OpenBSD Project in Financial Danger

DieNadel writes "In an entry to the OpenBSD Journal, Marco, from the OpenBSD project, warns about the somewhat disturbing financial situation in which they are now. The OpenBSD team is the one that also develops the OpenSSH suite, used nowadays almost everywhere. From the entry: 'What I want to point out what a lot of people don't seem to realize is that OpenSSH development is paid from the same pool of money as OpenBSD. OpenSSH is in use by millions around the world however the revenue stream just simply isn't there. This is where other projects could help. Without naming entities or projects by name there are others out there that are sitting on some cash. It would be wonderful if these entities could share some of the wealth to keep us going.'"

Comments

Just waiting

[gregarican]

...for Netcraft to weigh in on this one :-)

Sad

[r2q2]

This is really sad. I used to use openbsd and it is a great project. Very easy to install and a nice fast text based installer. Hopefully someone can pick up the slack and donate to this great project.

Re:Sad

[MikeFM]

Do they have a page with info on how to donate? I don't use OpenBSD but I do use some of their other work so I'd be willing to toss in a few bucks here and there.

Re:Sad

[danielk1982]

Hopefully someone can pick up the slack and donate to this great project.

You?

Re:Sad

[compass46]

http://www.openbsd.org/donations.html

Re:Sad

[TedCheshireAcad]

I am sure they will find the magical Open Source revenue stream somehow.

Re:Sad

[Cid Highwind]

Bottom line: OSS is a wonderful idea... like communism. You will find pockets where it works. But overall it falls on its face.

What sort of reality-distortion field are you in that it looks like Linux, GNU, FreeBSD, Mozilla, and OpenOffice are mere "pockets" of success and OpenBSD's perennial financial trouble is the "overall" situation?

Re:Sad

[Pantero Blanco]

Then why do most other major F/OSS communities NOT have this problem?

The reason this is happening to OpenBSD isn't because they're relying on donations and support money...It's because many of the prominent members of their community have alienated those who would otherwise be willing to shell out cash. Bad salesmanship will kill businesses and organizations alike.

Re:Sad

[emag]

Bingo. It gets even worse when the "company" is "the government". I'm aware of at least one situation where a group in a government agency is using OpenBSD for their firewalls. They can't legally make a donation, but have absolutely no problems spending $500+ on software, even "free" software. They have bought CD sets, but really would like to do more (and had approval to spend more than $50), but AFAIK the OpenBSD project makes it *extremely* difficult for companies and organizations to do this. "Donation" just doesn't parse financially for a lot of groups, while a $500 or $1k "enterprise", "professional", or "corporate" product, even without any material difference to the downloadable or $50 version, is a lot easier for companies to justify, account for, and get approval and funds for.

So, I can't say I'm really surprised that they're having difficulties, as their stance on accepting money is the same as the perceived stance on everything else, namely "our way or the highway", even when it causes them more potential harm than good.

(Yes, I'm aware that some third parties do offer a "more expensive" option of obtaining the CDs, and throw in some consulting, donating the monies above the material CD cost back to OpenBSD, and applaud them for that)

Re:Sad

[MikeFM]

Thanks, I might suggest they offer PayPal subscriptions as an option so that every month we could have $5 donated or something like that. $5/mo is easier than $60 once a year but I won't remember on my own.

It'd be great to be able to donate funds through Freshmeat or something like that where we could go through and pick out our favorite projects and set-up a donation schedule.

Re:Sad

[B747SP]

> Hopefully someone can pick up the slack and donate to this great project.

Yeah, someone ought to do something about that

(Note to Americans with mod points: that's sarcasm, kthxs)

Re:Sad

[Walkiry]

>What sort of reality-distortion field are you in that it looks like Linux, GNU,
>FreeBSD, Mozilla, and OpenOffice are mere "pockets" of success and OpenBSD's
>perennial financial trouble is the "overall" situation?

Redmond?

Re:Sad

[drsquare]

But that Theo de Raadt is such a nice guy, who wouldn't want to give him money?

Sorry, Theo

[bellers]

Dear Theo:

Maybe people are deciding you're just too much of a douche to put up with.

I'm sure if you run out of money and cant work on openssh anymore that someone with the time and resources will pick up the ball and run with it. Such is the nature of OSS.

Love,

the Free Software Community.

Re:Sorry, Theo

[miscz]

Love,

the Free Software Community. Ummm, are you the entire free software community?

Seperate the openBSD & openSSH projects?

[tpgp]

I know some large companies (cough*apple*microsoft*redhat*cough*) can certainly afford to support openSSH, and need the project to continue running.

These companies however would not want to give to an operating system project that competes with them.

Maybe the openBSD & openSSH projects should seperate?

Re:Seperate the openBSD & openSSH projects?

[zerocool^]

Maybe the openBSD & openSSH projects should seperate?

This is exactly the first thing I thought when I read this story. It sounds like the developers are yelling: "OH NOES, OPENSSH IS DYING, WE NEED MONEY!!!!11", and then honest people, who want to support openssh, ask "How can I support OpenSSH?". The answer given is "Give money to OpenBSD."

To me, that's unacceptable. It's classic bait-and-switch. I use OpenSSH every day of my life and if you count scripts and cronjobs, probably every hour of my life. But I could give a shit about OpenBSD. So, while I'd be willing to help OpenSSH out, I want to know that my money is being spent on OpenSSH. I don't want the overhead going to OpenBSD. There, I admit it - I expect something in return for the money I donate - it's my money so sue me.

You want to get support for OpenSSH? Fork off the legal entity and make an OpenSSH foundation which can accept donations directly. We're not going to solve your OpenBSD problems for you, though.

~Will

Re:Seperate the openBSD & openSSH projects?

[justins]

To me, that's unacceptable. It's classic bait-and-switch.

Yes, those OpenBSD guys are the typical evil marketing geniuses, just sucking you in with one thing and then trying to sell you something else. Damn them and their not-for-profit, giving all their software away, could use some donations please to continue their work ways.

Oh the nerve!

Re:Seperate the openBSD & openSSH projects?

[peacefinder]

"I like my tax money to fill potholes in the street outside my house, but not the ones in front of your house. Screw taxes, I'm not paying!"

