pabs3

They should classify the ICANN and the RIRs as gatekeepers too, they are the biggest ones.

I've been a FOSS contributor since the early 2000s, I've stopped contributing and stopped maintaining projects completely in recent years, except for when I am paid, or where there is a problem that affects me directly that I can't workaround easily. I don't feel the FOSS community values that formed part of my identity are represented in the community much these days, and AI has made that situation worse.

They are likely pretty busy with their lawsuit against Vizio, which is going to trial in August and would set a very interesting precedent if won.

https://sfconservancy.org/copyleft-compliance/vizio.html

I feel like that is quite unlikely. Both the hash and bitwise comparisons read both files in both cases. In the not-equal case the hash reads the entirety of both files, so its slower than a start-to-end bitwise comparison, which exits at the first not-equal bit. In the equal case, both read the entirety of both files. Various other bitwise strategies can be faster than start-to-end, rdfind for example checks the start of the file first, then the end, then the rest of the file.

The OpenMoko Freerunner only had 128MB RAM, it was able to run a Linux desktop of the time, Englightenment/E16. There were lots of apps for it too. IIRC the cut down QtMoko distro ran best though.

https://wiki.openmoko.org/wiki/Neo_Freerunner https://wiki.openmoko.org/wiki/Applications https://wiki.openmoko.org/wiki/QtMoko

Before that Linux ran on the Zaurus too:

https://en.wikipedia.org/wiki/Sharp_Zaurus https://en.wikipedia.org/wiki/OpenZaurus

Indeed, the Reproducible Builds community is working on fixing non-deterministic build output https://reproducible-builds.org/

Build reproducibility checks usually use bitwise comparison, not hash comparison.

The Reproducible Builds project also wrote diffoscope, which goes quite far with helping identify where differences occur and how to fix them.

https://reproducible-builds.org/ https://diffoscope.org/ https://try.diffoscope.org/

That sounds like a GPLv2 violation:

https://sfconservancy.org/blog/2021/mar/25/install-gplv2/ https://sfconservancy.org/blog/2021/jul/23/tivoization-and-t...

There were 5G towers being attacked during COVID, because of delusional conspiracy theories:

https://www.bbc.com/news/stories-53285610 https://www.telstra.com.au/exchange/5g-health-concerns-and-c... https://www.abc.net.au/news/2020-08-03/5g-conspiracy-theory-...

There is a copy of it on Software Heritage:

https://archive.softwareheritage.org/browse/origin/directory...

Some links about GPL & TiVo:

https://sfconservancy.org/blog/2021/mar/25/install-gplv2/ https://sfconservancy.org/blog/2021/jul/23/tivoization-and-t... https://events19.linuxfoundation.org/wp-content/uploads/2017...

I don't know what the solution to slop is. Maybe the bubble will implode at some point. Until then, just close down issues/pulls or remove projects from GitHub I guess.

The xz incident was only discovered by accident, not by someone actually verifying the tarball and test cases were not malicious. We still don't have verification of tarball build reproducibility anywhere. The closest you can get to verified builds is what the bootstrappable builds community built in hex0/stage0, and what stagex built on top of that. I'm guessing even they haven't read through all that source code though. There aren't even good tools for distributing reviews, there is crev, but the stagex folks think it has some deficiencies.

https://news.ycombinator.com/item?id=47701394

Thats the entire history of companies right there though? They have always socialised costs, privatised profits.

Under the LGPL, statically linked Qt is also fine, as long as the user can relink your proprietary code with a modified Qt library.

> someone (or something) who's concealing their identity has nothing to gain from recognition

The xz supply chain attacker hid their real identity, created fakes one and gained recognition over time in order to gain more access and add the backdoor. So TLAs and other bad actors at least are interested in gaining recognition.

Tesla is full of open source software, including the Linux kernel. They probably are GPL violators though.

https://sfconservancy.org/blog/2018/may/18/tesla-incomplete-... https://sfconservancy.org/blog/2019/oct/30/calling-all-tesla... https://sfconservancy.org/blog/2023/dec/21/tesla-no-source-c...

See also this interesting slide deck about the GPLv3 and cars, I expect that regulations would mean you could not drive cars with modified software (similar to what happens with solar inverters):

https://events19.linuxfoundation.org/wp-content/uploads/2017...

Related post from GamersNexus:

https://gamersnexus.net/fk-you-bambu-lab

Don't get me wrong, Amazon are evil for sure, and worse than those companies.

That is incorrect, the FSF licenses would require Amazon contribute code forward to their users, not back to the project.

Also, Amazon were already contributing code back when these companies changed their licenses, the companies don't care about code contributions, just money.