Fedora’s Lead Speaks on the Popularity of Linux and the Importance of Open Source

Fedora project leader Matthew Miller spoke to TechRepublic’s Jack Wallen this week, sharing some thoughts on the future of Linux — and on open source in general:
Matthew Miller: I think it’s a lost cause to try to “sell” our quirky technology interest to people who don’t see it already. We need to take a different approach…. I think our message, at its root, has to be around open source…. [W]ith Linux, when you install an open-source distro, you’re not just part of a fan community. You’re part of a colossal, global effort that makes software more available to everyone, makes that software better and better, and makes the whole world better through sharing… Just by using it you’re sharing in this amazing undertaking, part of a move away from scarcity to an economy based on abundance….
Jack Wallen: What’s the biggest difference in Linux today vs. Linux of 10 years ago?

Matthew Miller: I think first we have to start with just the amazing ubiquity of it. Ten years ago, it was cute to find a TV that ran Linux. Now, not only is it definitely powering your TV, you’ve probably got Linux running on your lightbulbs! It’s everywhere. And while Linux had pushed proprietary Unix from the server room, ten years ago Windows-based servers were pushing back. The cloud changed that — now, the cloud is Linux, almost completely. (Anything that isn’t is a legacy app that it was too much trouble to port!) From tiny devices to the most powerful mainframes and supercomputers: Linux, Linux, Linux….

Jack Wallen: If Linux has an Achilles’ heel, what is it?

Matthew Miller: Linux and the whole free and open-source software movement grew up with the rise of the internet as an open communication platform. We absolutely need that to continue in order to realize our vision, and I don’t think we can take it for granted.

That’s more general than an Achilles’ heel, though, so right now let me highlight one thing that I think is troubling: Chrome becoming the dominant browser to the point where it’s often the only way to make sites work. Chromium (the associated upstream project) is open source, but isn’t really run as a community project, and, pointedly, very very few people run Chromium itself. I’d love to see that change, but I’d also like to see Firefox regain a meaningful presence.
Miller also said Fedora’s next release is focused on simplicity. (“When the OS gets in the way, it drops from the conversation I want to have about big ideas to … well, the boring technical details that people never want to deal with”)
And he also shared his thoughts on what Linux needs most. “What I’d really like to see more of are more non-technical contributors. I mean, yes, we can always benefit from more packagers and coders and engineers, but I think what we really need desperately are writers, designers, artists, videographers, communicators, organizers and planners. I don’t think big companies are likely to provide those things, at least, not for the parts of the Linux world which aren’t their products.”
“We need people who think the whole grand project I’ve been talking about is important, and who have the skills and interests to help make it real.”

Read more of this story at Slashdot.

Should Companies Audit Their Software Stacks for Critical Open Source Dependencies?

Thoughtworks is a technology consultancy/distributed agile software design company. The principle technologist in its CTO’s office warns that managers of IT assets “need to keep up” with the changing economics of open source:

Early 2022 has brought with it an unusually high level of commotion in the open-source community, largely focused on the economics of who — and how we — should pay for “free” software. But this isn’t just some geeky flame war. What’s at stake is critical for vast swaths of the business world….

We know of many open-source enthusiasts who maintain their software personally while leading busy professional lives — the last thing they want is the responsibility of a service-level agreement because someone paid them for their creation. So, is this the end of the road for the open-source dream? Certainly, many of the open-source naysayers will view the recent upheavals as proof of a failed approach. They couldn’t be more wrong. What we’re seeing today is a direct result of the success of open-source software. That success means there isn’t a one-size-fits-all description to define open-source software, nor one economic model for how it can succeed.

For internet giants like Facebook or Netflix, the popularity, or otherwise, of their respective JavaScript library and software tool — React and Chaos Monkey — is beside the point. For such companies, open-source releases are almost a matter of employer branding — a way to show off their engineering chops to potential employees. The likelihood of them altering licensing models to create new revenue streams is small enough that most enterprises need not lose sleep over it. Nonetheless, if these open-source tools form a critical part of your software stack or development process, you might want some form of contingency plan — you’re likely to have very little sway over future developments, so understanding your risks helps.

For companies that have built platforms containing open-source software, the risks are more uncertain. This is in line with Thoughtworks’ view that all businesses can benefit from a greater awareness of what software is running in their various systems. In such cases, we advise companies to consider the extent to which they’re reliant on that piece of software: are there viable alternatives? In extreme circumstances, could you fork the code and maintain it internally?

Once you start looking at crucial parts of your software stack where you’re reliant on hobbyists, your choices begin to dwindle. But if Log4J’s case has taught us anything, it’s this: auditing what goes into the software that runs your business puts you in a better place than being completely caught by surprise.