Same argument, only taxes aren't voluntary. This is.

(Don't forget that the money you might give only to the OpenSSH project would go towards ensuring it works on about a dozen hardware platforms. I suppose you'd prefer that such money go only to OpenSSH/i386, because that's all you think you use?)

Re:Seperate the openBSD & openSSH projects?

[Jack9]

If eighty cents of every dollar I spend supporting OpenSSH gets flushed down the OpenBSD toilet, is that a good use of my contribution?

This is called a valid point. Contribution would support the continued marriage of OpenBSD and OpenSSH, which does not need to exist. I understand.

OpenSSH would not have existed (in its current form) without OpenBSD. OpenBSD continues to provide a solid theoretical and practical framework for OpenSSH. I see nothing productive about a divorce, outside of serving the DeRaat-hating egos. If you are adamant enough, write a check directly to Tatu Ylönen.

Unfortunately, I believe you are simply posting to make noise.

Re:Seperate the openBSD & openSSH projects?

[peacefinder]

"I wish you, and everyone else here, would stop putting words in my mouth."

Sorry, but it seemed a reasonable analogy to respond to an apparently unreasonable person. Your comment made you sound like a heartless greedy bastard, and evidently I was not the only person to read it that way. If that is not the impression you meant to give, you might want to take it up with your ghostwriter. :-)

On a much more civil note, please remember that the project linkage you call wagging the dog exists for historical reasons: OpenBSD developers wanted a free version of SSH, so they made one. Then they gave it away. That same developer pool still maintains it, because the OpenBSD project requires a free and highly correct implementation of SSH and they think they are maintaining a better one than anyone else is. I'm sure they're delighted that world+dog uses their tool, but that's ancillary to what they're interested in doing. It's not really a separate project, it's just part of the toolkit OpenBSD develops for its own use and gives away freely.

(Also, don't forget that OpenSSH profits from being developed on and by OpenBSD. Their coding and auditing practices with an eye towards correctness and security make it a very reliable tool.)

Of course, you still may not like this. That's fair enough. But I seriously doubt they'll alter their practices to suit you... especially since you didn't ask nicely or say please.

So you have some choices: Stand aside and let other people donate to support OpenBSD and its child project OpenSSH, overcome your objection and donate to them knowing that much of your donation will go towards other projects, or do it your own damn self.

It's BSD licensed code, after all. If you don't like the way they're handling the business, just grab the source and arrange to maintain it yourself. Or start a foundation, or a for-profit, whatever. It's free code.

If, like me, you lack the interest, time, and expertise necessary to do this, then I'd suggest that you stick with one of the first two options. And if, as you said, you use and appreciate OpenSSH, then I'd suggest that the second option is more likely to achieve the results you want.

(Incidentally, the article quoted marco out of context. He mentioned OpenSSH as part of a pitch for OpenBSD donations, not the other way around. See the whole thing here.)

Re:Seperate the openBSD & openSSH projects?

[Alioth]

Do you use the X Window System (i.e. any Unix desktop?)
In which case, OpenBSD is helping you. OpenBSD's new safer malloc()/free() implementation found security bugs in x.org recently.

Same goes for most things that end up as part of OpenBSD - the stricter environment of OpenBSD shakes out bugs and the entire community benefits, not just OpenBSD users.

OpenBSD benefits far more than its immediate userbase.

BSD is dying...

[ichin4]

...oh wait, I guess it really is!

Do what you can.

[Inoshiro]

As Maddog put it:
"I believe it was at a conference in Australia (also in the 1996-1998 time frame) that I ran into a rather despondent Theo de Raadt, who told me that for lack of $300. his ISP was going to turn off the project's servers. I took out my checkbook and immediately wrote him a personal check for $300., to keep the OpenBSD servers alive. My comment to Theo was that "your project is too valuable to let die over a measly $300.""

If you're really poor, just donate 5$.

Re:Do what you can.

[stlhawkeye]

Two days later, I saw Theo with a new iPod and he was not despondant at all.

Re:Do what you can.

[paiute]

And how much did it cost him to get to Australia?

Re:Do what you can.

['nother poster]

Well, if he was presenting at a conference, the conference most likely picked up the tab for transport and lodging. That's usually how it goes.

Re:Do what you can.

[Suppafly]

Only high-profile speakers get their expenses covered by the conference itself, and only if the conference has a high budget.

No, if they want to hear what you have to say, they will pay for it. You probably just aren't that good at negotiating.

Re:Do what you can.

[LinuxGeek]

If he was at a conference, then he probably had his travel expenses paid by the organization. Very common.

Also, I just sent a donation to OpenBSD via paypal. Even if I don't think of Theo as the greatest guy in the OSS world, the project is very important to keep alive, and not just for the OpenSSH portion. The OpenBSD group has made a public plea for support and I'm dissapointed to see something along the lines of "needing money, huh, hehehehe then just suffer bitches..." from many posts here.

I'm sure that talented people with a little spare time will read those kinds of posts and be glad to spend a year or two writing something cool and useful for you. With these attitudes, they may get what they are really begging for; a computer running microsoft software because developers got tired of people not stopping at mere indifference towards the projects, but happily extending into ridicule. What a grateful bunch we must seem to be.

Does it matter?

[MrChom]

The SSH project will stay in development with or without BSD, there's no issue here of what would happen if OpenBSD ceased to exist. It's kinda like when most apps on Linux die, or simply cease development...if it's important then someone is there to pick up the pieces.

order an OpenBSD CD

[lotzmana]

Brother, improving your security is as easy as ordering a CD: http://www.openbsd.org/orders.html

The CDs that OpenBSD project sells is their main source of revenue and support.

Re:order an OpenBSD CD

[SteeldrivingJon]

"The CDs that OpenBSD project sells is their main source of revenue and support."

It obviously, and unsurprisingly, isn't working for them. They should work on finding other ways to raise money.

How to get the money

[rice_burners_suck]

Somebody needs to set up a site where we can donate money to the OpenBSD project through PayPal or some other convenient method. This is an important project, and I think that a lot of people in the community realize that, but take for granted that development happens "for free."

