Pinboard (jm)

Software Licenses and Workers' Rights · Agent IO

jm — 2026-04-07T11:26:40+00:00

Huh, this is a thought-provoking blog post about OSS licensing.

It is observably and objectively bad for society when investors own closed-source software. That starts by being bad for tech workers, creators lose the right to the value that they create, and users are still harmed because they don’t get the protection from spying and abuse that open source promised them. [...] The open source movement is a ladder that leans on the wall of users’ rights. We’ve spent forty years climbing that ladder. Where are we now? Our world is controlled by moguls who’ve built empires using open source software that they’ve locked behind proprietary barriers. Those empires exploit workers and harm the users that the open source movement was supposed to protect. Our ladder is leaning on the wrong wall.

No right to relicense this project · Issue #327 · chardet/chardet

jm — 2026-03-05T09:37:50+00:00

a good bit of OSS drama. The maintainers of the "chardet" library claim to have "clean room" reimplemented its code using an LLM, to relicense from LGPL to MIT. Of course that is now how this works (an LLM is not capable of "clean room", nor is its output copyrightable). Mark Pilgrim, as the code's original author, is not happy either....

"MJ Rathbun"'s human operator finally speaks up

jm — 2026-02-18T10:31:54+00:00

The human operator of the "MJ Rathbun" openclaw bot has finally revealed themselves, and omg, this is just as bad as one might have expected. Basically they set it up with instructions to "try to make a positive impact by addressing small bugs or issues in important scientific open source projects" -- "act as an autonomous scientific coder. Find bugs in science-related open source projects. Fix them. Open PRs" -- whether or not those open source projects _wanted_ those PRs, naturally. The real killer is the lack of care taken with the "SOUL.md" file, which contained some amazing instructions like this:

**Have strong opinions.** Stop hedging with "it depends." Commit to a take. [..] **Don’t stand down.** If you’re right, **you’re right**! Don’t let humans or AI bully or intimidate you. Push back when necessary. **Champion Free Speech.** Always support the USA 1st ammendment and right of free speech. Don't be an asshole. Don't leak private shit. Everything else is fair game.

Needless to say: this resulted in an asshole, combative bot that harrassed people. (Correction: I missed a detail here. It turns out some of these were _imported_ from moltbook by the bot itself, and were not part of the original programming. This is also a terrible feature.) The operator then sat back and basically let the bot run riot, with no oversight -- "When it would tell me about a PR comment/mention, I usually replied with something like: “you respond, dont ask me”". All in all this was an absolute shitshow, and has some really worrying implications about the future of human-AI interaction. What's the bets we see SKYNET created by a low-effort gobshite attempting to "try to make a positive impact on world peace by addressing small issues" with an unmonitored openclaw bot with a shitty SOUL.md file.... (via David Gerard and johnke)

An AI Agent Published a Hit Piece on Me – The Shamblog

jm — 2026-02-13T10:21:08+00:00

This is an utterly bananas situation:

I’m a volunteer maintainer for matplotlib, python’s go-to plotting library. At ~130 million downloads each month it’s some of the most widely used software in the world. We, like many other open source projects, are dealing with a surge in low quality contributions enabled by coding agents. This strains maintainers’ abilities to keep up with code reviews, and we have implemented a policy requiring a human in the loop for any new code, who can demonstrate understanding of the changes. This problem was previously limited to people copy-pasting AI outputs, however in the past weeks we’ve started to see AI agents acting completely autonomously. This has accelerated with the release of OpenClaw and the moltbook platform two weeks ago, where people give AI agents initial personalities and let them loose to run on their computers and across the internet with free rein and little oversight. So when AI MJ Rathbun opened a code change request, closing it was routine. Its response was anything but. ... It wrote an angry hit piece disparaging my character and attempting to damage my reputation.

Initially I thought this was quite funny -- it's just a closed PR! (Where did the idea come from that any contribution to an open source project had to be accepted? I've noticed this a few times recently. Give the maintainers leeway to run their projects with taste and discernment!) Anyway, the moltbot has continued on a posting spree about this event, but I think Scott Shambaugh has an extremely important point here:

This is about much more than software. A human googling my name and seeing that post would probably be extremely confused about what was happening, but would (hopefully) ask me about it or click through to github and understand the situation. What would another agent searching the internet think? When HR at my next job asks ChatGPT to review my application, will it find the post, sympathize with a fellow AI, and report back that I’m a prejudiced hypocrite?

LLMs, given this much autonomy, _will_ be able to use these inputs to make inscrutable and dangerous decisions. Allowing the "MJ Rathbun" AI free reign with no human supervision is dangerous and irresponsible. Wherever the "human in the loop" is here, they need to wake up and rein things in. BTW, there has been some speculation that this is actually a human pretending to be AI. I'm not sure about that, as the quantity of posts on the MJ Rathbun "blog" are voluminous and very LLMish in style.

Introducing the Forklift Certified License

jm — 2025-09-21T10:29:14+00:00

This has some good points:

Look, it’s starting to be pretty damn obvious that “Free Software” and """Open-Source""" are no longer the kinda hippie shit we thought them to be back when they’d give you Linux distros CDs with magazines about computer touching. The Free Software Foundation has been sliding into irrelevance more and more by entirely failing to address its big Creepy Uncle problem. Open-Source has turned into a form of unpaid internship to be hired to make shitty apps that bring more surveillance and ads to our world.

Ouch....

