No matter what your belief is, I think we can all agree that a user with the name Michael Collins defending the moon landings is probably one of the best examples of nominative determinism we will ever get
538 karma · joined May 3, 2022
> …
> Klein told French news outlet Le Point that his intention had been to educate people about fake news online
While I respect the position that people should always check sources, “person famous in their field posts a lie about something well within their field, then tut tuts when people outside their field believe the expert” feels a bit too smug to me.
When you start playing the HA game, the easy failures go off the table, and things break less often because “failures happen constantly and are auto-healed”. But when your virtual IP failover goes sideways or your cluster scheduler starts reaping systems because the metadata service is giving it useless data, you’re well into an infrequent, complex failure, and I hope you have a good ops team.
It’s always a trade off.
A trademark dispute is a civil issue between two parties. We have legal systems to solve these. Cloudflare should ensure that their customers get timely notification of complaints, and that’s pretty much it.
> That said, maybe they would indeed not license to the three "biggies"
I think it's actually likely the other direction: I suspect Mongo has been working with all three to get it licensed as a service, and any hesitation is from their potential customers.
I know AWS the best. They want total control, and hate paying other people. They can also afford a long time horizon. They didn't buy Annapurna Labs to offer an alternative to Intel. They aren't going to want to license Mongo because that cuts into margin and costs them control.
True, that is an option. I’ll give anyone odds of it happening ;-)
> While it not be "Open Source" (note the capitals) I don't think anybody has the right to legislate the use of "open source" with lower case letters.
I think talking about “open source” is overloaded to uselessness. I really prefer to talk about licenses.
Even then the consensus I’ve heard from most people who care to think about software licensing is that the SSPL is essentially a weaponized license designed to strip freedoms. Lowercase open source, you be the judge.
Excellent note, and very accurate!
I can start a company that sells your AGPLv3 software tomorrow. I just have to comply with the terms & conditions. If I'm doing absolutely nothing but operating the software without change, I can satisfy the license by saying "git clone github.com/your/software", done.
Where things get murky is on the concept of linking/derivative works. If I operate a cloud service and make changes to your software to make it use my cloud systems efficiently, those changes have to be open-sourced under AGPLv3. Does that leak too much proprietary information about my systems? Very possibly. That might be enough to stop me. But if I keep going down that road, I end up risking a legal argument that our systems have become so tangled together that parts of my software fall under AGPLv3.
For most companies, this is simply not worth the risk. MongoDB took it one step further with the SSPL:
> you must make the Service Source Code available via network download to everyone at no charge, under the terms of this License. [...] “Service Source Code” means the Corresponding Source for the Program or the modified version, and the Corresponding Source for all programs that you use to make the Program or modified version available as a service, including, without limitation, management software, user interfaces, application program interfaces, automation software, monitoring software, backup software, storage software and hosting software, all such that a user could run an instance of the service using the Service Source Code you make available.
This is basically the anti-AWS license: for AWS to run MongoDB proper, they'd need to expose source for huge amounts of their backplane. It's also not open source under almost anyone's definition.
> Does that mean, the owners of the platform to have to pay the other platforms?
No.
Tons of "value-add platforms" exist like this: wrap a bunch of open source up, add a UX layer on top and offer support. As long as you comply with the terms of the license, you can do just that. And many licenses (MIT/BSD/friends) are often complied with by merely redisplaying that software's license in the documentation or on a LICENSES file somewhere.
But there are licenses that are less permissive. The GPL is the one most people think of. If you modify and distribute GPL licensed software to others, you have to share your source. How do you dodge this? SaaS: change the GPL licensed software as much as you want, never distribute it, but instead allow users to interact with it over the network. Totally compliant.
Hence, we got AGPLv3, with this big provision:
> Notwithstanding any other provision of this License, if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge, through some standard or customary means of facilitating copying of software.
Now, if your bundled SaaS solution includes AGPLv3 software, you have to make its code available.
There are interesting questions here ... if you take an AGPLv3 software and slap a nice GUI under it, is that "linking" under AGPLv3? Possibly. There's at least an argument to be made.
> Is there any kind of license that protects the interest of opensource developers.
