Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

metapunk2077fail

macrumors 6502a
Oct 31, 2021
634
845
NATO-aligned countries having their own intranet is exactly what I expect the future to be.
We don't want that though. Western businesses have shopping sites for almost every country and would lose a lot of money.

We want abuses to end. That's all. So we have to use our combined energy to demand an end to abuses of software, toxic platforms, extremists using money laundering vehicles in open source spaces.
 

JMacHack

Suspended
Mar 16, 2017
1,965
2,422
We don't want that though. Western businesses have shopping sites for almost every country and would lose a lot of money.

We want abuses to end. That's all. So we have to use our combined energy to demand an end to abuses of software, toxic platforms, extremists using money laundering vehicles in open source spaces.
I’m not happy about it, but I’m gonna bet on the death of a free and open internet.
 

Ethosik

Contributor
Oct 21, 2009
7,820
6,724
I think people give far too much weight on the open source aspect of things. Is Linux more secure than Windows because of the source? Or is it due to marketshare instead? I’m sure Linux and Mac have some different implementations than Windows on things. But I don’t buy the fact that it’s more secure because it’s open. And how many distro are out there for Linux? It’s too much hassle for the majority of malware.

I don’t write malicious software I find it horrible. But if I did I would target Windows for the more traction I can get.

There have been a few major issues tied to open source software. Remember Heartbleed too?

Assume nothing is fully secure. I take security very seriously on any operating system or application or codebase. If macOS (or one specific Linux distro) and Windows are flipped marketshare wise, I can guarantee you that Windows would be the “secure” system.
 
  • Haha
Reactions: killawat

Spock

macrumors 68040
Jan 6, 2002
3,429
7,302
Vulcan
That’s exactly what makes the “lock in” scenario implausible. It’s easier, cheaper, and less stupid to just stop making Macs than it is to lock in the App Store.


No, you pretty much said they were gonna do it:

And you are wrong.
You can have your opinion and I can have mine. I hope that I am wrong.
 

orev

macrumors 6502a
Apr 22, 2015
572
978
Are they inviting anyone from Open Source to be part of this? Or are we just going to see a one-sided show of commercial companies taking shots are open source? Google, IBM, and Facebook better be up front that they wouldn't exist without Open Source. Would be nice for Amazon to be there too, given all of their services exist only because of OSS.

The "security" dividing line of open vs. closed source is completely the wrong thing to be focused on, as it makes no meaningful difference. The difference is made in what resources are allocated to any given software (a shoestring budget for a commercial product is just as bad as a shoestring open source one).
 

svenmany

macrumors demi-god
Jun 19, 2011
2,052
1,330
You misunderstand me. The big guys saying open source bad (Microsoft, VMware, Cisco) are saying its a non-issue because they are using 1.x. That's the joke. We are spending hours mitigating things ourselves because these closed source applications are ignoring the problem and are saying bundling packages that were EOL in 2015 is business as usual.
Apologies.

When the patches to version two were coming out they were also patching version 1. I haven't studied the version 1 issues. I wonder if it affects the products you mention.
 

Freeangel1

Suspended
Jan 13, 2020
1,191
1,753
This is a bunch of crap. open source is less secure than closed source MONEY HUNGRY Apple closed software.

I Guess Tim Cook is not happy with the 98 million dollars he took home as a salary last year. This year he wants more.


GREED.
 
  • Haha
Reactions: jdb8167

metapunk2077fail

macrumors 6502a
Oct 31, 2021
634
845
I’m not happy about it, but I’m gonna bet on the death of a free and open internet.
Instead of countries being blocked I'd prefer certain IP address ranges blocked/sanctioned if they are definitively connected to scammers, terrorists, hackers, ransomware, etc

To some extent that is already being done.
 

Freeangel1

Suspended
Jan 13, 2020
1,191
1,753
They build macOS all off of FREE BSD which is open source UNIX and then they BASH open source.

REALLY REALLY STUPID.

Try keeping up with updating macOS to the latest FREE BSD parts so your software is not left with security Flaws.
 

JMacHack

Suspended
Mar 16, 2017
1,965
2,422
Instead of countries being blocked I'd prefer certain IP address ranges blocked/sanctioned if they are definitively connected to scammers, terrorists, hackers, ransomware, etc

To some extent that is already being done.
I’d prefer the opposite, a completely anonymized internet. But that’s a utopian idea that the powers that be don’t want that.
 