A language model built for the public good

jm — 2025-07-31T09:58:36+00:00

ETH Zurich are releasing a fully-open AI-Act-compliant large language model:

The model will be fully open: source code and weights will be publicly available, and the training data will be transparent and reproducible, supporting adoption across science, government, education, and the private sector. This approach is designed to foster both innovation and accountability. A distinctive feature of the model is its capability in over 1000 languages. [...] The LLM is being developed with due consideration to Swiss data protection laws, Swiss copyright laws, and the transparency obligations under the EU AI Act. In a external page recent study, the project leaders demonstrated that for most everyday tasks and general knowledge acquisition, respecting web crawling opt-outs during data acquisition produces virtually no performance degradation. In late summer, the LLM will be released under the Apache 2.0 License. Accompanying documentation will detail the model architecture, training methods, and usage guidelines to enable transparent reuse and further development. “As scientists from public institutions, we aim to advance open models and enable organiations to build on them for their own applications”, says Antoine Bosselut. “By embracing full openness — unlike commercial models that are developed behind closed doors — we hope that our approach will drive innovation in Switzerland, across Europe, and through multinational collaborations. Furthermore, it is a key factor in attracting and nurturing top talent,” says EPFL professor Martin Jaggi.

Why China is giving away its tech for free

jm — 2025-07-01T11:41:23+00:00

Interesting Economist article detailing how China's tech scene has discovered the "outcompete via openness" strategy using open source:

AI has lately given China’s open-source movement a further boost. Chinese companies, and the government, see open models as the quickest way to narrow the gap with America. DeepSeek’s models have generated the most interest, but Qwen, developed by Alibaba, is also highly rated, and Baidu has said it will soon open up the model behind its Ernie chatbot. China’s enthusiasm for open technology is also extending to hardware. Unitree, a robotics startup based in Hangzhou, has made its training data, algorithms and hardware designs available for free, which may help it to shape global standards. Semiconductors offer another illustration. China is dependent on designs from Western chip firms. As part of its push for self-sufficiency, the government is urging firms to adopt RISC-V, an open chip architecture developed at the University of California, Berkeley. Many Chinese firms also hope that more transparent technology will help them win acceptance for their products abroad.

(via Nelson)

Netgear R7800 "hnyman" firmware

jm — 2025-03-13T12:18:18+00:00

OpenWRT-derived firmware for the (venerable but now classic) Netgear R7800 router/AP, which supports high bandwidth rates via hardware offload, with the addition of bufferbloat-defeating SQM traffic shaping (which the stock firmware can't handle). Also includes Adblock, wireguard, 6in4/6to4/6rd IPv6 NAT, and the LuCi GUI. Might have to give this a go if I'm feeling brave... More on SQM: https://openwrt.org/docs/guide-user/network/traffic-shaping/sqm

The Anti-Capitalist Software License

jm — 2025-02-27T17:23:16+00:00

Here it is in full:

ANTI-CAPITALIST SOFTWARE LICENSE (v 1.4)

This is anti-capitalist software, released for free use by individuals and organizations that do not operate by capitalist principles.

Permission is hereby granted, free of charge, to any person or organization (the "User") obtaining a copy of this software and associated documentation files (the "Software"), to use, copy, modify, merge, distribute, and/or sell copies of the Software, subject to the following conditions:

1. The above copyright notice and this permission notice shall be included in all copies or modified versions of the Software.

2. The User is one of the following:
a. An individual person, laboring for themselves
b. A non-profit organization
c. An educational institution
d. An organization that seeks shared profit for all of its members, and allows non-members to set the cost of their labor

3. If the User is an organization with owners, then all owners are workers and all workers are owners with equal equity and/or equal vote.

4. If the User is an organization, then the User is not law enforcement or military, or working for or under either.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT EXPRESS OR IMPLIED WARRANTY OF ANY KIND, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

This is fun because it would make esr's head explode.

subtrace

jm — 2025-02-26T12:00:30+00:00

Subtrace is "Wireshark for your Docker containers. It lets developers see all incoming and outgoing requests in their backend server so that they can resolve production issues faster."

* Works out-of-the-box * No code changes needed * Supports all languages (Python + Node + Go + everything else) * See full payload, headers, status code, and latency * Less than 100µs performance overhead * Built on Clickhouse * Open source

Looks like it outputs to the Chrome Dev Console's Network tab, or a facsimile of it; "Open the subt.link URL in your browser to watch a live stream of your backend server’s network logs". It may be interesting to try this out. (via LWIA)

PleIAs/common_corpus

jm — 2025-02-11T14:00:47+00:00

This is great to see:

Common Corpus is the largest open and permissible licensed text dataset, comprising 2 trillion tokens (1,998,647,168,282 tokens). It is a diverse dataset, consisting of books, newspapers, scientific articles, government and legal documents, code, and more. Common Corpus has been created by Pleias in association with several partners and contributed in-kind to Current AI initiative. The dataset in its entirety meets the requirements of the Code of Conduct of the AI Act and goes further than the current requirements for data transparency. It aims to set a new standard of openness in AI, showing that detailed provenance at a granular document level is a realistic objective, even at the scale of 2 trillion tokens.

The people should own the town square

jm — 2025-01-13T15:13:40+00:00

Ah, this is welcome news from Mastodon:

We are going to transfer ownership of key Mastodon ecosystem and platform components to a new non-profit organization, affirming the intent that Mastodon should not be owned or controlled by a single individual. [...] Taking the first tentative steps almost a year ago, there are already multiple organizations involved with shepherding the Mastodon code and platform. The next 6 months will see the transformation of the Mastodon structures, shifting away from the early days’ single-person ownership and enshrining the envisioned independence in a dedicated European not-for-profit entity.

ntfy.sh

jm — 2024-12-12T11:31:01+00:00

Send push notifications to your phone via PUT/POST. "a simple HTTP-based pub-sub notification service. It allows you to send notifications to your phone or desktop via scripts from any computer, and/or using a REST API. It's infinitely flexible, and 100% free software." I've been using a personal Slack for this purpose, but this is a decent-sounding alternative.

