT license!).

For anyone that thinks this is hyperbole, this is already close to the current standard for shipping any executable to Windows or macOS machines today. If you want your app to run on either operating system, you first must buy certificates every year and sign your apps with them, and then you must remain in good standing with Microsoft or Apple if you don't want those certificates revoked or if you want them to be renewed.