kc9hzn

macrumors 68000
Jun 18, 2020
1,603
1,909
That said, the businesses the White House called in are all fairly big proponents of what you might call enterprise open source. All of them do maintain and/or support some pretty substantial open source projects. Microsoft, in addition to owning GitHub, open sourced the entirety of the .NET stack. Google, Meta, and IBM are very notable users and maintainers of significant open source code. Apple, of course, has LLVM and clang, among many others. Oracle is perhaps the most dodgy of the listed companies, with regards to open source, since they’ve been known to change licensing terms on projects they’ve acquired, but they do own MySQL and OpenOffice, among others. If you’re calling in representatives of large firms to discuss challenges facing open source software, you could do worse. Plus, they can give the perspective of closed source users of open source software, as well. Their perspective could well be useful, though adding a representative from Apache or maybe Red Hat might be useful for some additional perspective.
 

vmistery

macrumors 6502a
Apr 6, 2010
942
688
UK
What a lot of closed source shops do is use a lot of opensource stuff as their base especially for common components you shouldn’t need to reinvent all the time (like OpenSSL and Log4j). Oh lord Android uses all sorts of opensource stuff, MacOS does too albeit modified. Basically every router including ones made by big names like Cisco have open source dependencies and even Microsoft use it extensively in their cloud. Closed source and opensource code is the same it’s just you can see how bad it is when it’s open. It being closed or opensource doesn’t make it any more or less secure it just makes the threats different. The way to make opensource software better is the companies that use it to contribute back to the projects they use either financially or with time / resources.
 

vmistery

macrumors 6502a
Apr 6, 2010
942
688
UK
That said, the businesses the White House called in are all fairly big proponents of what you might call enterprise open source. All of them do maintain and/or support some pretty substantial open source projects. Microsoft, in addition to owning GitHub, open sourced the entirety of the .NET stack. Google, Meta, and IBM are very notable users and maintainers of significant open source code. Apple, of course, has LLVM and clang, among many others. Oracle is perhaps the most dodgy of the listed companies, with regards to open source, since they’ve been known to change licensing terms on projects they’ve acquired, but they do own MySQL and OpenOffice, among others. If you’re calling in representatives of large firms to discuss challenges facing open source software, you could do worse. Plus, they can give the perspective of closed source users of open source software, as well. Their perspective could well be useful, though adding a representative from Apache or maybe Red Hat might be useful for some additional perspective.
Redhat is IBM these days, I’d prefer a true Opensource project to represent the OS market, something like Debian on there as well as your suggestion of the Apache foundation
 

kc9hzn

macrumors 68000
Jun 18, 2020
1,603
1,909
Redhat is IBM these days, I’d prefer a true Opensource project to represent the OS market, something like Debian on there as well as your suggestion of the Apache foundation
Fair, but it would be harder to find a representative empowered to speak on behalf of the whole Debian project. The Apache Foundation probably has more of a corporate structure for lack of a better term. Debian does have a Project Leader, according to Wikipedia, but I get the feeling the Project Leader is less like a Benevolent Dictator For Life and the internal culture is a bit more like a commune than a hierarchical model. Makes it kinda hard to choose one person to serve as a representative/as voice to an entity, like the government, that’s a lot more top down hierarchical.
 

vmistery

macrumors 6502a
Apr 6, 2010
942
688
UK
Still not that simple. If you want to target a system, the natural targets are those which are most prominent.

Is the platform really more “secure” or simply far less frequently targeted?
I’m not sure what your argument is here. The Linux kernel is on many more devices around the world than windows or MacOS combined so it naturally makes a great target. MacOS is in most of the world a small market share so you could argue it is more secure by its relative obscurity. Log4j is in blooming everything it seems
 

Macbookprodude

Suspended
Jan 1, 2018
3,306
898
Ah, US government cherry picking things to "discuss" security threat of open source. Because they "know" better. :D

I think the US government should focus on telling their own politicians like AOC to wear masks. They don't seem to even understand what they were spitting from their own mouth.
This isn't the US government, its the Supreme Soviet of the Union of Socialist American States. Also called, Soviet Union II.
 

johnmacward

macrumors 6502
Jul 12, 2011
345
254
Maybe there could be a public body that ratifies many of the most popular core libraries. Some kind of governmental agency or non profit company. The issue is more that there are a certain amount of core libs that everyone has in their builds. I think now its the Wild West because its no one person/ orgs job to check any of these libs or certify them.

I suppose a bit like an https cert or something. If your build has a lib that hasn't been validated by this body it will throw up an alert. Use it at your own risk.

We are leaving for too many core components to be looked after by people for free with no incentive to make sure everything is ok.
On the open source community they need incentives, and in fact it would be detrimental as the moment you soak something in money (which I’m assuming you’re talking about) it doesn’t necessarily result in the right things being done, just the incentee (if that’s a word) finding ways to get more money (maybe one day it’s security, another day it’s features when in fact it should be security). Often tiny projects that have massive followings are just run by one or two people who have real lives and simply don’t have the time to nail every security vulnerability because they’re working their ass off for a big tech company that doesn’t take much interest in giving them free time. Closed or open source is not the question here, both have their ups and downs. It’s worth noting that our entire world runs on open source and not proprietary software.
 

sideshowuniqueuser

macrumors 68030
Mar 20, 2016
2,863
2,874
Security Theater. The obvious answer is to fund OSS. Scores of backend technology powering MacRumors, Google, Amazon and yes even Apple are powered by the efforts of unpaid, overworked volunteers. Billions of dollars in revenue.
The only time an open source project is "adopted" is when a particular corporation wants to exert influence over the direction of the product, but most OSS never sees a dime. Enough is enough. Fund open source efforts right on the GitHub.