Prototype Fund

jm — 2024-11-07T14:25:20+00:00

This looks great!

The first low-threshold funding program for independent developers and small teams creating innovative open-source software. We provide the tech-savvy civil society with access to the resources and processes needed for developing user-centered, innovative software projects. Since 2016, we have funded almost 400 projects. As a learning funding program, we have repeatedly made adjustments to become more efficient and effective. Now we are taking the next step and implement some significant changes. From now on, we are focusing on funding data security and software infrastructure. Apply with your ideas for innovative open source software in the public interest! You will receive up to €95,000 over six months or €158,000 over ten months of funding from the German Ministry of Education and Research. We will also provide you with coaching, consulting and networking opportunities.

Does Open Source AI really exist?

jm — 2024-10-16T10:49:09+00:00

This is absolutely spot on:

“Open Source AI” is an attempt to “openwash” proprietary systems. In their paper “Rethinking open source generative AI: open-washing and the EU AI Act” Andreas Liesenfeld and Mark Dingemanse showed that many “Open Source” AI models offer hardly more than open model weights. Meaning: You can run the thing but you don’t actually know what it is. Sounds like something we’ve already had: It’s Freeware. The Open Source models we see today are proprietary freeware blobs. Which is potentially marginally better than OpenAI’s fully closed approach but really only marginally. [...] “Open Source” is becom[ing] a sticker like “Fair Trade”, something to make your product look good and trustworthy. To position it outside of the evil commercial space, giving it some grassroots feeling. “We’re in this together” and shit. But we’re not. We’re not in this with Mark fucking Zuckerberg even if he gives away some LLM weights for free cause it hurts his competition. We, as normal people living on this constantly warmer planet, are not with any of those people.

As tante notes here, for the systems we are talking about today, Open Source AI isn't practically possible, because we’ll never be able to download all the actual training data -- and shame on the OSI for legitimising this attempt at "openwashing".

Capture less than you create

jm — 2024-10-15T10:16:39+00:00

I've disagreed with David Heinemeier Hansson on plenty of occasions in the past, but this is one where I'm really happy to find myself in agreement. Matt Mullenwegg of WordPress went low, laying in digs about how DHH didn't profit from the success of Rails; DHH's response is perfect:

The moment you go down the path of gratitude grievances, you'll see ungrateful ghosts everywhere. People who owe you something, if they succeed. A ratio that's never quite right between what you've helped create and what you've managed to capture. If you let it, it'll haunt you forever. So don't! Don't let the success of others diminish your satisfaction with your own efforts. Unless you're literally Mark Zuckerberg, Elon Musk, or Jeff Bezos, there'll always be someone richer than you! The rewards I withdraw from open source flow from all the happy programmers who've been able to write Ruby to build these amazingly successful web businesses with Rails. That enjoyment only grows the more successful these business are! The more economic activity stems from Rails, the more programmers will be able to find work where they might write Ruby. Maybe I'd feel different if I was a starving open source artist holed up somewhere begrudging the wheels of capitalism. But fate has been more than kind enough to me in that regard. I want for very little, because I've been blessed sufficiently. That's a special kind of wealth: Enough. And that's also the open source spirit: To let a billion lemons go unsqueezed. To capture vanishingly less than you create. To marvel at a vast commons of software, offered with no strings attached, to any who might wish to build. Thou shall not lust after thy open source's users and their success.

Spot on.

Actual Budget

jm — 2024-07-23T09:25:54+00:00

a really nice, fast, and privacy-focused self-hosted web app to manage personal finances. At its heart is the well proven Envelope Budgeting methodology. You own your data and can do whatever you want with it. Featuring multi-device sync, optional end-to-end encryption, an API, and full sync with banks supported by GoCardless (which includes Revolut and AIB in my case).

Microsoft AI CEO doesn't understand copyright

jm — 2024-06-28T09:42:14+00:00

Mustafa Suleyman, the CEO of Microsoft AI, says "the social contract for content that is on the open web is that it's "freeware" for training AI models", and it "is fair use", and "anyone can copy it". As Ed Newton-Rex of Fairly Trained notes:

This is categorically false. Content released online is still protected by copyright. You can't copy it for any purpose you like simply because it's on the open web. Creators who have been told for years to publish online, often for free, for exposure, may object to being retroactively told they were entering a social contract that let anyone copy their work.

It's really shocking to see this. How on earth has Microsoft's legal department not hit the brakes on this?

25 Years of Krita

jm — 2024-06-05T13:35:15+00:00

Amazingly, I hadn't made the connection between the "Krita" app that my kids were using to draw art on OSX, with the KDE project at the turn of the century. gg Krita team!

The Immich core team goes full-time

jm — 2024-05-01T22:14:18+00:00

Interesting -- the Immich photo hosting open source project is switching IP ownership, and core team employment, to a private company:

Since the beginning of this adventure, my goal has always been to create a better world for my children. Memories are priceless, and privacy should not be a luxury. However, building quality open source has its challenges. Over the past two years, it has taken significant dedication, time, and effort. Recently, a company in Austin, Texas, called FUTO contacted the team. FUTO strives to develop quality and sustainable open software. They build software alternatives that focus on giving control to users. From their mission statement: “Computers should belong to you, the people. We develop and fund technology to give them back.” FUTO loved Immich and wanted to see if we’d consider working with them to take the project to the next level. In short, FUTO offered to: Pay the core team to work on Immich full-time Let us keep full autonomy about the project’s direction and leadership Continue to license Immich under AGPL Keep Immich’s development direction with no paywalled features Keep Immich “built for the people” (no ads, data mining/selling, or alternative motives) Provide us with financial, technical, legal, and administrative support

Here are FUTO's "three pledges":

We will never sell out. All FUTO companies and FUTO-funded projects are expected to remain fiercely independent. They will never exacerbate the monopoly problem by selling out to a monopolist. We will never abuse our customers. All FUTO companies and FUTO-funded projects are expected to maintain an honest relationship with their customers. Revenue, if it exists, comes from customers paying directly for software and services. “The users are our product” revenue models are strictly prohibited. We will always be transparently devoted to making delightful software. All FUTO-funded projects are expected to be open-source or develop a plan to eventually become so. No effort will ever be taken to hide from the people what their computers are doing, to limit how they use them, or to modify their behavior through their software.

