Hacker News Reader

Comment by richardwhiuk | Hacker News Reader

If it's publicly funded, it should be subject to standard public sector oversight.

I don't think open-source wants this.

Just a sidenote: some publicly funded code is produced as a side-effect of the government funding scientific research. The government is buying the research, not the code, so it should not have oversight on the coding process except inasmuch as it impacts the research. This could require open sourcing, but there ought not be an expectation that the code is particularly bulletproof.

IMO we should have an organization to produce publicly funded code (boring infrastructure stuff not R&D), but it should be neither achieved by co-opting existing community projects nor cannibalizing research projects. It should be a new thing.

Making an analogy to physical infrastructure: it would be crazy if we relied on groups of hobbyists to build a bridge, or if we just grabbed a bridge directly out of somebody’s PhD in civil engineering. (I mean the analogy looks ridiculous because the situation is!)

> Making an analogy to physical infrastructure: it would be crazy if we relied on groups of hobbyists to build a bridge, or if we just grabbed a bridge directly out of somebody’s PhD in civil engineering.

Except this is precisely what is happening… because it turns out the engineering hobbyists often build useful things. At which point, if the government goes and uses it as the foundations of a publicly constructed bridge, it might make sense for the government to invest a bit in ensuring the foundations are maintained.

If we required that government invested in open-source to use it, the only thing that would happen is that projects would be outsourced to the private sector (either explicitly by the government tendoring, or implicitly by the government offering tax incentives to build the project), and the private sector wouldn't fund it.

> Except this is precisely what is happening…

So Arathorn, pray tell, when will you be fixing the well-documented, years old bugs in the matrix-bifrost?

As soon as we have any money to pay someone to work on it, hence the point of this whole post(!!)

Some issues:

- Why we would we fund Matrix when XMPP and IRC already exists?

- Software developers earn way more than most public sector workers - is this justifiable?

> Why we would we fund Matrix when XMPP and IRC already exists?

Because empirically Matrix is what governments appear to be using - e.g. https://tchap.beta.gouv.fr/ for France; https://messenger.bwi.de/bundesmessenger for Germany; Delta for Ukraine; equivalent for UK & US, etc.

Matrix also has a completely different featureset to XMPP or IRC: E2EE by default; conversation history as a first class citizen; HTTPS+JSON APIs by default; E2EE Group VoIP (almost) integrated; etc.

> Software developers earn way more than most public sector workers - is this justifiable?

This feels like a false dichotomy. The implication is that public sector software developers are paid less than average private sector software developers. This may well be the case in some places - but the answer there is SURELY to pay public sector software developers the average going rate, rather than conclude that funding private sector FOSS maintenance is not justifiable(!)

I don't think this is a competition, but to clarify: XMPP has long been used in the public sector (via suppliers such as Isode) since before Matrix was conceived, and continues to be still. I've spoken with multiple organizations for whom the Matrix data model was not a good fit. As you say, they are quite different and each has strengths and weaknesses.

Yup - XMPP clearly has a lot of public sector traction too (e.g. in NATO's Federated Mission Networking), and each protocol has its merits. I was just trying to explain that the current "how can Governments better fund Matrix" is borne out of a glut of Governmental Matrix deployments as a WhatsApp/Teams replacement.

No, it's born out of Element not funding Matrix, and Matrix being desparate for funding.

The OP is calling out the need for any large org that depends on a FOSS project to contribute to its maintenance.

Currently we don’t have good mechanisms to make this happen.

The post uses Matrix as an example but it applies equally to any project deemed as critical infrastructure which would of course include XMPP, IRC and plenty of others.

To solve this, FOSS projects must work together to advocate for practical funding mechanisms. This is not a zero sum game.

> Why we would we fund Matrix when XMPP and IRC already exists?

A common sentiment I’ve come across, here and other corners of the internet, is dismay that more organizations have been adopting closed communication platforms such as Discord and Slack. These platforms (probably Discord more so) make it easier for online communities to be set up and offer relatively polished user experience compared to Matrix, IRC, or XMPP.

There was a post shared on HN a few weeks ago by a technical user and their onboarding experience with Matrix https://blog.koehntopp.info/2024/02/13/the-matrix-trashfire.... As someone who uses Matrix, I’m hoping they bridge the UX gap sooner than later.

XMPP and IRC are even further away from being viable alternatives.

Yup. No question that UX is critical for Matrix, and many clients are racing to fix that right now.

If we funded XMPP, we could fix the UX on XMPP, rather than reinventing the wheel with Matrix

I dunno; if an open source project wants to take public sector funding, then some kinds of public sector oversight (e.g. public sector requiring security audits, or SBOMs, etc which they pay for) could be very desirable indeed.

If your implication is that the government who's funding it might then try to leverage the project somehow (e.g. insert a backdoor or whatever), then we're back with the original problem of needing to protect FOSS projects from malicious actors wherever they come from.

I'd argue that the benefits of actually being funded massively outweigh the risks of the funder going rogue, given you can use the funding to build checks & balances to protect against malicious activity no matter the source.

IMO we should start an Office of Digital Infrastructure if we want things like software BOM and software oversight. If the government wants secure code they should write the code in a controlled environment. They can run it similarly to an open source project (take pull requests from the general public) but it should be clear that the responsibility lays 100% at their feet.

I don’t think most open source projects really inspect their dependencies that well. Lots of these projects are community/hobby things, they should be treated as such.

I found this post to be interesting discussion on how a not profit organisation could practically operate to support FOSS maintenance. It still has risks surrounding infiltration by bad actors, but mitigation is easier since staffers are paid. https://www.tbray.org/ongoing/When/202x/2024/04/01/OSQI

Reply on news.ycombinator.com