FLOSS virtualization hacker, occasional brewer

  • 0 Posts
  • 174 Comments
Joined 3 years ago
cake
Cake day: June 9th, 2023

help-circle

  • I think the OP’s analysis might have made a bit of a jump from overall levels of hobbyist maintainers to what percentage of shipping code is maintained by people in their spare time.

    While the experiences of OpenSSL and xz should certainly drive us find better ways of funding underlying infrastructure you do see a higher participation rates of paid maintainers where the returns are more obvious. The silicon vendors get involved in the kernel because it’s in their underlying interests to do so - and the kernel benefits as a result.

    I maintain a couple of hobbyist packages on my spare time but it will never be a funded gig because comparatively fewer people use them compared to DAYJOB’s project which can make a difference to companies bottom lines.













  • Alex@lemmy.mltoLinux@lemmy.mlCloudflare bankrolls fascists
    link
    fedilink
    arrow-up
    7
    arrow-down
    1
    ·
    4 months ago

    I didn’t know who Kirk was until the assassination I have better things to do with my limited time than go on a deep dive into their history before posting any comment on the news. I kinda got the vibe when I realised that was who Cartman was based on in the recent South Park.



  • There are large areas of open source that don’t rely on volunteer labour because companies with a vested interest pay people to work on them. They tend to be the obvious large projects that are continuously developed and gain new features. The trouble with something like xz is it was mostly “done” (as in it did the thing it was intended to do) but still needed maintenance to address the minor niggles, bug reports and updates to tooling and dependencies.

    The foundations could do a better job here of supporting the maintainers. After Heartbleed the Linux Foundation started the Core Infrastructure Initiative to help fund those under recognised projects. I would hope the people running that could be more proactive identifying those critical understaffed components.

    Edit I think it’s now called the Open Source Security Foundation: https://openssf.org/





  • I would be curious if there have been any pen testing against the police and municipal camera networks in the UK. I wonder how many of the vulnerabilities of the system in the video come from trying to use WiFi to save on costs of hardwired setups.

    We’ve had them for a long time. In the London the “ring of steel” was installed as a result of the IRAs mainland bombing campaign in the 80s and of course has expanded as the various congestion and clean air zones have been rolled out. I doubt it would be politically possible to remove them now. While potential leaks are an issue at least public sector organisations have some degree of accountability for the cock ups.