Why didn't OSS get this type of "attention" after the Equifax hack (apache struts)? Why focus on Log4j.
The biggest, best, and most popular open source projects are extremely well funded. Many OOS projects are even created by corporations, including Apple, who not only fund, but supply the staff, and offices for it. A lot are funded by donations. A lot are funded through the founders and key developers selling professional consulting for the project. A lot are funded by having commercial spin offs that add extra, paid-for functionality, but continue to fund the base OSS code. There are huge advantages to open sourcing software.
 

killawat

macrumors 68000
Sep 11, 2014
1,947
3,581
The biggest, best, and most popular open source projects are extremely well funded. Many OOS projects are even created by corporations, including Apple, who not only fund, but supply the staff, and offices for it. A lot are funded by donations. A lot are funded through the founders and key developers selling professional consulting for the project. A lot are funded by having commercial spin offs that add extra, paid-for functionality, but continue to fund the base OSS code. There are huge advantages to open sourcing software.


Survey Finds Many Open Source Maintainers Are Stressed Out and Underpaid, But Persist So They Can Make a Positive Impact​

46% are not paid at all while only 26% earn more than $1,000 per year for their maintenance work, according to Tidelift Survey

BOSTON, June 3, 2021 /PRNewswire/ -- A new survey by Tidelift, the premier provider of solutions for managing the open source software behind modern applications, found that most open source maintainers are not paid enough, if at all, for often stressful and thankless work. Yet, making a positive impact is what motivates these maintainers to continue their work despite the challenges.

This first-ever survey of open source maintainers was fielded in early 2021, and nearly 400 responded with thoughts about how their work is funded, and what they do (and don't) enjoy about being a maintainer. The most pressing questions surround how open source maintainers should be compensated for their work and whether they are being paid adequately.

"The entire world relies on open source components to power applications, yet our data shows that the open source maintainers who create and keep open source running well are not properly compensated for the incredible value they provide," said Donald Fischer, CEO and co-founder, Tidelift. "The path to a safer, healthier open source software supply chain starts with ensuring more volunteer maintainers get paid adequately for the crucial work they do."

Key Findings

Nearly half of maintainers are unpaid volunteers but many persist so they can make a positive impact


  • Forty-six percent are not paid at all, while only 26% earn more than $1,000 per year for their maintenance work. Tidelift is having an impact, with 52% of Tidelift-partnered maintainers making more than $1,000 per year for their work compared to only 17% of those maintainers who are not partnered with Tidelift.
  • The top three reasons maintainers enjoy their work are "making a positive impact on the world" (71%), "allowing me to fulfill a need for creative, challenging, and/or enjoyable work" (63%), and "getting to work on projects that matter to me" (59%).
  • Getting paid for maintenance work ranked dead last in the list of things maintainers enjoy today (21%), yet a deeper look at the data suggests that it's because most haven't traditionally had the opportunity to get paid. Only 18% of those getting paid less than $1,000 per year say getting paid is a reason they enjoy being a maintainer. That rises to 30% for those making $1,001 to $10,000, and explodes to 61% for those earning more than $10,000.
But maintaining open source is often stressful, thankless, and financially unrewarding

  • Almost half of respondents (49%) cited "not getting financially compensated enough or at all for my work" as the top reason to dislike being a maintainer, followed by "adds to my personal stress" (45%), and "feel underappreciated or like the work is thankless" (40%).
  • More than half (59%) of maintainers surveyed have quit or considered quitting maintaining a project. The more projects a maintainer is responsible for, the more likely it is that they have considered quitting— over two thirds (68%) of those who managed 10 projects or more have quit or considered quitting.
  • The number one most likely reason to quit, cited by 60% of respondents, was that "other things in my life and work took priority."
How maintainers spend their time and where they need help