Read more of this story at Slashdot.

The Free Software Foundation’s ‘LibrePlanet’ Conference Happens Online This Weekend

LibrePlanet, the annual conference hosted by the Free Software Foundation, will be happening online this weekend. The event “provides an opportunity for community activists, domain experts, and people seeking solutions for themselves to come together in order to discuss current issues in technology and ethics,” according to its web page. This year’s LibrePlanet theme is “Living Liberation”.

And while you’re listening to the presentations, you can apparently also interact with the rest of the community:

Each LibrePlanet room has its own IRC channel on the Libera.Chat network… Want to interact with other conference-goers in a virtual space? Join us on LibreAdventure, where you’ll be able to video chat with fellow free software users, journey to the stars, and walk around a replica of the FSF office!

Our Minetest server is back by popular demand, and now running version 5.x of everyone’s favorite free software, voxel sandbox game. You can install Minetest through your GNU/Linux distro’s package manager, and point your client to minetest.libreplanet.org with the default port 30000.

Sunday’s presentations include “Living in freedom with GNU Emacs” and “Hacking my brain: Free virtual reality implementations and their potential for therapeutic use.”

And Sunday will also include a talk from Seth Schoen, the first staff technologist at the Electronic Frontier Foundation (who helped develop the Let’s Encrypt certificate authority) titled “Reducing Internet address waste: The IPv4 unicast extensions project.”

View the complete schedule here.

Read more of this story at Slashdot.

Who’s Paying to Fix Open Source Software?

The Log4Shell exploit “exposes how a vulnerability in a seemingly simple bit of infrastructure code can threaten the security of banks, tech companies, governments, and pretty much any other kind of organization,” writes VentureBeat. But the incident also raises some questions:
Should large deep-pocketed companies besides Google, which always seems to be heavily involved in such matters, be doing more to support the cause with people and resources?

Long-time Slashdot reader frank_adrian314159 shares a related article from a programming author on Dev.To, who’d read hot takes like “Open source needs to grow the hell up.” and “Open source’ is broken”.

[T]he log4j developers had this massive security issue dumped in their laps, with the expectation that they were supposed to fix it. How did that happen? How did a group of smart, hard-working people get roped into a thankless, high-pressure situation with absolutely no upside for themselves…?

It is this communal mythology I want to talk about, this great open source brainwashing that makes maintainers feel like they need to go above and beyond publishing source code under an open source license — that they need to manage and grow a community, accept contributions, fix issues, follow vulnerability disclosure best practices, and many other things…
In reality what is happening, is that open source maintainers are effectively unpaid outsourcing teams for giant corporations.

The log4j exploit was first reported by an engineer at Alibaba — a corporation with a market capitalization of $348 billion — so the article wonders what would happen if log4j’s team had sent back a bill for the time they’d spend fixing the bug.

Some additional opinions (via the “This Week in Programming” column):

PuTTY maintainer Andrew Ducker: “The internet (and many large companies) are dependent on software maintained by people in their spare time, for free. This may not be sustainable.”
Filippo Valsorda, a Go team member at Google: “The role of Open Source maintainer has failed to mature from a hobby into a proper profession… The status quo is unsustainable…. GitHub Sponsors and Patreon are a nice way to show gratitude, but they are an extremely unserious compensation structure.”
Valsorda hopes to eventually see “a whole career path with an onramp for junior maintainers, including training, like a real profession.”

Read more of this story at Slashdot.

Trump’s Social Media Site Quietly Admits It’s Based On Mastodon

mrflash818 shares a report from PCMag: To avoid a lawsuit, Donald Trump’s social media site is quietly acknowledging the computer code powering the platform comes from Mastodon. Trump’s “Truth Social” site now features a dedicated section labeled “open source,” which contains a Zip archive to Mastodon’s source code. “Our goal is to support the open source community no matter what your political beliefs are. That’s why the first place we go to find amazing software is the community and not ‘Big Tech,'” the site adds. Truth Social created the section on Nov. 12, two weeks after social networking provider Mastodon threatened to sue Trump’s platform for violating its open-source license.

Since Mastodon is an open-source software project, anyone can use it for free. But if you do, the software license demands the code and any ensuing modifications to your Mastodon-powered platform be made publicly available, allowing the entire Mastodon community to benefit. (This doesn’t include publishing any user data or disclosing admin access, though.) […] However, it appears the uploaded Zip archive is simply a barebones version of the existing Mastodon source code you can already find on GitHub. The archive itself is only a mere 30MB in size. Nevertheless, Rochko said the Zip archive might “become more interesting” once Truth Social finally launches.

Read more of this story at Slashdot.