I also think that the OpenBSD project needs to start operating a bit more like a business. Services need to be offered that bring in a healthy revenue stream. Two areas where the OpenBSD development team excel are cryptography and code auditing. Both are related to security, which is a good industry these days. The OpenBSD site could offer paid services, such as code auditing for other projects to enhance security, etc. The OpenBSD developers should also set up a consulting business that performs setup and maintainance of OpenBSD installations, perhaps primarily for small businesses that aren't in the IT business, such as clinics, legal offices, automotive repair facilities, family operated stores, etc. These are relatively simple setups for those familiar with OpenBSD and projects from the larger open source community, and the effort would be minimal. These small businesses would be willing to pay a reasonable price for the service, since they would save greatly on software licensing.

All of those methods could be used to bring in a healthy revenue stream for the OpenBSD project. But in the meantime, please get a PayPal account set up!

Re:How to get the money

[dkaplowitz]

"Somebody needs to set up a site where we can donate money to the OpenBSD project through PayPal or some other convenient method."

http://www.openbsd.org/orders.html

Re:How to get the money

[Penguin Programmer]

Somebody needs to set up a site where we can donate money to the OpenBSD project through PayPal or some other convenient method. This is an important project, and I think that a lot of people in the community realize that, but take for granted that development happens "for free."

They have a paypal link on their website. http://www.openbsd.org/donations.html

How you can help

[karmawarrior]

Software development costs money. When people like Theo work their asses off to get us high quality programming, like OpenBSD, OpenSSH, PF, and a host of other excellent operating system level tools and frameworks that most of us use every day without thinking about it, they need to be rewarded, not just because they've done a good job, but because every minute they devote to making these things for us, is a minute they can't spend on work that puts food on their plates and roofs over their tables.

Unfortunately, they know that the best value they can give to the tools they provide is to make them free. But as long as the tools are free, there will always be those parts of society that do not contribute to the costs of their creation. And, unfortunately, that's not a minority of people. When was the last time YOU gave money to OpenBSD?

This quagmire of people being unable to develop that that should be free will not disappear by itself. Resources need to be devoted, and unless people are prepared to actually act, not just talk about it on Slashdot, nothing will ever get done. Apathy is not an option.

You can help by getting off your rear and writing to your congressman or senator. Tell them that critical free software is important to you. Tell them that you appreciate the work being done by the OpenBSD and GNU teams to support you with the software you need in your life but that if cheapskates keep refusing to contribute to the projects, ensuring people like Theo are not forced to hold down proper jobs, you will be forced to use less and less secure and intelligently designed alternatives. Explain the concerns you have about freedom, openness, and choice, and how a lack of money for Free Software harms all three. Let them know that this is an issue that effects YOU directly, that YOU vote, and that your vote will be influenced, indeed dependent, on their policies on funding Free Software.

You CAN make a difference. Don't treat voting as a right, treat it as a duty. Remember, it was thanks to ordinary people like YOU that we are now seeing such innovations as SMP in OpenBSD. Keep informed, keep your political representatives informed on how you feel. And, most importantly of all, vote.

Re:How you can help

[stlhawkeye]

Software development costs money ... Unfortunately, they know that the best value they can give to the tools they provide is to make them free.

In order words, we're discovering that handing out quality products and begging for money in return doesn't work. Is anybody really surprised?

When was the last time YOU gave money to OpenBSD?

When I bought OpenBSD 3.2 and it took them 4 months to ship it to me, and it arrived in broken jewel cases and the source CD was scratched beyond readability. That's why they aren't getting any more money out of me.

You can help by getting off your rear and writing to your congressman [house.gov] or senator [senate.gov]. Tell them that critical free software is important to you. Tell them that you appreciate the work being done by the OpenBSD and GNU teams to support you with the software you need in your life but that if cheapskates keep refusing to contribute to the projects, ensuring people like Theo are not forced to hold down proper jobs, you will be forced to use less and less secure and intelligently designed alternatives. Explain the concerns you have about freedom, openness, and choice, and how a lack of money for Free Software harms all three. Let them know that this is an issue that effects YOU directly, that YOU vote, and that your vote will be influenced, indeed dependent, on their policies on funding Free Software.

Are you kidding? You want me to encourage my congressman to publically fund open source software? You want the state to get involved in software development? Because you do you realize that the government doesn't just write blank checks. Not even Halliburton gets a blank check, there's strings attached to all this shit. Do you really, seriously think it's a good idea to turn open source software funding over to the government? Because you know what's goign to happen. We get fat sucking off the public teat and when the government wishes to change something in how that software works because our reps are getting lobbied by the RIAA, they threaten to cut that funding out unless we incorporate (or don't incorporate, or stop development on) some specific feature or package that a lobbyist finds to be inconvenient. Like p2p technology.

You CAN make a difference. Don't treat voting as a right, treat it as a duty. Remember, it was thanks to ordinary people like YOU that we are now seeing such innovations as SMP in OpenBSD. Keep informed, keep your political representatives informed on how you feel. And, most importantly of all, vote.

No, sir, you can shove your socialized software up your ass. I want my government staying as far away from OSS as possible.

Re:How you can help

[Billly Gates]

Right on

Just say no to TCP/IP, BSD UNIX, WWW, the Internet, FTP, and many algorithms used for smp systems and servers.

If it were not for uncle sam you would be paying $50 a month for AOL or CompUserve on a dialup modem with no interent nor innovation.

The government is not that evil in doing things like setting standards and funding research that private industry can't do because of their need to generate profits.

I have no problem with academia sponsoring OpenBSD because it will help everyone including business and personal use. OpenSSH is the result of free software and so is the web and apache.

Its not that evil folks and the government is not always bad. Sometimes its needed because the industry can't help itself.

Consider going GPL?

[argoff]

OK, I apologize in advance because I already know this is going to piss some people off, but why don't they try going all GPL. That would make it so that proprietary development couldn't fork off the code base and so would probably make the project leads a center point for support, services, and custom jobs. Lots of other people like Red Hat are making money this way, I don't see why the OpenBSD team couldn't do it too. The fact that the free software movement is exploding in cash while Open BSD is suffering - shouldn't that be telling us something?

Re:Consider going GPL?

