Slashdot Mirror
Microsoft, Google, Others Join To Fund Open Source Infrastructure Upgrades
wiredmikey (1824622) writes "Technology giants including Microsoft, Google, Intel, and Cisco are banding together to support and fund open source projects that make up critical elements of global information infrastructure. The new Core Infrastructure Initiative brings technology companies together to identify and fund open source projects that are widely used in core computing and Internet functions, The Linux Foundation announced today. Formed primarily as the industry's response to the Heartbleed crisis, the OpenSSL library will be the initiative's first project. Other open source projects will follow. The funds will be administered by the Linux Foundation and a steering group comprised of the founding members, key open source developers, and other industry stakeholders. Anyone interested in joining the initiative, or donating to the fund can visit the Core Infrastructure Initiative site."
Microsoft and Open source, in the same sentence. What's wrong with this picture?
is not to be trusted. I know all multi-billion dollar tech companies are untrustworthy to varying degrees, but MS is the worst of the lot. They are pure slime.They are just betting better at hiding it.
OpenSSL has nothing to do with Linux, other than that a number of vendors that bundle it with their products also bundle Linux. The FreeBSD or NetBSD Foundations would have made as much sense (i.e. none).
I am TheRaven on Soylent News
Say what you want about Theo or the name his team has chosen but I think I'd rather give my money to OpenBSD's LibreSSL project than donate to this.
I get that they are probably just after the good will and PR that this will generate, and that this isn't some vast conspiracy against open source, but I don't trust one of the companies on that list to give a care once public attention to heartbleed dies off.
Pick a project and donate directly, don't let these giants pick and choose for us!
Creationist Textbook Stickers Declared Unconstitutional by CowboyNeal
So they will fun projects that make up critical elements... what about projects that might one reach that status? Why not fund interesting open source projects in general?
So while these people have been doodling around forming initiatives and getting their logos splattered all over a web page, the OpenBSD people have actually founded the LibreSSL project and started actually overhauling the OpenSSL library, including fixing bugs that have been in the OpenSSL queue for years, not to mention finding a metric assload of new ones.
Someone's already doing something. The best choice would just be to fund LibreSSL at this point.
But hey, actually doing work like fixing bugs and etc is not nearly as glamorous as making press releases and having a hudge wodge of logos.
SJW n. One who posts facts.
This announcement comes days after openbsd has launched libreSSL.
So the Linux Foundation has a fundamental distaste for Theo? Does the world really need two competing forks of OpenSSL?
Team up to create the pie, then fight for your pieces. I'm actually shocked Microsoft is participating. It's a good move and I'm not used to seeing Redmond do the smart thing. Maybe their collective IQ went up now that Ballmer is out of the picture.
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
that make up critical elements of their information infrastructure.
Frankly the only reason I think these multibillion dollar monopolistic companies have banded together to throw money is because their reputation and userbase have clammored for some kind of response to the problem. lets be perfectly clear: Theo De Raadt is completely capable of handling the code refactor (he even went so far as to say he didnt need help with the code projects website.) going to the Linux foundation just shows how fucking shortsighted these guys are. If you want to help, donate to the OpenBSD foundation because this is a BSD package that was kindly ported to Linux. It will be released as LibreSSL, not the OpenSSL you want to "fix" in your products, as the code is completed and tested in accordance with what I presume is an OpenBSD development model, not Linux. And in regard to the 'other open source projects will follow' statement, its arrogant and absurd to think that once the LibreSSL code is finalized and ported that these dicks are going to stick around and continue to contribute to any open source technology that doesnt clandestinely butter their bread in user facing products that happen to be facing a sev. 1 exploit they cant avoid through marketing or a new product.
Good people go to bed earlier.
For some funny blow-by-blow commentary that the LibreSSL people are doing, check out http://opensslrampage.org/
Too many VMS jokes to count.... but just looking at the comments, OpenSSL's code is labyrinthine and full of cruft and useless files.
READY.
PRINT ""+-0
The idea behind open source is "people power." Instead of relying on government or corporations, we'll do it ourselves through a volunteer effort.
Unfortunately, as anyone involved in a serious volunteer effort (e.g. not your beer-drinking weekend "fun" activism) knows, volunteer efforts don't work without strong leadership.
They become "everybody do whatever they want" under the guise of "helping out," and the result is always pointless and bad.
So far, we've ignored problems. Bad code, no documentation, most products either (a) imitations of already successful commercial products or (b) academic projects gone on to a new life as volunteer efforts.
With Heartbleed, it became clear that "people power" in software is not a substitute for strong leadership. Just moving it from the commercial realm to the volunteer realm does not automatically make it good.
Now history has caught up. The open source era is over or at least fundamentally changed.
Futurist Traditionalism
Oh wait, they can't afford it, it's not in their budget...
whois the band of 15? http://www.linuxfoundation.org/about/board-members current & former penguin clubbers every one
> 3. LibreSSL gains feature parity with OpenSSL
The LibreSSL team has deleted tens of thousands of lines of code from OpenSSL, saying that one of their key goals is to remove as many features as possible. Their reasoning is that simple is more secure, that features which don't exist can't have bugs.
That principle is correct, unless either:
a) It's a feature people need, in which case each code-monkey will scratch out their own homebrew version.
or
b) It's a security feature, a chunk of code designed to make things more secure.
Right or wrong, it appears unlikely that LibreSSL will ever get anywhere near feature parity with OpenSSL. They would consider it a failure if they did that.
Shut up and hack. Paying your way through projects you don't want to get actively involved in won't get you going anywhere to how exactly you want it to be. Instead, put one of your engineers to work on it and contribute to it.
People here are already complaining. The whole operation seems pretty straight-forward to me. Make a fund, get some people to administer it and ask some big corporations to donate a tiny percentage of their profits to help fund some infrastructure projects we are all relying on.
I can see some people being anxious their pet projects will not get funded, but come on! One free software project in need receiving funds is better than nothing.
Maybe the fund will be mismanaged or whatever, but in the worst case these corporations will have lost a small sum (to them). In all other cases, bugs will be fixed and the Internet will generally be better off. What's the problem?
Victory was short lived.
So after all these corporation has literally made billions in profit, exploiting free software, they finally offer pennies to help develop them further... Where was their moral in first place? Now they pay only because bug in this library can danger their future profits so it needs fixed.
In reply to
a) They are willing to put extra features back in as needed/requested/paid for
b) You are a twit. If the OpenBSD team is working to make OpenSSL more secure you can bet that their version (LibreSSL) is already more secure.
Oh and a lot of the code removed was insecure OpenSSL cruft and/or support for legacy systems that broke security
Clearly you haven't followed ANY of the relevant discussion. We're not putting back 98% of the features that are being removed. Not. Going. To. Happen.
Security for BSD is more important than support for FIPS or HP. If you want HP support, use OpenSSL or gnuTLS. LibreSSL will be simple and clean - screw features.
A suggestion - get a clue what you're talking about before arguing about it. The discussion is on the list. Read it - or stfu when people who HAVE read it ate talking.
TrueCrypt is getting audited by OCAP, how about OpenSSL too?
http://IsOpenSSLAuditedYet.com?