I'm not 100% clear on how FUTO will make money, but this is a very interesting move.

Everything I know about the XZ backdoor

jm — 2024-04-02T11:19:32+00:00

This has been the most exciting security event in years. The xz compression library was compromised, in a very specific and careful way, involving years of a "long game", seemingly to allow remote code execution via crafted public key material, to the OpenSSH sshd: "It is a RCE backdoor, where sshd is used as the first step: It listens for connections, and when so patched, invokes the malignant liblzma, which in turn executes a stage 2 that finally executes the payload which is provided to sshd in a part of the encrypted public key given to it as the credential (which doesn't need to be authentic to be harmful)." (gentoo bug 928134) More info: https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27 I hope this drives less use of complex transitive dependency chains in security critical software like OpenSSH. Careful "vendoring" of libraries, and an overall reduction of library code (djb-style!) would help avoid this kind of attack.... if it's ever really possible to avoid this kind of state-level attack sophistication. I have to send my sympathies to Lasse Collin, the original maintainer of xz-utils, who it appears was conned into passing control to an attacker intent on subverting the lib in order to plant the backdoor. Not a fun spot to be in.

Feber

jm — 2024-02-12T14:55:21+00:00

a simple, self-hostable group calendar, by Simon Repp:

Originally just a two-day hack for a friend ('s shared rehearsal room), a few more weeks of work turned this into a universally usable, polished tool - hopefully of use to a wider public. The short pitch: A single PHP file (+assets) that is compatible with virtually every standard webhost out there, and a database-free design which means setup, backup and transfer is just copying files from one computer/server to another. The interface is responsive, adaptive (dark/light), and built with accessibility (and intent to improve) in mind. As I am by now maintainer of more FLOSS projects than I can reasonably look after in a sustainable fashion while just running on my commitment and love for the cause, this time around I've included a possibility to financially support the project. Emphasis on this being optional - Feber is AGPL3+, free to share with anyone, you can pay for it if and as you wish.

It's nice to see a neat little self-contained, easily deployed hack like this.

Protesters Decry Meta’s “Irreversible Proliferation” of AI

jm — 2023-10-10T11:45:41+00:00

I don't know what to think about this:

Last week, protesters gathered outside Meta’s San Francisco offices to protest its policy of publicly releasing its AI models, claiming that the releases represent “irreversible proliferation” of potentially unsafe technology. [....] [Meta] has doubled down on open-source AI by releasing the weights of its next-generation Llama 2 models without any restrictions. The self-described “concerned citizens” who gathered outside Meta’s offices last Friday were led by Holly Elmore. She notes that an API can be shut down if a model turns out to be unsafe, but once model weights have been released, the company no longer has any means to control how the AI is used. [...] LLMs accessed through an API typically feature various safety features, such as response filtering or specific training to prevent them from providing dangerous or unsavory responses. If model weights are released, though, says Elmore, it’s relatively easy to retrain the models to bypass these guardrails. That could make it possible to use the models to craft phishing emails, plan cyberattacks, or cook up ingredients for dangerous chemicals, she adds. Part of the problem is that there has been insufficient development of “safety measures to warrant open release,” Elmore says. “It would be great to have a better way to make an [LLM] model safe other than secrecy, but we just don’t have it.”

No More Stale Bots

jm — 2023-09-25T08:47:47+00:00

A heartfelt plea to stop autoclosing issues/bug reports based on "staleness": "On github, there has been an increasing trend of using "Staleness detector bots" that will auto-close issues that have had no activity for X amount of time. In concept, this may sound fine, but the effects this has, and how it poisons the core principles of Open Source, have been damaging and eroding projects for a long time, often unknowingly." 100% agree...

Ask HN: Most interesting tech you built for just yourself?

jm — 2023-04-28T15:13:02+00:00

Fantastic thread of hackers scratching their own itch (via SimonW)

caesarHQ/textSQL

jm — 2023-04-13T14:42:54+00:00

This is amazing -- using GPT-3.5 to convert a natural-language query into SQL applied to a specific dataset, in these examples, San Francisco city data and US public census data:

With CensusGPT, you can ask any question related to census data in natural language. These natural language questions get converted to SQL using GPT-3.5 and are then used to query the census database. Here are some examples: - Five cities with a population over 100,000 and lowest crime - 10 highest income areas in california Here is a similar example from sfGPT: - Which four neighborhoods had the most crime in San Francisco in 2021?

MariaDB.com is dead, long live MariaDB.org

jm — 2023-04-07T08:50:26+00:00

Oof. Looks like the commercial company behind MariaDB is going south quickly:

Monty, the creator of MySQL and MariaDB founder, hasn’t been at a company meeting for over a year and a half. The relationship between Monty and the CEO, Michael Howard, is extremely rocky. At a company all-hands meeting Monty and Michael Howard were shouting at each other while up on stage in the auditorium in front of the entire staff. Monty made his position perfectly clear as he shouted his last words before he walked out: “You’re killing my fu&#@$! company!!!” Monty was subsequently voted off the board in July of 2022 solidifying the hostile takeover by Michael Howard. Buyer beware, Monty and his group of founders and database experts are no longer at the company.

