Glorified network janitor. Perpetual blueteam botherer. Friendly neighborhood cyberman. Constantly regressing toward the mean. Slowly regarding silent things.

  • 3 Posts
  • 13 Comments
Joined 1 year ago
cake
Cake day: December 27th, 2023

help-circle

  • I’ve been politically active most of my life and I’ve voted (I’ve got a dual citizenship, so I can vote in two countries, which I’ve done), however, as I’ve grown older and am now nearing retirement age, I’ve realized the futility of it all. The same elite politicians are still in power. They still top their party ballots (“the big names”, “heavy hitters”) and normally get auto-elected to the parliament. They are creatures that live within the system and thus the system never changes. Issues haven’t been solved - at most we’ve reached some kind of muddled centrist consensus and agreement that “this is what it is” - there’s actually very little reform and every mandate period with sways a bit, like a wave reaching to hit the beach to wash away the sand castle but not quite reaching.

    The old truism of “people being more conservative as they age” has been completely opposite for me. In my youth I was probably liberal, slightly right leaning democrat - these days I’m very firmly anti-authoritarian and anti-capitalist libertarian socialist and believe in self-governance and workers’ self-management. I organize whatever I can in my local community but I’ve stopped voting (I don’t resent anyone else for voting - please do if you believe it’s useful).

    When it comes to the political system in the U.S - I have opinions of course. Largely irrelevant, since I don’t live there, but I find it hard to “fix” something that wasn’t designed to be fixed in the first place. Cory alluded to it in his post, but the founding form of the union was not really intended for greater social justice, cultural realization or to allow the repressed to politically participate. It was for a small group (the political elite) to rule on behalf of wealth of the nation, and the majority’s decision-making was confined to choosing among a select number of their peers within tightly controlled elective processes.

    It sort of “consensual domination” made possible by the concentration of global capital, which allows concentration of political power. I think it’s hard to fix something that was designed to sail off course. I think the better option would be to change the system.

    But I don’t deny that we could make it better. Considerably so. Many of those things you list would improve and reform. But in the end it would still be the same system.

    Sorry for the wall of text. Not sure if that made much sense - I hope it was somewhat coherent and not just my braincells having a spat of ADHD.












  • Thanks for the share.
    Obviously Perens is one of the FOSS OG figures and he makes a lot of good points. Lately the RHEL/IBM situation has shown a mere license text file isn’t going to keep megacorps from finding ways to circumvent the ideology and the purpose behind it. They have simply too many resources both in development and in legal departments and too many ways to work around the legalese of its intended purpose .

    Also there’s been an increasing trend where products (Elastic etc) start off with FOSS license and as soon as they gain critical mass, they split their product and switch to their own FOSS-light license and gimped “community edition” downloads. Again, all still legally above the board, but at the same time completely ignoring the intended purpose of the license in the first place.

    I think what Perens is proposing is too complicated. I understand that “contract” has far more binding legal fire power compared to a “license”, but as he also points out in the article, it complicates things to the point where it’s hard to adopt. The problem is of course far deeper than just licensing and has its roots deep somewhere in late-stage capitalism and deregulation of corporate entities and those are of course not problems that Perens or the free software community can easily solve. Unfortunately.

    It’s clear that something new is needed and I appreciate the work he is doing. I’m not sure it’s the right direction to take, but can’t say I have any rabbits I can pull out of my hat either, so I’ll follow this with interest.


  • Well, that article was a hot mess.

    I appreciate the authors effort and they are correct about lack of “what is VPN” articles that are not written by VPN-vendors in marketing purpose. But I’m not sure if this was it.

    Writing an article meant to “debunk” misconceptions and getting two core concepts, Security and Privacy mixed up right from the start wasn’t very good.

    A lot of time was spent on explaining HTTPS and how it somehow magically makes you and your data secure on the Internet and it completely missed to mention who the potential threat actors thwarted by HTTPS are?

    Could have probably used a chapter on how actual threats (both security and privacy) work and how don’t have much to do with the level of encryption your TCP/IP connection happens to encapsulate.

    The last chapter with the first 3 bullets was pretty good though. That could have just been the whole article and it would have been alright.

    Oh well. Attempt was made.


  • I do security as my dayjob (more blue team stuff these days, but used to do pentesting in the past).

    Software development normally comes down to a holy trinity of Speed/Cost/Quality. You can only pick two.

    Commercial software has time/cost constraints so they often pick speed and cost over quality initially. FOSS software doesn’t need to “get to the market”, but also doesn’t have any money, so you often get cost/quality over speed.

    However - in larger enterprises there’s so much more, you get the whole SDL maturity thing going - money is invested into raising the quality of the whole development lifecycle and you get things like code reviews, architects, product planning, external security testing etc. Things that cost time, money and resources.

    FOSS software is generally going to be missing this, unless the project gets popular and picked up by some big megacorp that bankrolls the development (Google, IBM etc). Look at mission critical projects like OpenSSL that was (until Heartbleed) more or less one man project.

    Commercial software also needs to invest in licensing, support, documentation, certifications, training and potentially integration partners. It’s a whole different playing field. FOSS has easier time, because it’s generally just pointing at the code and saying “well send a PR”.

    Then you have the whole devops thing, where you might take FOSS software and build a whole commercial service around it.

    And all of this is just generalizing of course, because unless we’re just comparing small programs, there’s really no way to do objective comparisons between “commercial” and “free” without writing a full 50 page thesis.