If your interest is building software and releasing it openly while keeping it away from people who want to monetize it, traditionally the use of AGPL does just that. Google, Facebook, Amazon – I have first or second-hand knowledge that any attempt to bring AGPL into those ecosystems is a hard no without exception.
But, what "interest" are you trying to protect? I have released software under the BSD license that has been adopted in commercial applications. I'm fine with that; it was in my interest to release it under the BSD license, that's all.
Licenses matter. Pick the one that encodes what you'd like to achieve.
There’s way too much nuance to give a clear answer without something being wrong. Give an example?
It rings hollow to throw your hands up at the license part and say - “not my job”. It is. Understanding the legal risk of that dependency is as important as understanding the technical risk.
If your company doesn’t have a license policy, ask for a lawyer to draft that. But I’ve worked at some pretty penny-ante companies before and even they had an acceptable license policy.
If yours truly doesn’t have one, part of your job as the person building the software is to get one drafted.
“I’m going to chose to do Z and A with your software.”
“Moral hazard! Moral hazard!”
Picking a license indicates what you are willing to have others do with your work. If you don’t want people to be able to monetize it, pick a different license.
First, are you in a FCC regulated state, or one of the 21 that have passed their own pole regulations and have very different rules?
Have you negotiated a pole access agreement with the owner of the poles - which might be an electrical company, a municipality, or a Baby Bell? Some of those entities would love to see fiber internet in their community; others will be sure to make your life difficult because you are a competitor. And in some cases the ownership dictates the regulatory framework: a rural electric coop’s poles are handled differently from a municipalities, which are different from a telco.
Does your agreement/regulatory body allow you to do make ready work, or are you depending on the pole owner to do site surveys & line up engineering crews for the other utilities attached to the pole - likely telco, cable, maybe some existing fiber too? Are those poles also running electrical, in which case you’ve got even more headaches to deal with? Is the pole owner or anyone attached to the pole going to try to slow you down by claiming your changes are complex and need additional oversight?
Are you willing to wait, if you are required, for each other utility on the pole to send their engineers out to move their lines so you’re ready to place yours?
Alternatively: you negotiate an agreement with a city to trench in their right of way. One set of local regulators to work with. Looks appealing in comparison, no?
Eventually they decided the network was so damaged that they’d have to do a total rebuild, and that wasn’t interesting. They threw up their hands up and left, giving the city a few million to clean up the mess.
So, careful what you wish for.
That subnet had a handful of mainframes that had the same IP address for decades. When we migrated a handful of systems off those mainframes and onto what were then called "minicomputers" (heh!) they ended up in the same subnet.
Those mainframes ran the ERP system for an entire business unit. Every accounting application lived in or talked to a database in that space. Manufacturing information systems that ran assembly lines called into it. The IVR systems talked to systems in that space. Hell, public facing systems called into it (behind a thick layer of indirection :))
Basically, the systems behind that IP space were responsible for ~5 billion in annual revenue, and it was significantly cheaper to lease back those IPs from AWS, do absolutely nothing with them (in AWS), and advertise routes internally for the systems that still remain on those old IPs.
Another option is to look for a respirator with an exhalation valve. You give up a level of source control but any exhortations to "protect others!" is pretty silly when they come from people who aren't wearing anything to protect themselves. The Aura has a vented model (9211+) which I've not tried but have heard excellent things about.
You could also consider a half-face elastomeric respirator. You wouldn't expect it, but I've found the ones made with a quality silicone material (3m 75xx / Honeywell North 7700) to be far more comfortable than disposable N95s. They have far more breathable area, which is a major plus. When adjusted properly, they also do not "dig into your face" the same way disposable respirators do - you can keep the straps surprisingly loose & still maintain a seal. And they have a much lower TCO because the respirator media lasts for a long time. Muffled speech is the biggest problem, but speech diaphragms go a ways towards fixing that.
In general though, as you move up the ladder of protection you end up using tools that are both more effective & more comfortable. Pre-pandemic I had a crawlspace under my house spray foam insulated. A team of three guys crawled around under my house in mid-August while wearing full face respirators. They told me they were actually more comfortable than the old half-mask / goggles combination they used to use.