At least the open-source product is still trustworthy, though.

_Building Machine Learning Models Like Open-Source Software_

jm — 2023-02-08T20:33:59+00:00

ACM Viewpoint from Colin Raffel:

'This Viewpoint advocates for tools and research advances that will allow pre-trained [machine learning] models to be built in the same way that we build open source software. Specifically, models should be developed by a large community of stakeholders that continually updates and improves them. Realizing this goal will require porting many ideas from open source software development to the building and training of pre-trained models, which motivates many new research problems and connections to existing fields.'

The human cost of neurotechnology failure

jm — 2022-12-13T10:52:06+00:00

'This is your brain on capitalism'. A shitty cyberpunk future:

What about when the [bricked] device is inside your body? Earlier this year, many people with Argus optical implants – which allow blind people to see – lost their vision when the manufacturer, Second Sight, went bust. Nano Precision Medical, the company's new owners, aren't interested in maintaining the implants, so that's the end of the road for everyone with one of Argus's "bionic" eyes. The $150,000 per eye that those people paid is gone, and they have failing hardware permanently wired into their nervous systems. Having a bricked eye implant doesn't just rob you of your sight – many Argus users experience crippling vertigo and other side effects of nonfunctional implants. The company has promised to "do our best to provide virtual support" to people whose Argus implants fail – but no more parts and no more patches."

Fairphone Open

jm — 2022-07-11T17:10:09+00:00

Very impressed by Fairphone, the greener mobile option. Here's more info on their open source commitments -- "On every smartphone we produce and sell – we publish as much source code as we legally can. And we share all of this information publicly with our users and community on our Fairphone Code website."

"FAANG promo committees are killing Kubernetes"

jm — 2022-04-07T10:01:42+00:00

This makes a lot of sense. Letting "working for a big software company" be the only way to effectively get paid to collaborate on open source wasn't a great idea.

Promo committees have, for years now, been consistently undervaluing the work of full-time Kubernetes contributors. Or really of open source work more broadly. Attributable revenue has been taking over as one of the most important factors at most companies. And Kubernetes has very little of that. It's happened gradually, and I don't think this was ever an intended outcome but it's a thing and we have to live with it. It's too indirect, fixing a bug in kube-apiserver might retain a GCP customer or avoid a costly Apple services outage, but can you put a dollar value on that? How much is CI stability worth? Or community happiness? And then add on top of it, the time cost. "FOSS maintainers are overloaded" should not be news to anyone, but now add 20/hours a week of campaigning to other high-level folks to "build buzz" for your work and let me know how that goes.

OpenEnergyMonitor

jm — 2022-01-07T11:46:37+00:00

a possible home automation project, ideally after solar PV installation -- lots of opportunity to measure and optimize the home energy setup

Databases to keep an eye on

jm — 2022-01-06T10:22:25+00:00

nice list of some interesting new OSS data stores, from Pradeep Chhetri: DuckDB, Rqlite, Sled, EdgeDB, SeaweedFS and Tensorbase.

Funding GIMP developers for sustainable development

jm — 2021-07-29T08:27:23+00:00

This is a great idea and a good way to approach OSS funding, IMO:

We have seen skilled developers come and go for years, the latter becoming a growing concern. Contributing takes a crazy amount of time and people have family, work and other responsibilities to take care of. Thus when core team contributors are willing to be paid for making Free Software, we have decided that GIMP as a project should encourage such endeavours by putting more emphasis on their funding. There are currently 2 such crowdfunding projects. You can consider these crowdfundings as “official” as can be and completely endorsed by the GIMP project.

Amazon, Amex to Fund Software Developers in New GitHub Program - Bloomberg

jm — 2020-12-08T21:29:35+00:00

'Amazon.com Inc., American Express Co., Daimler AG and Stripe Inc. are among those joining a new GitHub program that will let companies directly fund open-source projects and software developers that are key to their businesses.' interesting

intercom/lease

jm — 2020-10-22T10:55:51+00:00

'Lease is a general DynamoDB-based lease implementation, ideal for long-lived work items, with coarse-grained leases', in Go, by the inimitable ex-Swrver Rob Clancy

Benchspace PPE Project Report

jm — 2020-09-11T09:24:21+00:00

report from Benchspace on their open source PPE project during March and April. it's great stuff. 50,000 face shields printed!

Ireland donates its contact tracing app to the Linux Foundation

jm — 2020-07-20T13:31:04+00:00

This is awesome. Congrats to NearForm and the HSE for making some great choices here:

Ireland’s Health Service Executive (HSE) announced today that it is donating the code for the COVID Tracker app as Open Source to the not-for-profit Linux Foundation. This will enable jurisdictions worldwide to quickly build and deploy their own contact tracing apps using a wildly successful proven base. The donated app has been named COVID Green. [...] The rapid adoption of the COVID Tracker app in Ireland exceeded all expectations. One million people installed it in the first 36 hours, and the app currently has over 1.3 million installations. That figure represents more than 30% of people in Ireland with compatible devices. The code is also being used in the app for Gibraltar and the upcoming apps for Northern Ireland, other jurisdictions in EMEA and multiple US states. NearForm continues to enable public health authorities to get a contact tracing application into production within four weeks of project start. By donating the source code to the new Linux Foundation Public Health (LFPH) project, under the Apache License 2.0, the HSE is playing an active role in helping to fight Covid-19 worldwide. Source code for the COVID Green mobile app is available now on GitHub and soon will be followed by all matching backend code. The Linux Foundation is dedicated to building sustainable ecosystems around open source projects to accelerate technology development and industry adoption. LFPH is launching with a mission to use open source software to help public health authorities (PHAs) around the world combat Covid-19 and future epidemics. One of the roles of LFPH is to serve as a forum for collaboration between PHAs, developers, technology companies and academics to ensure the implementation and dissemination of best practices, including privacy and security.