[m50d]

Switching would also be in violation of the rights of those who contributed code under the assumption of BSD; switching thus isn't legally viable.

Erm, the WHOLE FUCKING POINT of being BSD rather than GPL licensed is that you CAN change the license. Go read the BSD license. You're permitted to redistribute the software under pretty much any terms you want.

The GPL isn't free software - it's communal software as in communistic communes or hippie communes.

The only way to be truly free is to put it in the public domain. You have to pick a line where you feel software is "free enough" - Stallman's four freedoms seem a pretty good place.

The BSD style license enables true freedom for authors and users alike. Freedom to fork. Freedom to contribute. Freedome to use.

All those are freedoms you have with the GPL

The GPL is so complicated how many of you have actually taken the time to read it?

I have. It's only a page or so, less if you skip the preamble (which isn't part of teh license itself)

It bases is communistic society on rules that restrict your freedom by putting limits on what you can and can't do with it.

The only restrictions there are are there to preserve the freedom of others. Is the only free society a complete anarchy?

For example, you are not free to develop with it and sell your modified versions without contributing your source code back to the commune.

False. You have to give the source code to the people you sell the program to, and you have to give them permission to redistribute and modify it. That's all.

And if you're going to be picky, am I free to sell a warrantied version of BSD software? I don't see how I can.

Re:Consider going GPL?

[Ded Bob]

Erm, the WHOLE FUCKING POINT of being BSD rather than GPL licensed is that you CAN change the license. Go read the BSD license. You're permitted to redistribute the software under pretty much any terms you want.

You are not allowed to change the license. You may add restrictions, such as the GPL, to the code, but the original license stays.

The only way to be truly free is to put it in the public domain.

I think I have read that in the U.S. it is safer to have an AS-IS license (MIT-style) since people will have an easier time suing you if it is public domain. :(

All those are freedoms you have with the GPL.

In this case they are not since the BSD definition of use (almost any development or running the program) is different than the GPL definition (GPL development or running the program).

The only restrictions there are are there to preserve the freedom of others.

A BSD license does this by allowing anyone to do almost anything with the code. You are not bound by more restrictions. Which is freer for you? More restrictions or less restrictions?

False. You have to give the source code to the people you sell the program to, and you have to give them permission to redistribute and modify it. That's all.

This is untrue. You are not allowed to sell GPL'd software unless all authors of the software are in agreement with the action. You may charge for the distribution of the software as long as the fee applies solely to the distribution . This is according to the license. As long as someone receives the software, they may request the source by which you, the author(s), must comply.

And if you're going to be picky, am I free to sell a warrantied version of BSD software? I don't see how I can.

Yes, you may. You may add a warranty to BSD (or GPL?) software as long as it applies to you. You cannot add a warranty on anything that makes others responsible for what you warranty.

Re:Consider going GPL?

[Compenguin]

This is untrue. You are not allowed to sell GPL'd software unless all authors of the software are in agreement with the action. You may charge for the distribution of the software as long as the fee applies solely to the distribution . This is according to the license. As long as someone receives the software, they may request the source by which you, the author(s), must comply.

Just because you have to make the source available to anyone who receives the software and you can't limit their redistribution does not prevent you from selling GPL'd software without the authors consent.

See http://www.gnu.org/licenses/gpl-faq.html#DoesTheGP LAllowMoney

Re:Consider going GPL?

[labratuk]

You are not bound by more restrictions. Which is freer for you? More restrictions or less restrictions?

This is the dumbest line of thought that I continually hear. If you're going to try and distill your argument to fundamentals, you've got to make sure your argument makes sense in the first place.

Do you think we would be more free if there were no laws? Sure, we would be free to do some things which the law currently prevents us from doing, but do you think you'd have the freedom to walk to the end of the street without getting mugged at knifepoint?

Or as it as been put more concisely: "Without rules, we have no freedom."

Re:Consider going GPL?

[m50d]

Ok, swear words, while highly colorfull and fun to use, are not necessary for this discussion.

They are when you miss the point that badly. You claim changing the license on a project other people have contributed to would be unethical. And yet you prefer BSD to GPL because...it allowes you to change the license on a project other people have contributed to?

While others can distirbute their enhancements under modified terms the original authors code remains under BSD terms regardless of the actions of others. This power comes from Copyright law.

Sure, openssh 4.2p1 is and always will be BSD. But there's no reason on earth Theo can't simply announce that official releases from the Openssh project will now be GPL. They have the right to distribute all the code they currently have under GPL - the BSD license allows you to do this - and they could also add code from other GPL projects, which would be useful. New submissions could either be BSD or GPL licensed. Anyone who wanted it to stay BSD could fork the last BSD-licensed version, like with the xorg fork of xfree86 (which forked the first beta of 4.4 because the license changed happened with the second beta, at least iirc)

While the GPL provides a few "freedoms" it does so at a tremendous expense: the authors rights using the mechanisms of many restrictions; this is what many, including I, object to.

What restrictions? There are restrictions on the terms under which you can redistribute. That is all.

BSD style licensed projects have been very successful with no anarchy present and notably with no need to enforce people's natural desire to contribute with rules as the GPL does.

They have. On the other hand, they have also meant e.g. Apple has a superior OS to anything in the free software world, because they can take anything they want from the BSDs, add their own stuff to it, and no-one else is able to use the stuff they've added. There are plenty of generous people, but there are also people and businesses who are not generous - and those are more of a threat, and more to be concerned about.

At the expense of the original authors, thus the GPL compromises (in the dark sense) the rights of the original authors.

How? The original author has all the rights they would, and can relicense under any terms they choose - look at trolltech, mysql, or plenty of others. The only people whose rights it restricts are the redistributors. Yes, GPL puts the rights of the user above the rights of the redistributor they bought the software from. I think this is the right way around for things to be.

You made my point for me - you give up your rights with the GPL. With a GPL'd licensed program you are not free to add your own code and distribute it without also giving your modifications.

But this isn't the author giving up the rights, this is someone else, and the only rights they lose are some of distribution. With BSD it is the author who gives up rights - someone else can take your code, change it, or just pretend to even, distribute the binaries around, even back to you, but not let you see what's happened with your code. And it is the users of this redistributed version who lose rights. GPL gives rights to the author, and it gives rights to the end user - the only people who don't have as many rights are the middlemen.