  • Maintainers spend less than a quarter (24%) of their time building new features and writing new code; followed by reviewing contributions, issues, and generally responding to users (20%); resolving conflicts and handling bugs (14%); and managing technical debt and improving existing code (11%).
  • The primary non-financial places where they are looking for help are with improving documentation and improving the experience for new users and contributors—with 90% of respondents reporting at least one of these as valuable.
  • In addition, 69% of maintainers agree that "open source suffers from a lack of diversity and would benefit if contributors represent a wider set of backgrounds and experiences," while only 9% disagree with the statement.
  • Their top ideas for increasing maintainer diversity were creating a welcoming atmosphere (72%), community onboarding and outreach (60%), and mentorship opportunities (56%).
On June 7 at 11 a.m. EDT, Tidelift is hosting a panel of maintainers to discuss these survey results at the free, virtual event Upstream. Brenna Heaps of Tidelift will moderate with maintainer panelists including John Leider of Vuetify, Alex Clarkof Pillow, Isabel Costa of AnitaB.org, Gina Häußge of OctoPrint. They'll be joined by developer research expert Lawrence Hecht, who led the analysis of the survey results, and Ewa Jodlowska, executive director of the Python Software Foundation. Register at upstream.live.

Receive a copy of the full survey report here.

About Tidelift

Tidelift helps organizations effectively manage the open source behind modern applications. Through the Tidelift Subscription, the company delivers a comprehensive management solution, including the tools to create customizable catalogs of known-good, proactively maintained components backed by Tidelift and its open source maintainer partners. Tidelift enables organizations to accelerate development and reduce risk when building applications with open source, so they can create even more incredible software, even faster. https://tidelift.com/

Contact:
Melissa Logan for Tidelift
melissa@constantia.io

SOURCE Tidelift

rt.gif

Related Links​

http://www.tidelift.com


Source: https://www.prnewswire.com/news-rel...hey-can-make-a-positive-impact-301304925.html
 
  • Like
Reactions: rumormiller

killawat

macrumors 68000
Sep 11, 2014
1,947
3,581
The biggest, best, and most popular open source projects are extremely well funded. Many OOS projects are even created by corporations, including Apple, who not only fund, but supply the staff, and offices for it. A lot are funded by donations. A lot are funded through the founders and key developers selling professional consulting for the project. A lot are funded by having commercial spin offs that add extra, paid-for functionality, but continue to fund the base OSS code. There are huge advantages to open sourcing software.
Log4j being used de facto in so many Java projects means its important, one of the best and popular right? This was and still is a global event so surely there is some muscle behind it right? Log4j had three sponsors through GitHub before the latest vuln. Lets look at Ralph Goers (Log4j Developer) GitHub profile.

Ralph Goers:

I am a Member of the Apache Software Foundation and am a PMC member of Apache Commons, Apache Flume, Apache Logging Services, and Apache Maven. I created the initial versions of Apache Log4j 2 and continue to focus most of my efforts there providing support and enhancements to try to make Apache Log4j 2 the best logging framework for Java developers.

I currently have a full time job as a Software Architect. I work on Log4j and other open source projects in my spare time and so I typically work on those issues that are of most interest to me. I have always dreamed of working on open source full time and would love your support to enable that to happen.

Where is his office to park his Lamborghini? Who is writing his checks for his work on Log4j? Google? Apple? DoD? Amazon? The US? China? Oh thats right. No one. No one cared before the latest vuln came out. That's exactly the point. Support these guys before it's too late!

Log4j's project sponsorship skyrockets after critical bug exploitation

"Open Source" is Broken (relates to OSS funding)

 
Last edited:

Powerbooky

macrumors demi-god
Mar 15, 2008
597
499
Europe
It has nothing to do with open-source at all! The problem lies more in the fact that most people (and companies) do not compile the source-code but instead download the already compiled binary. Only very few people check these downloaded binaries if they match with the source code. And we all know that compilers could also be compromised as well. This makes open- and close-source software both just as "dangerous". Regardless if the available binary is a free download or not.

You all know where this is going. Whenever US government gathers the tech companies to discuss "security," the actual agenda is probably to enforce backdoors.

Yeah... even if they have invited software experts from China, this won't work. Germany has tried something similar, enforcing backdoors in home routers, supposedly for anti-terrorist measures. Didn't work either.
 

ian87w

macrumors G3
Feb 22, 2020
8,704
12,636
Indonesia
Yeah... even if they have invited software experts from China, this won't work. Germany has tried something similar, enforcing backdoors in home routers, supposedly for anti-terrorist measures. Didn't work either.
"Didn't work" doesn't mean they will stop trying. Any "security" events will definitely be used for this.
 

bbeagle

macrumors 68040
Oct 19, 2010
3,542
2,982
Buffalo, NY
The worst part is that because they're so cute, it's hard to evaluate their arguments objectively.

View attachment 1943456
I updated my original message. Spell-check is ridiculous. :)

I have a niece named 'Rylee'. When anyone used to text about her, spell-check changed it to 'Tyler'. Initially we were confused, but we got used to it, then later when everyone mentioned 'Tyler', we all knew who they were referring to.

It hasn't happened in the past few months, so I don't know if it's been 'fixed'?
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.