In reply to @circlebuilder:matrix.org
FYI on the XZ subject, solutions: https://www.tbray.org/ongoing/When/202x/2024/04/01/OSQI

In reply to @circlebuilder:matrix.org
FYI on the XZ subject, solutions: https://www.tbray.org/ongoing/When/202x/2024/04/01/OSQI

In reply to @circlebuilder:matrix.org

Just read your forum follow-up, which I hadn't seen up to now. Yes, in my "TIP" post I am also referring to paying due attention to all aspects of the FSDL, though I didn't mention that clear enough. The criterium of "organizational legitimacy" has aspects of that, like good governance, no single points of failure in the org, good custody for project names & trademarks, etc. And then there additional demands that come from being part of controlled supply lines, which also include stuff beyond coding.

Btw, the focus on becoming "pallatible" to corporations in order to receive their donations/investments is an angle that isn't needed per se. I just zoomed in on that, as you left it unaddressed, and also because of the danger to FOSS being left behind in favor of 'professionalised-OSS'. The XZ and log4j incidents had this big impact because of their corporate / professional uses.

You mention how e.g. NLnet might play a role. I think NLnet isn't the best example. They already have a somewhat different mission as a funding vehicle. But they operate in a network of other institutions. The Commons Conservancy is initiated by the same person behind NLnet (Michiel Leenaars). They offer services to a handful of projects that are under their wings.

Of the organizations I know that offer these kinds of services, Commons Conservancy is best aligned to FOSS values and culture. Yet still they are an example of clubs that place themself above FOSS, an added hierarchical layer, and forming power bases. They don't stand on equal footing to the projects they represent. Part of the "mythical shrines and temples" analogy where you pray at the altar for help.

None of these organizations AFAIK has managed to bind a large amount of FOSS projects to them, maybe for this reason, idk. Linux Foundation did manage to get many major projects under its umbrella, but those are OSS projects and mostly corporate-backed ones.

I was just using NLNet as an example. I couldn't think of any other funds or grant givers. I tend to think of companies existing on a different quantum field to our own and we need a mediator particle to facilitate interaction.

Majority of companies don't give a damn and there's no reality where they willingly pay for anything where they get free labour instead. So I don't really consider them in any equation for a solution. They're not reliable.

In reply to @circlebuilder:matrix.org
FYI on the XZ subject, solutions: https://www.tbray.org/ongoing/When/202x/2024/04/01/OSQI

In reply to @dannymate:matrix.org

I was just using NLNet as an example. I couldn't think of any other funds or grant givers. I tend to think of companies existing on a different quantum field to our own and we need a mediator particle to facilitate interaction.

Majority of companies don't give a damn and there's no reality where they willingly pay for anything where they get free labour instead. So I don't really consider them in any equation for a solution. They're not reliable.

In reply to @dannymate:matrix.org
Only governments can force companies to do anything. If they're even willing to do that. Especially considering how cheap politicians are in most countries including my own.

Majority of companies don't give a damn and there's no reality where they willingly pay for anything where they get free labour instead. So I don't really consider them in any equation for a solution. They're not reliable.

This is the wrong way of looking at it. Most companies care A LOT about their own product and service offerings. I am sure that in most companies there never was a "Let's squeeze as much free labour out of this open source community" discussion. Techstack decisions are all made at IT department level, i.e. bottom-up, often by individual devs as they build some functionality. Here its mostly "Let's see what open source project already does this" that's causing them to become adopted. These devs for the most part do not have good understanding of Free Software culture, nor of licensing intrinsics, and if they do they do not have proper means (nor time) to convey how the company should deal with the adoption properly.

It is when a log4j or XZ incident happens that higher-ups in the company wake up with a "Damn, we are vulnerable by this crap" and CTO gets urgently tasked to "take control of that damn supply chain". Who will then put the reigns on casual dependency selection with rules and guidelines. To the detriment of FOSS projects who are the first to not be able to comply.

Companies pay good money for Enterprise-level support and SaaS subscriptions, if that gives them the guarantees they need for the continuity of their business. The money is there. It is spent. It's not going seeping into the lowest nooks and crannies where the overworked FOSS maintainer is holding out.

Devenv.sh has a 1.0 release, which also involves a rewrite in Rust, for reason of:

When I started to write this blog post for the Python rewrite, I came up with only excuses as to why it is not fast and realized that we were simply breaking our promise to you.

The second reason is that in the Nix community there has been a lot of controversy surrounding flakes (that's for another blog post); two years ago, the tvix developers decided to do something about it and started a rewrite of Nix in Rust. This leaves us with the opportunity in the future to use the same Rust libraries and tooling.

In reply to @dannymate:matrix.org
Laxystem: https://lemmy.world/post/13762503

In reply to @Ryuno-Ki:matrix.org
∅

In reply to @tomatdividedby0:matrix.org
On that note which client makes Matrix not miserable to use