You may sell a warranteed version of a BSD program if you so choose. However it's you making the warrantee and not the original authors. They'd allowed you and others to freely use the code without any warrantee. If you sell it with a warrantee then you are taking on that legal obligation. Could be risky. Could be lucrative. Good luck in that business.

That's certainly the situation with the GPL - but it explicitly states that you can sell it with warranty protection. The BSD says you have to include their disclaimer of warranty on any redistributed version, and doesn't say anything about selling your own warranty for it. It's probably ok, but it's certainly less clear - which is the price of its brevity. A lot of the length of the GPL is from being clear about things.

Old Joke

[ajs318]

Linus Torvalds and Bill Gates briefly saw Theo de Raadt in the Gents' toilets at an important computer show; Theo left the trough and walked away without washing his hands. A bit later, they saw him again and decided to take him to task over his indiscretion.

"At Microsoft, we always wash our hands when we've been to the toilet!" said Bill, smugly.
"I'm sure all the Linux developers wash and dry their hands when they've been to the toilet!" said Linus, determined to outdo Bill.
"Fuck off, the pair of you," said Theo, "OpenBSD people don't piss on their fingers!"

Hmm....

[Locke2005]

Isn't SCO using the OpenSSH code? Maybe they could kick in a few dollars to help maintain it... after all, won't they be getting several billion from IBM any day real soon now?

Slashdot Editors:Please add this link to the story

[NZheretic]

OpenBSD's Donations:

OpenBSD has no wealthy sponsors, nor a business model.

Naturally, the OpenBSD project requires funds to operate, due to electrial costs, Internet line costs and the same hardware upgrades that everyone must experience. For this reason, the project sells CDROMs and T-shirts and posters. Thus, when you buy an OpenBSD CD, whether at a conference, from any sales site, or from our CDROM ordering page, you are helping to increase the chance that OpenBSD will continue to make future releases.

It is also possible to donate funds or hardware, in which case your name ends up on our Donations page.

Re:Their community

[Minwee]

"I've never wanted to use OpenBSD. The reason? Their community is filled with assholes."

And yet, here you are on Slashdot. How does that work?

OpenBSD offended their sugardaddy

[amightywind]

OpenBSD is a vital project that is lead by an amateur. OpenBSD had a sugardaddy in Darpa, but apparently offended them with negative comments. My question, who does he think will be most interested in his super secure OS?

Re:OpenBSD offended their sugardaddy

[joe545]

So you think that because an open source project has received some US government funding that the high profile members of such projects should voluntarily gag themselves in order to please their sugardaddy?

If de Raadt's anti-war comments were indeed the reason that the funding was pulled, shouldn't you look to blame DARPA for being amateurish/childish and not de Raadt for simple speaking his mind?

Re:OpenBSD offended their sugardaddy

[Reality Master 101]

And back in the real world...

So you think that because an open source project has received some US government funding that the high profile members of such projects should voluntarily gag themselves in order to please their sugardaddy?

You do realize that "the government" is not some monolithic inhuman machine, right? If I'm giving money to someone who mouths off about how I'm "sickening" him, I'm probably going to get tired of it. It's not about "gagging" themselves, it's about wanting a bit of simple courtesy. Not to mention holding a hypocrite responsible. If he doesn't the like the source of the money, then he shouldn't accept it. If de Raadt's anti-war comments were indeed the reason that the funding was pulled, shouldn't you look to blame DARPA for being amateurish/childish and not de Raadt for simple speaking his mind?

Guess what? Free speech does not mean you are free of responsibility. No one said The Rat couldn't say whatever the hell he wanted. But that doesn't mean that the *people* he's insulting have to work with the a-hole.

Re:OpenBSD offended their sugardaddy

[GalacticCmdr]

Free Speech does not mean free from any consquences of that speech. If you are going around complaining how your employer "sickens" you - then expect that your employer will more than likely get rid of you. After all, he had no problems taking the money (even with his lame cruise missle excuse).

Nobody tried to gag him, certain projects just no longer want to be associated with him.

Re:OpenBSD offended their sugardaddy

[Blakey Rat]

Yesterday I sat though a 45-minute lecture on how positive thinking increases water quality and how we're all surrounded by powerful auras that can sour milk if we don't have a positive attitude. This lecture was from a person I work with as I was installing some software on her computer. Now, personally, I think the entire speech was New Age bullshit and it upset me that she was wasting my brain with that drivel, but I didn't say anything. I just grinned and bore it. You know why? Because I'm not a jackass.

It's called civility, and it's called that because it's what keeps civilization going.

He's welcome to have his opinion, and even to state it anywhere he likes-- Canadians have as much free speech as anyone-- but he should have kept his mouth shut and just grinned and bore it, like anyone else would have done. Because he didn't, now he's begging for scraps on Slashdot.

Open Source Funding...

[Anonymous Coward]

What you said may sound troll-ish to some, but it just goes to show how little support there is for open source projects - especially money wise. Everyone here seems to think everything should be F/OSS, and that you should live off support contracts and such. But in reality, 99.9% of the time, it just doesn't work out (and I don't know many coders who want to do a living off answering the phone instead of coding).

There are some great and very useful OSS projects, but I don't make a living that way. My money comes off closed source/proprietary software - on the hugely popular closed platform. It's already hard enough making a living this way, I can't imagine how "easier" it would be if I gave the app away with the source code and let people fork it. I have enough money now to retire at 30, put my kids thru university, etc. Had I gone the open source way, I don't think this would be true.

It's just like websites and newspapers lately. Besides some advertizing (that we block in any way we can like using AdBlock), there just isn't much of a revenue stream. Nobody's really figured it out yet... Yet there are so many bright folks who've been scratching their heads for a while. This could be the 2nd "dotcom" crash - money has to come from somewhere to fund all this.

Re:Open Source Funding...

[EatHam]

there's obviously a problem.

I don't think that wanting to retire someday equates to a "problem". Seriously, you need some schooling. You have some really misguided ideas about investing, the amount of time it takes, and the resources necessary to start. Read the link I gave you. Within two hours (and that just once, not every day) you can be up and running if you choose to.