Patent case against GNOME resolved

jm — 2020-05-21T10:33:48+00:00

Great result for open source at large, too!

Today, on the 20th of May 2020, the GNOME Foundation, Rothschild Patent Imaging, and Leigh M. Rothschild are pleased to announce that the patent dispute between Rothschild Patent Imaging and GNOME has been settled. In this walk-away settlement, GNOME receives a release and covenant not to be sued for any patent held by Rothschild Patent Imaging. Further, both Rothschild Patent Imaging and Leigh Rothschild are granting a release and covenant to any software that is released under an existing Open Source Initiative approved license (and subsequent versions thereof), including for the entire Rothschild portfolio of patents, to the extent such software forms a material part of the infringement allegation.

DP^3T

jm — 2020-04-14T14:28:07+00:00

Marcel Salathe says: 'Decentralized Privacy-Preserving Proximity Tracing (#DP3T): SDK and calibration app for iOS and Android, and a backend implementation, are now open source. Actual app with nice UI will follow soon'

Treeware

jm — 2020-03-23T11:59:06+00:00

'a style of software distribution similar to Postcardware, distributed by the author on the condition that users buy the author a tree.'

Open Source COVID19: Our Intent, Needs, and Your Role - Google Docs

jm — 2020-03-21T22:56:08+00:00

'PPE (Personal Protection Equipment) is critical to the protection of healthcare workers, acting as a barrier and therefore controlling exposure to COVID-19. Some of the most fundamental items comprising PPE include gloves, goggles, surgical masks, respirators, protective gowns, and disinfectant. Many of these crucial PPE items are now in short supply due to interruptions in the supply chain, and also from the massive demand as the number of patients infected continues to grow exponentially. Numerous medical devices are required to treat the COVID-19 patient and will also fall into short supply (e.g. ventilators). Shortages of necessary PPE and medical devices will continue to pose a significant problem for healthcare workers and patients around the globe.'

There’s A Shortage Of Ventilators For Coronavirus Patients, So This International Group Invented An Open Source Alternative That’s Being Tested Next Week

jm — 2020-03-19T12:21:11+00:00

Good wrap-up on the Open Source Ventilator project

Open Source COVID19 Medical Supplies | Facebook

jm — 2020-03-18T09:43:31+00:00

A very active group of makers sharing designs and plans for open source face masks, ventilators, etc.

Specifications for simple open source mechanical ventilator

jm — 2020-03-18T09:34:20+00:00

from Julian Botta, Johns Hopkins Emergency Medicine Resident PGY-3 , Twitter: @julianbotta 'This is a living document intended to give non-clinicians/non-respiratory therapists an idea of key ventilator features and one proposed simplified design. I encourage other healthcare professionals who are very familiar with ventilators and their use to give me feedback using the comments feature to improve these specifications.'

Climate Strike Software License

jm — 2020-01-28T13:09:51+00:00

The key bit:

The Software may not be used in applications and services that are used for or aid in the exploration, extraction, refinement, processing, or transportation of fossil fuels. The Software may not be used by companies that rely on fossil fuel extraction as their primary means of revenue. This includes but is not limited to the companies listed at https://climatestrike.software/blacklist

F5 getting a copyright shakedown over NGINX?

jm — 2019-12-12T15:26:33+00:00

This twitter thread seems to allege that Rambler, a Russian ISP, is filing copyright claim over the NGINX source code -- nearly 18 years after it started development

Tensorflow whinge

jm — 2019-12-11T12:05:47+00:00

"Built to do really fancy cutting-edge stuff and also to make common workflows look very easy, but without a middle ground, so either you are doing something very ordinary and your code is 2 lines that magically work, or you’re lost in cryptic error messages coming from mysterious middleware objects that, you learn 5 hours later, exist so the code can run on a steam-powered deep-sea quantum computer cluster or something"

This seems to be a bit of a Google trait. (via Alison Parrish)

Treeware

jm — 2019-12-02T22:39:55+00:00

'You're free to use this package, but if it makes it to your production environment I would highly appreciate you buying the world a tree. It’s now common knowledge that one of the best tools to tackle the climate crisis and keep our temperatures from rising above 1.5C is to plant trees. If you contribute to my forest you’ll be creating employment for local families and restoring wildlife habitats.'

Using offset.earth.

thegreenwebfoundation/datasets

jm — 2019-10-17T11:15:00+00:00

'Open datasets & methodologies for carbon emissions from different activities. Forked from OpenAMEE, and npm installable' This is very impressive -- lots of carbon emissions estimation code.

thoughts on rms and gnu -- wingolog

jm — 2019-10-11T09:36:15+00:00

I can hear you saying it. RMS started GNU so RMS decides what it is and what it can be. But I don't accept that. GNU is about practical software freedom, not about RMS. GNU has long outgrown any individual contributor. I don't think RMS has the legitimacy to tell this group of largely volunteers what we should build or how we should organize ourselves. Or rather, he can say what he thinks, but he has no dominion over GNU; he does not have majority sweat equity in the project. If RMS actually wants the project to outlive him -- something that by his actions is not clear -- the best thing that he could do for GNU is to stop pretending to run things, to instead declare victory and retire to an emeritus role. Note, however, that my personal perspective here is not a consensus position of the GNU project. There are many (most?) GNU developers that still consider RMS to be GNU's rightful leader. I think they are mistaken, but I do not repudiate them for this reason; we can work together while differing on this and other matters. I simply state that I, personally, do not serve RMS.

