Comment by ninjagoo | Hacker News Reader

Comment by ninjagoo | Hacker News Reader

> We are joined by Amazon Web Services, Anthropic, Chainguard, Cisco, Citi, Endor Labs, Ericsson, Google, IBM, JPMorganChase, Microsoft and GitHub, NVIDIA, OpenAI, RapidFort, Red Hat, Rust Foundation, Sonatype, Vodafone, and Zscaler

A lot of open source folks are going to be very skeptical, rightly so, of this group of players.

> ... to find, fix, and responsibly disclose vulnerabilities in critical open source software ...

How this is implemented is going to be key. Are they going to contribute through (a) existing channels, pull requests etc. or (b) are they going to fork the projects under the guise of 'security' or (c) offer bug bounties or (d) contribute financially?

Approach (a) brings the community along. (b) alienates the community, splits resources, and in the long term will likely cause many open-source projects to die. (c) has potential but timing and speed can be unfavorable for critical bugs, and doesn't mesh with 'responsible disclosure'. (d) can be ineffective for critical bugs unless paired with support for maintainers, which can be incredibly helpful for the opensource ecosystem.

Keep in mind that while I am employed by the Linux Foundation, I know nothing of the internals of this project; I will speak, instead, of what the projects I support do.

I have found (c) to be high noise, low signal. We're winding down our HackerOne program.

D: we do this in a couple ways. For PQCA, for instance, we use credits from AWS to get access to hardware to run proofs and CI on. PQCA also has a paid mentorship program.

For OWF, we do the same with AWS credits, as well as provide hosting for projects to run services on for testing.

For LFDT, we offer paid mentorships, have paid for Trail of Bits to do reviews, and run events. We had a maintainer summit in New York in January so our maintainers could meet for two days face-to-face. We fund large GitHub CI runners for projects as well.

I know it doesn't answer everything, but our team is only a few people and we really do work hard to help developers. What I'll call the devrel team for OWF/PQCA/LFDT is three FTE, one contractor, and our manager.

LFDT: https://www.lfdecentralizedtrust.org/

OWF: https://openwallet.foundation/

PQCA: https://pqca.org/

PQCA benchmarks, for instance: https://pq-code-package.github.io/mldsa-native/dev/bench/

It doesn't help that "Akrides" sound like a Bond villain EvilCorp run by Dr Ambergris whose face is horribly disfigured from a series botched face lifts that's plotting to populate Mars with big boobed clones running around dressed only in brassieres, just like his lead concubine, Dorothy "Dirty" Sanchez (Don't blame me for Kam Fleming's knack for double entendres...) who leads his team of equally big boobed secret helicopter pilotresses.

This is, of course, ridiculous, and Dr. Ambergris is just an amalagam of Muammar al-Gaddafi and some 2nd rate wannabe strongmen not worth mentioning that I made up for fun.

The name is of Greek origin https://en.wikipedia.org/wiki/Akritai from frontier soldiers guarding the Byzantine empire's borders.

A group that is working on developing streamline rules for fixing security.

> Byzantine

Not the connotations I would aim for, but after looking at the organisations involved it's probably apt.

> A lot of open source folks are going to be very skeptical, rightly so, of this group of players.

You say this as if these players aren't members of "the open source folks". It's not an exclusive club.

I don't see how that was implied? Just because someone is part of the "club" doesn't mean many other "members" can't be skeptical of their role.

In fact, it doesn't even seem difficult to simultaneously acknowledge and commend the valuable role they play, while also expressing concern over the influence they wield and how it might contrast with desires and goals of the wider community.

They are the wider community. Programmers working on behalf of corporate actors write open source code in the commons because their organizations have discovered competing on some parts of the stack isn't as viable as collaborating on parts of the stack.

I won't pretend to speak to specific numbers, but a huge amount of work and maintenance is from these programmers, or funded via the corporate actors which employ these programmers. Those actors are either on this list, or don't have a problem with this list.

What remains are the handful of truly independent contributors, which are a minority in terms of LoC (though they often have an outsized impact), and the peanut gallery.

Open source wasn't always this way, it would be a different discussion 30 years ago when independents were the only guys in town, but it is now.

I am not sure you'd be right if you see what people use vs what other companies use.

I'm sorry, your response does not adress the real world concern about the powe that for-profit entities wield over the entire software industry. So I am going to assume you just want to focus on part of the problem.

> alienates the community

That's a feature to them, not a bug. They want the software and don't want the community.

My best understanding from reading this is a) where possible and b) where necessary. This is the Linux Foundation, so it must put OSS and community first, surely.

People talk about contributing financially, but how and to what end? Most projects aren't set up to accept or utilise donations. That said, I would say we should be providing all OSS projects with significant access to AI in order to review their codebases and PRs and hopefully relieve some of the maintenance burden. I know there are some initiatives in this area already.

> This is the Linux Foundation, so it must put OSS and community first, surely.

Linux Foundation is run by the said called corporates from the list. So is Rust Foundation. Linux in itself is safe cos Linus controls it. Not the rest of the projects LF controls.