Re:Open Source Funding...

[eno2001]

Depends on how you measure accomplishment. In my worldview, having money is next to worthless. Leaving behind some kind of useful contribution to the world is true wealth. People who don't understand that have failed at life.

Obligatory Monty Python aside

[phaxkolumbo]

The Dead Collector: Bring out yer dead.
[a man puts a body on the cart]
Man: Here's one.
The Dead Collector: That'll be ninepence.
OpenBSD: I'm not dead.
The Dead Collector: What?
Man: Nothing. There's your ninepence.
OpenBSD: I'm not dead.
The Dead Collector: 'Ere, he says he's not dead.
Man: Yes he is.
OpenBSD: I'm not.
The Dead Collector: He isn't.
Man: Well, he will be soon, he's very ill.

Just joking, here's to hoping OpenBSD gets better (financing) soon. (and you can change "Linux Zealot" to "Man" if you're so inclined...)

quick & painless

[rehabdoll]

http://openbsd.org/donations.html - quite painless.

Sorry, wrong answer

[schnell]

"It would be wonderful if these entities could share some of the wealth to keep us going."

Wow, that's a weak response. It sounds like they're basically asking other F/OSS projects to fork over cash because OpenBSD can't raise money. And it makes F/OSS groups look like the business-challenged hippies that some people think they are.

If you are going to have an OpenBSD organization, then that means that part of your job is raising funds to keep yourself a going concern. Let me repeat: your job is no longer just to write code, but to bring cash in the door so that you can continue to get paid. If you are building products that world + dog are using, then that should be pretty easy. If you are not capable of raising funds, then you need to find someone who is good at it to help you out. There are plenty of those people out there - any semi-competent second-year marketing student should be able to significantly increase their funding channels over what they have now.

I'm sorry but I just don't think you can say, "hey, other open source organizations have done a good job working with the public and the press, and they raised funding, so why can't we have it?" It just hacks me off when programmers complain about the business-types at an organization, then discover it's actually harder than they think. And in this case they have taken the additional step of not trying to remedy the problem, but actually glomming off other groups that have maintained done great work with fundraising and marketing their products.

I have supported OpenBSD myself in the past by buying install discs and T-shirts. I think OpenBSD is a fantastic OS and I will contribute my few bucks here and there to keep them going. But if OpenBSD's answer to their money problems is not to fix their own house but rather to ask others to fork over - it probably means they'll just get in this same hole again later! I think they need to have a better answer to this question if my support (or anyone else's) isn't just going to be money down the drain.

Re:Sorry, wrong answer

[Bogtha]

It sounds like they're basically asking other F/OSS projects to fork over cash because OpenBSD can't raise money.

What are you talking about? Let's look at that quote in full:

OpenSSH is in use by millions around the world however the revenue stream just simply isn't there. This is where other projects could help. Without naming entities or projects by name there are others out there that are sitting on some cash. It would be wonderful if these entities could share some of the wealth to keep us going.

It seems to me that he's talking about businesses such as RedHat, who include OpenSSH in their products, not random open-source projects.

If you are going to have an OpenBSD organization, then that means that part of your job is raising funds to keep yourself a going concern.

And if you were keener on reading the article than flaming, you would see that they had a working revenue stream in the form of selling CDs, but that people were moving away from it in preference to obtaining it for free.

The demand isn't any less, they aren't losing any users, they are just having to deal with people less willing to spend money when they can get something for free. It seems very reasonable to hint - without naming names - that the businesses who base their products on OpenBSD's work should contribute a bit. It's in their own best interests even.

Re:Sorry, wrong answer

[Zontar_Thing_From_Ve]

"It would be wonderful if these entities could share some of the wealth to keep us going."

Wow, that's a weak response. It sounds like they're basically asking other F/OSS projects to fork over cash because OpenBSD can't raise money. And it makes F/OSS groups look like the business-challenged hippies that some people think they are.

Man this is astute. The problem as I see it is that OpenBSD relied on a revenue generating source (people buying CDs) that was a dead end. Go back, say, 2 years ago and yes, I can see someone buying a CD because they don't want to keep their dialup connection tied up for 24 hours to download one CD. I have plenty of friends and relatives who I thought would never, ever get broadband internet who have indeed gotten broadband internet in the past year. When you have DSL or cable modem, why should you pay OpenBSD for the CDs when you download everything you need in, I don't know, say 10-15 minutes and get instant FREE gratification? Any business model they have that relies on people buying CDs from them is doomed to fail.

I gave OpenBSD a chance

[stlhawkeye]

After my Linux box got hacked for the 3rd time, I switched to OpenBSD. Here's about how it went. (1) Go to web site, pay for CDs (2) Wait 2 weeks (3) Wait 3 more weeks (4) Contact webmaster, ask what's going on, receive no response (5) Wait another month (6) Try again to contact somebody at OpenBSD, receive no response (7) Wait two more months, give up on trying to contact anybody, write off OpenBSD as a bust (8) CDs arrive in mail almost 4 months after I ordered them in cracked, broken jewel cases with one CD scratched beyond the ability of my drive to read it. Luckily it was the source CD and I didn't need it. (9) Write to OpenBSD people to say I got my CDs but the quality was god-awful, the delay was ridiculous, and one of them was busted. Receive no response. Regardless, my OpenBSD box is going on 3 years hack-free with minimal effort on my part to keep it that way. Regardless, I'm unlikely to go through OpenBSD again. When I order a product, waiting over a quarter of the year is unreasonable, and it could at least arrive NOT broken and all screwed up. And they could at least acknowledge that they receive my email, even if only to tell me to piss off.

Re:I gave OpenBSD a chance

[peacefinder]

I tried it too. Here's what happened for me:
1) I went to the OpenBSD website and read the install FAQ
2) I downloaded a floppy disk image and the tools to write it in Windows from openbsd.org
3) I booted from the floppy installer on a computer attached to the internet
4) The installer FTP'd the entire OS from a mirror site
5) I said "This totally rocks!", ordered some CDs, and donated to the project.

I think my way was easier.