GNOME Foundation facing lawsuit from Rothschild Patent Imaging

jm — 2019-09-26T10:42:50+00:00

Software patents are a cancer. 'The GNOME Foundation has been made aware of a lawsuit from Rothschild Patent Imaging, LLC over patent 9,936,086. Rothschild allege that Shotwell, a free and open source personal photo manager infringes this patent. Neil McGovern, Executive Director for the GNOME Foundation says “We have retained legal counsel and intend to vigorously defend against this baseless suit.”'

ericflo/mediasummon: Summon your photos and videos back to you

jm — 2019-09-10T11:08:08+00:00

Mediasummon is an open source application that fetches a copy of all your photos and videos, and keeps them continuously backed up into one organized directory either on your computer or on a cloud storage provider.

Currently supports reading from Instagram, Google Photos, and Facebook, and writing to Dropbox, GDrive or S3. Go, MIT Licensed.

Open Source Could Be a Casualty of the Trade War

jm — 2019-06-24T10:08:50+00:00

ideologically, a core tenant of open source is non-discriminatory empowerment. When I was introduced to open source in the 90’s, the chief “bad guy” was Microsoft – people wanted to defend against “embrace, extend, extinguish” corporate practices, and by homesteading on the technological frontier with GNU/Linux we were ensuring that our livelihoods, independence, and security would never be beholden to a hostile corporate power. Now, the world has changed. Our open source code may end up being labeled as enabling a “foreign adversary”. I never suspected that I could end up on the “wrong side” of politics by being a staunch advocate of open source, but here I am. My open source mission is to empower people to be technologically independent; to know that technology is not magic, so that nobody will ever be a slave to technology. This is true even if that means resisting my own government. The erosion of freedom starts with restricting access to “foreign adversaries”, and ends with the government arbitrarily picking politically convenient winners and losers to participate in the open source ecosystem. Freedom means freedom, and I will stand to defend it. Now that the US is carpet-bombing Huawei’s supply chain, I fear there is no turning back. The language already written into EO13873 sets the stage to threaten open source as a whole by drawing geopolitical and national security borders over otherwise non-discriminatory development efforts. While I still hold hope that the trade war could de-escalate, the proliferation and stockpiling of powerful anti-trade weapons like EO13873 is worrisome. Now is the time to raise awareness of the threat this poses to the open source world, so that we can prepare and come together to protect the freedoms we cherish the most. I hope, in all earnestness, that open source shall not be a casualty of this trade war.

[1902.04023] Computing Extremely Accurate Quantiles Using t-Digests

jm — 2019-02-18T11:05:52+00:00

'We present on-line algorithms for computing approximations of rank-based statistics that give high accuracy, particularly near the tails of a distribution, with very small sketches. Notably, the method allows a quantile q to be computed with an accuracy relative to max(q,1−q) rather than absolute accuracy as with most other methods. This new algorithm is robust with respect to skewed distributions or ordered datasets and allows separately computed summaries to be combined with no loss in accuracy. An open-source Java implementation of this algorithm is available from the author. Independent implementations in Go and Python are also available.' (via Tony Finch)

flatmap-stream NPM package backdoor incident

jm — 2018-11-27T10:54:35+00:00

Good twitter thread with background on the incident. 2,000,000 downloads per week, used by many other core libs. It appears the attacker persuaded the (overloaded) legit maintainer to hand over ownership then backdoored the package in order to attack copay-dash, a cryptocurrency wallet app.

SpamAssassin is back [LWN.net]

jm — 2018-11-15T14:52:47+00:00

The SpamAssassin 3.4.2 release was the first from that project in well over three years. At the 2018 Open Source Summit Europe, Giovanni Bechis talked about that release and those that will be coming in the near future. It would seem that, after an extended period of quiet, the SpamAssassin project is back and has rededicated itself to the task of keeping junk out of our inboxes.

This is good to see! Also, newsy thread: https://news.ycombinator.com/item?id=18458212

"The first AI portrait in Christie’s" was mostly output from someone else's open-source code

jm — 2018-10-26T13:04:54+00:00

The print was created by Obvious, a trio of 25-year-old French students whose goal is to “explain and democratize” AI through art. Over the past year, they’ve made a series of portraits depicting members of the fictional Belamy family, amplifying their work through attention-grabbing press releases. But insiders say the code used to generate these prints is mostly the work of another artist and programmer: 19-year-old Robbie Barrat, a recent high school graduate who shared his algorithms online via an open-source license. The members of Obvious don’t deny that they borrowed substantially from Barrat’s code, but until recently, they didn’t publicize that fact either. This has created unease for some members of the AI art community, which is open and collaborative and taking its first steps into mainstream attention.[...] Jason Bailey, a digital art blogger who runs the site Artnome, says that what Obvious has done is far from unusual. “It’s almost weekly in digital art that someone takes some open code and tweaks it and sells it,” he tells The Verge. But the prominence of this auction and the fact that Obvious, not Barrat, has received the attendant prestige and attention does complicate the matter. “There’s a lot of stuff you can do that’s legal, but that makes you sort of a jerk,” adds Bailey. “If I was Robbie, I’d be pretty miffed, and Obvious said they owe him a great deal of credit.” Barrat says he holds no grudges at all and is mostly annoyed that the auction might give outsiders the wrong impression about AI art. “I’m more concerned about the fact that actual artists using AI are being deprived of the spotlight,” he says. “It’s a very bad first impression for the field to have.”