So far, the Linux Foundation, from what I have seen, has pretty darn good track record of keeping the projects under its umbrella open source, even going against corporate sponsors to do so. For a recent example, see the recent NATS tuffle. (And I should.recognize that Synadia, finally, did the right thing and backed down).

To add to this, I've experienced all sides of the LF and they are the only organization I trust at this point. Donating a project to them is A Good Thing.

There's bureaucracy of course but the mission is clear. Highly recommend working with them in any capacity.

Um, the Linux Foundation is an industry body, not a user or community group. You seem confused?

I am pretty sure that these industries use the open source projects the Linux Foundation maintains. So it is pretty clear the Linux Foundation is indeed a user community group, too.

These are also some of the largest Linux code contributors as well.

No, not really, and I don't think you need to be snarky.

It may be an industry body, but it runs multiple community conferences and projects which support Open Source. A notable example in this case being the OpenSSF https://openssf.org/

The LF is not perfect, but I would expect them to come from an OSS and community angle on this.

Remember when google set up a whole project to find vulnerabilities but never sent any fix and unpaid developers were basically having to fix things that an entire team of people was hired to find… yeah maybe they could have just made an offer to some maintainers instead of burning them out?

They are contributing back, which is a good thing. Other companies just fork, fix, and forbid to contribute back.

Burning out maintainers isn't "contributing back".

Do you have any examples of Google submitting vulnerabilities and refusing to assist maintainers create a patch when asked to do so?

Wasn’t that a story with ffmpeg a few months ago? And people were getting roasted for even the suggestion that google should contribute patches?

People were getting rightly roasted for calling google a leech when A) google does donate money to ffmpeg and B) that bug was in a weird format google almost certainly has disabled so they're not reporting it to get free labor.

From the horses mouth: "Michael Niedermayer, a leading FFmpeg developer, tweeted, “I am the main developer fixing security issues in FFmpeg. I have fixed over 2700 Google OSS fuzz issues. I have fixed most of the BIGSLEEP issues. And i disagree with the comments FFmpeg (Kieran) has made about Google. From all companies, Google has been the most helpful & nice.” https://thenewstack.io/ffmpeg-to-google-fund-us-or-stop-send...

Sounds like Google has been very helpful and nice.

https://linuxiac.com/libxml2-becomes-officially-unmaintained...

Maybe you posted the wrong link- I don't see anything at all about Google making a report or being asked to do anything and declining?

Is this an oblique reference to OSS Fuzz, or something else?

It seems weird to blame Google here, given that they didn’t manufacture the bugs: the bugs were already there, and they just found them. This is arguably the best thing for all parties: open source maintainers are still under no obligation to fix things, but downstreams can properly inform themselves about the risks they inherit by using any given project.

The alternative is a “don’t ask, don’t tell” system, which people generally agree doesn’t work well in other aspects of life.

Yep. This was my first thought when I saw what it does and who's on board. The commons cannot be in the hands of for-profit companies. What ever this needs to be it has to be distributed so no single centralized location or entity can exercise control over it.

> one confidential, trusted place to coordinate discovery, remediation, and disclosure

I read this they would build the patches privately (or with maintainers if confidential) and then share amongst their supporters before public release.

This looked great until I saw that list. It feels, to me, as if all of these companies are scared of the risk. The risk that decades of tech debt and shitty products sold at a premium built on other people's work will now come back to reverse brand fuck them.

I've worked for one of these companies and it was built on OSS and they contribute absolutely nothing back. They just take. And they've literally built a product of duct tape and band aids out of OSS that they charge a premium for.

What a joke. This week keeps getting more bizarre by the hour.

Which one

Z.

Total dumpster fire of a company. They acquired a company called Edgewise and it was so bad that after a number of P0 outages in customer networks they pulled it from the market. I was there less than 6 months after constantly arguing with leadership about how the product was not production worthy. They pulled it about 3 months after I left.

But while I was there I saw just horrid things within ZPA and ZIA (their core products at the time). And with that so many GPL violations, which seems to be the norm within the security market, anyway.

Option (c) is now thoroughly outdated in the age of AI. Offering a bug bounty attracts the kind of people who think they can make a quick buck using AI and then flood you with bogus bugs found by non-SOTA models. See curl.

What worked is to remove the bounty and simply allow people to report bugs responsibly. This attracts the kind of altruistic volunteers who want more secure software for ideological rather than financial reasons. They still use AI but you won’t see slop.

Note that the LF of today is basically just like any other global corporation with its own political agenda. You can just follow the money, and see that it is controlled by corporations. They neutered Torvalds, are very woke, and generally a nightmare to work with.

I always advice aspiring open source enthusiasts to stay far, far away from the Linux Foundation. It has become a barrier to software freedom these days, rather than an enabler.

You realize that the companies listed employ many of the core open source maintainers for large projects? It is project-specific, but 80% of Linux kernel development is from paid corporate employees. Similar for kubernetes. All the load bearing infrastructure is already handled by these companies... literally no one else is going to have the resources or experience to redirect large efforts on securing F/OSS.

What would you propose otherwise?

I guess you'd rather downvote than answer the question.

Reply on news.ycombinator.com