How long can a person wear one? The few times I work in office I wear one all day, and don’t find it difficult.
How long can a single N95 be reused? I’d read research indicating the real limiting factor seems to be the quality of the seal, and the straps tend to fail before the mask loses efficacy. Basically, if it seals without air escape, you’re good.
The paper talks about using this to go after people who are creating CSAM. That's a federal crime, which means an investigation will be conducted by federal agents. USAs have a 93% conviction rate – they'll case build like crazy to ensure they get a conviction. Any data point helps.
Plus, they might ask you if you took a photo with your phone – say "no" and they prove you did, and you're also lying to the feds, which is a felony itself.
That's the long lived edge case – I didn't really go into detail, but what the heck.
AIUI, assigning a new IP address to a mainframe isn't really hard: I'm told by reliable sources it's "just JCL, like everything else".
But assigning an IP address to a machine that's had the same one since the mid-eighties? When it has machines talking to it that don't have the concept of "DNS resolution", running programs whose source code was lost a decade ago? And all those things are the revenue critical systems? That's hard.
Talking with colleagues that have done large IP range sales before, this is pretty much the dominant strategy – your agreement sells all your contiguous space, then you have an immediate lease back provision for carved out space that gives you ~decade(s) of lease time to unwind whatever business processes exist that require those legacy IPs remain around.
Most cloud providers do let you run your own software on a managed substrate of infrastructure. But they also let you, nay, encourage you to build on top of their abstractions instead.
One thing that surprised me was that it was actually less cost-effective per IP to sell one large block. It made sense after I thought about it: you can count the potential buyers for a /8 on one hand, but there are tens of thousands of companies that would be willing to buy a /24 or two.
But a side effect of this was that we entered into an immediate long-term lease back for certain key ranges. Even though AWS may own 3/8, you probably won’t see anything in the 3.15/16 space advertised for the next 60 years.
Those edge cases might run deeper than you think, and we are certainly expecting them to last for a while.
If my use case for this device is so sensitive that I’m taking these steps to avoid it being intercepted, any evidence of tampering, even slight, means the device is compromised, /full stop/.
In your scenario when the government hands me three bags of lentils & my device I thank them, walk to the nearest dumpster, and pitch the whole lot in because I have to assume it’s been bugged.
What I've found is exactly what you describe: if I come to legal asking for a "no" – which I've done more than a handful of times – that's an easy answer that comes out of an email. But when I come wanting their approval, if I can get past the first meeting with counsel the next one is with officers, you are pitching the benefits while the lawyers are talking about risks, and if you can convince everyone to take the risks you get what you want. Just be sure to write down meeting minutes and send them around; no one at that level was taking notes ;)
"We want to distribute a ton of IP with unclear/insufficient releases" has almost no benefit and a mountain of risk for any company. It's no wonder the lawyers said no.
My past company had a huge pile of credits for certs because they valued them and I figured “I’ve been working with AWS; why not?” I didn’t study or prepare at all and went in using only the hands-on knowledge I picked up over my career.
I came out with all the associate certs, the AWS solutions architect pro, and their network specialty.
As a hiring manager I find certs to be a neutral indicator: you at least have to know the material to get them, but plenty of people learn the material hands-on, not from books.
At around the same time, I was watching HBO’s The Wire. One scene had a high-profile shooting with a frantic police response; people were running everywhere trying to help. The lead commander on the scene gave this instruction to his sergeant: “Slow this thing down to a crawl. Give these bastards no chance to fuck up in a meaningful way.”
And then it hit me. That’s exactly how they ran the calls. I asked them about this, and they said absolutely – human nature, when things are broken badly, is biased towards action. You want to try to make a change, to reboot a system, to do something to hopefully make things better. But often if you were not careful, you risk losing information about the outage you are in. Best case scenario you luck into fixing the problem and don’t know how. Worst case? You’ve changed the state of an already broken system, and have done nothing but add more variables to unwind.
So now, every time I’m on an outage call, I try to do what Wes and Tim and Major Rawls would all do: I take control, pump the brakes, and make sure that we are capturing enough information about the current state that we don’t confuse ourselves further.