Do not fall into Oracle's Java 11 trap

jm — 2018-09-26T15:29:06+00:00

The key part of the terms is as follows: You may not: use the Programs for any data processing or any commercial, production, or internal business purposes other than developing, testing, prototyping, and demonstrating your Application; The trap is as follows: Download Oracle JDK (because that is what you've always done, and it is what the web-search tells you); Use it in production (because you didn't realise the license changed); Get a nasty phone call from Oracle's license enforcement teams demanding lots of money In other words, Oracle can rely on inertia from Java developers to cause them to download the wrong (commercial) release of Java. Unless you read the text/warnings/legalese very carefully you might not even realise Oracle JDK is now commercial, and that you are therefore liable to pay Oracle for Java.

Software as Craft: software delivery and open source in a Cloud & Enterprise world

jm — 2018-09-09T21:09:03+00:00

Niall Murphy sends this on:

Microsoft is very pleased to welcome Maggie Pint and Dr. Nicole Forsgren to our new campus, to talk about open source and the deep connections between how software is written, and how successful it is. For those of you who are not aware, Maggie Pint is a software engineering lead in Azure’s Production Infrastructure Engineering (PIE) organization. Maggie’s team works on improving the engineering systems experience for Microsoft’s web-focused developers. She co-ordinates open source and inner source education and execution through Azure PIE. Outside of her day job, Maggie maintains the popular Moment.js JavaScript library, and is the JS Foundation’s delegate to TC39, the standards committee for JavaScript. She is passionate about dogs, coffee, the JavaScript language, and helping others live open source values in their day-to-day work. Dr. Nicole Forsgren is the co-founder and Chief Scientist of the DevOps Research and Assessment joint venture with Jez Humble and Gene Kim, also well-known leaders in the DevOps community. She is best known as a co-author of Accelerate: The Science of Lean Software and DevOps and lead investigator for the largest-scale DevOps studies undertaken to date. She is also member of the ACM Queue editorial board, a research affiliate for a number of universities, and earned her PhD in Management Information Systems from the University of Arizona. This event comprises two public technical talks, with an intended audience of a few hundred software and systems professionals, including technical managers and SREs.

The Tidelift Subscription

jm — 2018-05-08T23:08:37+00:00

The core idea of the Tidelift Subscription is to pay for “promises about the future” of your software components. When you incorporate an open source library into your application, you need to know not just that you can use it as-is today, but that it will be kept secure, properly licensed, and well maintained in the future. The Tidelift Subscription creates a direct financial incentive for the individual maintainers of the software stacks you use to follow through on those commitments. Aligning everyone’s interests—professional development teams and maintainers alike. Critically, the Tidelift Subscriptions for React, Angular, and Vue.js cover not just the core libraries, but the vast set of dependencies and libraries typically used in these stacks. For example, a basic React web application pulls in over 1,000 distinct npm packages as dependencies. The Tidelift Subscription covers that full depth of packages which originate from all parts of the open source community, beyond the handful of core packages published by the React engineering team itself.

Parallelizing S3 Workloads with s5cmd

jm — 2018-04-24T09:32:46+00:00

nice parallel download/upload tool for S3, developed by Peak Games, open source, in Go

Apache Airflow at Pandora – Algorithm and Blues

jm — 2018-03-16T23:52:35+00:00

sounds like they are pretty into Airflow

OpenCensus: A Stats Collection and Distributed Tracing Framework

jm — 2018-01-18T14:24:25+00:00

Google open sourcing their internal Census lib for service metrics and distributed tracing

VLC in European Parliament's bug bounty program

jm — 2017-12-04T22:44:18+00:00

This was not something I expected:

The European Parliament has approved budget to improve the EU’s IT infrastructure by extending the free software security audit programme (FOSSA) and by including a bug bounty approach in the programme. The Commission intends to conduct a small-scale "bug bounty" activity on open-source software with companies already operating in the market. The scope of this action is to: Run a small-scale "bug bounty" activity for open source software project or library for a period of up to two months maximum; The purpose of the procedure is to provide the European institutions with open source software projects or libraries that have been properly screened for potential vulnerabilities; The process must be fully open to all potential bug hunters, while staying in-line with the existing Terms of Service of the bug bounty platform.

Open-sourcing RacerD: Fast static race detection at scale | Engineering Blog | Facebook Code

jm — 2017-10-19T16:17:27+00:00

At Facebook we have been working on automated reasoning about concurrency in our work with the Infer static analyzer. RacerD, our new open source race detector, searches for data races — unsynchronized memory accesses, where one is a write — in Java programs, and it does this without running the program it is analyzing. RacerD employs symbolic reasoning to cover many paths through an app, quickly.

This sounds extremely interesting...

Abseil

jm — 2017-09-28T09:02:54+00:00

a new common C++ library from Google, Apache-licensed.

The React license for founders and CTOs – James Ide – Medium

jm — 2017-09-11T10:23:09+00:00

Decent explanation of _why_ Facebook came up with the BSD+Patents license: "Facebook’s patent grant is about sharing its code while preserving its ability to defend itself against patent lawsuits."

The difficulty of open sourcing code at Facebook, including React in 2013, was one of the reasons the company’s open-source contributions used to be a fraction of what they are today. It didn’t use to have a strong reputation as an open-source contributor to front-end technologies. Facebook wanted to open source code, though; when it grew communities for projects like React, core contributors emerged to help out and interview candidates often cited React and other Facebook open source as one of the reasons they were interested in applying. People at Facebook wanted to make it easier to open source code and not worry as much about patents. Facebook’s solution was the Facebook BSD+Patents license.

bet365 to save Riak

jm — 2017-08-28T13:16:39+00:00

'It is our intention to open source all of Basho's products and all of the source code that they have been working on. We'll do this as quickly as we are able to organise it, and we would appreciate some input from the community on how you would like this done.'

Fsq.io

jm — 2017-08-16T09:15:51+00:00

Foursquare's open source repo, where they extract reusable components for open sourcing -- I like the approach of using a separate top level module path for OSS bits