Re:I gave OpenBSD a chance

[Triumph The Insult C]

you probably could have:

1. donated $40 (or whatever the cd sets cost at the time)
2. installed via ftp

you would have been done much faster and the project would have gotten more $$ for the same $$ out of your pocket

the flip side to all this

[corbettw]

No one's made this observation yet, so I figure I should: the flip side to OpenBSD not having enough money to maintain operations means that the software they make, especially OpenSSH, is in danger of being no longer supported. Yes, yes, I know, it's free software, so someone else can pick up the pieces after Theo is forced to take his toys and go home. But the reality is that no business in the world should trust software who's creator is about to implode.

What happens in six months when OpenSSH is no longer actively supported by the team that created it and a new exploit is discovered/released? What responsible IT manager is going to let his employer get into the potential problem in the first place?

I say, rather than begging for donations, the OpenBSD team needs to get their act together and find a way to keep the lights on, or they're going to see fewer and fewer people trusting the use of their software in large corporate environments. If that means the leader of the team needs to keep his mouth shut about his anti-war views when he's depending on a grant from the US Defense Department to keep his operation going, then that's what he needs to do. Being an adult means doing things you don't neccessarily want to do, like eating your peas and broccoli.

Momma always said...

[RingDev]

"Don't give money to beggers." But I've got a few granola bars and juice drinks I would be willing to donate.

-Rick

Re:I have no sympathy for them at all.

[Ossifer]

It's funny how arrogance and bitterness go so frequently hand-in-hand.

Theo goes around (as seen in these pages) lambasting Linux for basically being popular and successful, and then laments how his "far superior" OS is not as highly regarded. (Compare this to the utterly humble Linus Torvalds.) Now there is the implied threat that if others (read: Linux companies) don't cough up the dough, he's going to yank OpenSSH away from us. He seems like quite a bitter man...

Re:Someone has to say it

[TheRaven64]

Theo de Raadt is an (occasionally) arrogant asshole, who is (consistently) right and (consistently) gets good code written. Quite frankly, I couldn't care less if he is a complete pain to be in the same room as; if he keeps producing code the quality of OpenBSD then I will continue using it and continue to buy CD sets to support the project.

I don't think I'd describe Theo as particularly arrogant. When I've seen or read interviews with him (there was a particularly good one in the Sydney Morning Herald a while back that Google can probably help you find), he's seemed like a reasonable and rational individual. He occasionally flames people on the developer mailing list, but I don't really see how that affects you as a user.

Donation Drive + Free & Open

[CuttingEdge]

OpenBSD needs an annual donation drive the way that Wikipedia has one.

OpenBSD needs to open up it's OS distribution so that people can download and bit torrent OpenBSD ISO disks. OpenBSD needs to be a little easier to install. By taking these steps more people will find out about the project and use it and it will be easier for them to install.

For example, I know someone who switched from OpenBSD to FreeBSD simple due to the ease of installing FreeBSD.

Theo, open up OpenBSD distribution and get with it, have a donation drive: 100k per year sounds like a good goal. But if the software is hard to get then people simply won't use it.

Hate to say it, but Google adsense

[fak3r]

Really, think about what a resourse openbsd.org site is, if they had those tacky Google ads it would recieve a ton of pageviews, and clickthroughs likely since it'll tailor it's ads to BSD/Open Source stuff. Might go against the whole philosophy of the project, which I completely respect, but if it saves said project, it may be a required trade off. With the proliferation of broadband expect to see things like CD sales to continue to dwindle.

Re:I'd be willing to chip in...

[TheRaven64]

OpenSSH is already BSD licensed. The BSD license is 100% GPL compatible. Perhaps you are thinking of OpenSSL, which uses and old Apache license which is not GPL compatible.

establish OpenBSD foundation in US

[lotzmana]

Locating its center of gravity in Canada is something of which OpenBSD takes great pride. This is not unreasanoble in light of the adverse legal envyronment and export limitations that security research faces in US.

Speaking of money, charitable donations, US is probably the best place to try to sell your cause. I believe that part of the work on OpenBSD could be supported by a non-profit organization registered in the US. Foundations permit donors to deduct the amount of the grant from their taxes, a benefit which, presently, OpenBSD denies to its benefactors.

You mean like borland?

[codepunk]

Oh you mean like how we developed a crap load of software with kylix only to be left standing with our dick's in our hand right now because they decided to end of life it? ... go spout your drivel elsewhere.. BSD could go tit's up tomorrow and will it make a difference? nope the software and the code still exist.

donations are better

[Triumph The Insult C]

donate $45 and do an ftp install. the project gets much more $$ that way

Re:Are many people really using OpenBSD?

[grub]

Our webserver, DNS servers, logging boxes, DHCP, wireless DMZ, etc, all exist here thanks to OpenBSD (and we support them). And that's off the top of my head.

Their biggest problem...

[chill]

...is that there is no corporate entity at all. You make checks out to "Theo de Raadt", which *isn't* going to happen from any really large company with deep pockets. There is zero tracability and zero accountability.

When the U.S. DoD was funding them, the disbursements were handled thru a University or some such.

They need to grow up as an organization. Find a sympathetic accountant to donate his time/effort to establish a tax-free (and tax deductable) non-profit in Canada and an arm in the U.S. Hell, maybe one in the EU and one down under as well.

This will make them infinitely more appealing to corporations who have deep pockets and MAJOR qualms about writing big checks out to individuals.

  -Charles

Re:Their biggest problem...

[seifried]

"There is zero tracability and zero accountability."

Funny because there is exactly that on the side of the people/organizations using OpenBSD/OpenSSH, you can get it for free, use it, sell it, etc and not even have to distribute source code or anything. The funny thing is business not trusting Theo with their money, but trusting his project with their critical infrastructure.

Re:Slashdot Editors:Please add this link to the st

[bogie]

Keeping in mind that I believe that his work and the OpenBSD project are important, a few words of advice. As someone who works at a very large non-profit let me say this, doing a good job isn't enough. You have to work just like any other business to stary afloat. And that means constantly dedicating time to fundraise and not acting as a "one-man-show". Perhaps he needs to hand off the reigns to someone else and let them manage the project and fundraising. He apparantly and not suprisingly is unable to handle both coding and fundraising. Most people can't so that isn't a knock on him.

Anyway I wish him luck and hope he gets organized. He really needs to establish a real non-profit and get someone with real fundraising experience working for him. Without that I'm surprised it lasted this long. IMHO giving him a few donations in order to keep the project running without him deciding to make major organizational chages is just delying the inevitable. I sincerely wish him the best of luck.

Re:Nice of Maddog -- but this is one for Google

[Triumph The Insult C]

you are wrong

what openbsd needs, and what the article is highlighting, are the big companies who use openssh to kick in a few bucks

cisco uses it in their kit. soes does hp. ibm is another. do you think that between the three, they can't come up with say, $75k/year?

~a year ago, a friend of mine consulted at a company that was reworking their entire network. they ended up spending well over $30k on kit. they chose cisco *because* they had ssh (openssh btw) on their kit at the time. the other vendors they had did not

They could spend SOME time making it easy...

[alexhmit01]

Ya know what would be nice? Making it easy for businesses AND individuals to contribute. If they don't want to be a business, fine, get the 501(c)3 status in the US and let people make tax deductable donations. Writing a check to Theo's personal account doesn't get considered as part of my charitable giving. I also by a few CDs with each release or two, whenever I'm ready to do another OpenBSD project...

And guess what, the project makes me feel like a sucker... because usually whoever is shipping CDs is out of town, and they don't go out for 2-3 weeks, meanwhile, people have been downloading for free and I'm waitting for my CDs...

You want businesses to pay more that use it? How about selling a business "OpenBSD license" that provides us X copies for some price on a per-server (or per-CPU license) under the BSD. Is it a joke, sure, because given 1 personal copy, I have a license to use it however I want. But if you sell me 5 $299 licenses, I can write it off as $1500 in software purchases. Alternatively, I could donate $1500, but then I can't write it off... This is rough on me as a small business owner, for no reason. A receipt for the purchase would help...

However, asking for non-tax deductable donations is a non-starter. If I was an IT grunt in the field, knowing that I could buy a CD for the $20 or $30 and use it without effort (or download), but if I want to contribute, I could generate an online invoice and bring it to A/P.

In that case, the geeks LOVE that they start the project immediately, and maybe the "invoice" gets paid, and maybe it doesn't. There is no loser in this scenario, but it would require the OpenBSD project to understand the people that they want money from and find a way to make it easy on us to give it to them.

Alex

flush master

[epine]

If eighty cents of every dollar I spend supporting OpenSSH gets flushed down the OpenBSD toilet, is that a good use of my contribution?

The cluelessness of this post defies belief.

I want to support this OpenFoil airplane wing because it supports me. However, if eighty cents of every dollar I spend supporting OpenFoil is vented through the OpenBlow high-test wind tunnel, is that a good use of my contributions?

NX protection, Pro-police, and priv-sep are all products of the two efforts coordinated together. Almost every dime OpenBSD spends is spent in the pursuit of enhancing security, and it's to imagine that those results are not immediately folded back into OpenSSH. Unlike FreeBSD, OpenBSD spends shockingly little on the OS itself. They aren't busy inventing disk geometry managers or porting to 150 different platforms.

90% of human stupidity originates in the capacity of the human mind to engage in intellectual shell games. Here is this dollar: let's split it up in to the 80 cents wasted on OpenBSD and the 20 cents invested in OpenSSH.

Or, my brother is dying of Leukemia. I want to donate blood because blood keeps him alive. Is that a good investment if 80% of the blood I donate is flushed down the toilet to replace blood lost during bone marrow transplants?

Almost too dumb to live, really.

Since OpenBSD is basically based in Calgary

[hansoloaf]

why don't the gov't of Canada support it with monies and in return get good software for their computer systems throughout the government network? What about the universities such as the university in Calgary? Perhaps set up some sort of network security program and use openBSD as the model and provide some support? Just throwing out some ideas.

The moderators suck.

[Inoshiro]

http://www.openbsd.org/donations.html

Once again, with feeling:

http://www.openbsd.org/donations.html

I already donated today. Cheque, credit card (my preferred method), and Paypal are all easily listed. I guess having the donations link on the main page (just below project goals) was not obvious enough.

OpenSSL/OpenSSH is important!

[KerberosKing]

I don't run the OpenBSD OS, but based on this report, I donated. Since I do use OpenSSL and OpenSSH all the time and want to keep them under active development and if everyone that uses these important open source tools for network security kicks in some bucks, we can keep this good thing going.

Re:Are many people really using OpenBSD?

[Tom]

Do have have any idea what you're talking about?

First, there's a good amount of production servers running OpenBSD. I happen to be the developer of an OpenBSD-based firewall, and the things are running rock solid. The only failures we've had in 5 years are hardware-related. One of the firewalls sits in front of our developer network and has by far the best uptime of anything in the company, including several so-called high-availability systems.

More importantly, only a fraction of the OpenBSD development efforts have moved into other systems, and then often incomplete or much later. I don't wanna start a W^X vs. other methods discussion here, but if you've ever seen a presentation where Theo or one of the other core dudes explained just what is really new under the hood in the latest release, you'd be quite surprised. There's a lot of actual research and development going on in OpenBSD.

Re:You Must Have Missed the Memo

[meme_police]

Right here: ftp://ftp5.usa.openbsd.org/pub/OpenBSD/3.8/i386/fl oppy38.fs ftp://ftp5.usa.openbsd.org/pub/OpenBSD/3.8/i386/fl oppyB38.fs ftp://ftp5.usa.openbsd.org/pub/OpenBSD/3.8/i386/fl oppyC38.fs The first will work in most cases, the B and C version include rarer drivers than the first one. Did you bother looking? At all?

Re:I'd be willing to chip in...

[Kjella]

Oh, you mean the required library that makes OpenSSH actually do anything useful, like anything to do with cryptography. Sorry, my bad. I wasn't aware that they weren't maintained by the same people. I've just always assumed OpenSSH itself was the problem (and for the anonymous coward, the OpenSSH page completely ignores this and only the OpenSSL page mentions it). I know debian-legal has had issues with it, apparently because OpenSSL taints OpenSSH and makes them incompatible with the GPL. So what I wanted still stands, I just realized Theo can't do a damn thing about it. Too bad.