Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Email Encryption Software Relies on One Guy, Who Is Going Broke

propublica.org

Post reply on HN
Print view View original

331–340 of 469 posts

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#331

Post by rectang »

davidw wrote: post #270
copsarebastards wrote: post #260

Earlier quoted context omitted.

Debian, Ubuntu, OpenSSH, Firefox, Apache, etc. In addition, some projects that are not well-funded as a project are "funded" in the sense that companies pay people to work on them, for example Microsoft paying Simon Peyton Jones to work on GHC.

It's a complex topic, so I think it's best to look at different funding models differently. Ubuntu is funded by Canonical. http://en.wikipedia.org/wiki/Mark_Shuttleworth in other words. So one big donor. Debian... seems to mostly get by on volunteer labor and be ok with it, or it did when I was involved with them. Has that changed? I suspect that in some ways Debian is underfunded given the amount of work they do. Pe…

    > The Apache Software Foundation does a decent job at
    > fundraising, and even employs a few people to do stuff
    > like administration. Most of the projects get by with
    > companies that pay people to work on them, which seems
    > to work out pretty well.
The ASF budget is roughly 1.2 million a year, the bulk of which goes to maintaining infrastructure for 200+ projects.

https://www.apache.org/foundation/records/minutes/2014/board...

As a 501c(3) non-profit, it is constrained as to what it can do with donations.

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#332

Post by kluliss »

tptacek wrote: post #32
mseebach wrote: post #26

Given the general scarcity of talent in the business, it should really be trivial for a high end IT security consultancy to pay Werner a €3000/month (ie. enough to live on, if not extravagantly) retainer to be available ~10 hours a month to consult on encryption matters (or something like that). I wonder if it all really comes down to "Really I am better at programming than this business stuff." or if there is some u…

The task of maintaining GPG isn't principally cryptographic. GPG is one of those classic un-fun projects that the open source community is notorious for neglecting. So the problem isn't finding and funding cryptographic experts to work on it; the problem is finding Werner Koches who are willing to take on the slog of making sure GPG continues to work. Look at how many crappy, trivially broken crypto messaging systems…

Aren't you ever tired of being wrong all the time? I swear, the only time I comment on this Digg-clone website is to counter your incredible BS.

Lots of people would love to work on it. But who can work for free? No one that I know of.

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#333

Post by Alupis »

hf wrote: post #149
mason55 wrote: post #100

Earlier quoted context omitted.

> How would a free software project 'pay it forward'? As mentioned by the grandparent comment, GPG is in use by Debian, Ubuntu and RedHat package managers. Whether or not you count those three as free software they have plenty of money to pay forward to a piece of software that underpins their entire stacks.

The point isn't easily settled, it seems: I am having a hard time to find financial statements from Debian. Ubuntu, or rather Canonical, being a private company, doesn't seem to release financial information. The Ubuntu main page doesn't even provide a 'donate' link anymore. Which leaves RedHat, at last. A public company, of course[0]: Operating profit 2014: $ 1.3e9 Net total income 2014: $ 178.3e6 [0] http://investo…

Here's Canonical's 2013 numbers:

http://www.scribd.com/doc/199373896/Canonical-Group-Limited-...

21 million USD negative, largely due to Ubuntu development and related expenses.

Canonical has never been profitable, which is why Shuttleworth constantly re-invests his own personal capital in the company.

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#334

Post by BjoernKW »

Kalium wrote: post #183
BjoernKW wrote: post #69

The problem boils down to "Really I am better at programming than this business stuff.". Someone with his talent and expertise should have no problem with getting highly paid consulting gigs. Then he could continue working on GPG in his free time and even use the consulting income for hiring additional programmers to work on GPG. There are quite a few product-based businesses that could be built upon GPG as well (sec…

Stallman doesn't and has never glossed over that programmers need to make a living. He has no qualms about charging for software and has happily done it himself. He says it's wrong to use licenses to force people into depending on you.

Good point. It's not that clear and easy in all cases though. Besides, Stallman once disparaged SaaS business models as unfree and essentially a problem to be dealt with. While that in way makes sense from his point of view, it's problematic for developers who try to make a living with providing a useful service.

I very much agree for all system software and especially cryptographic and security-related software.

What about a developer or a company though that's put several years worth of work into developing a particularly useful novel solution to a specific business problem? If they use a proprietary license they'll at first force others into depending on them once they start using the software but is that really wrong in every case? If on the other hand they immediately release their code under an open source license they might effectively commoditize their novel solution. Sure, they might be able to recoup some of their up-front investment but in most cases this won't be a sustainable business model.

Releasing the source code only to paying customers might seem like an obvious solution but depending on the nature of the software and the industry the customers might decide to just pay once and afterwards sideline the developer. Continued innovation can serve as an incentive to pay for updates but again this doesn't apply to all fields and industries. Licenses such as AGPL might be a remedy, too but from experience I can see that software licensed under these or similar terms is mostly avoided in business contexts. I'm not sure if there's any company that's built a viable long-term business on a dual-licensing model.

Not every closed source (or only partially open source) software product is created with malicious "Let's blackmail the customer into using our software forever." intent. Sometimes, it just makes good sense. However, in those cases I think companies should at least make provisions for releasing the code if they go out of business.

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#335

Post by tptacek »

dankohn1 wrote: post #329
tptacek wrote: post #321

Earlier quoted context omitted.

And the Linux Foundation kicked in $60K!

And please note that the Linux Foundation's Core Infrastructure Initiative funded him prior to the article.

I think we're talking about the same donation. It's recent.

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#336

Post by tptacek »

kluliss wrote: post #332
tptacek wrote: post #32

Earlier quoted context omitted.

The task of maintaining GPG isn't principally cryptographic. GPG is one of those classic un-fun projects that the open source community is notorious for neglecting. So the problem isn't finding and funding cryptographic experts to work on it; the problem is finding Werner Koches who are willing to take on the slog of making sure GPG continues to work. Look at how many crappy, trivially broken crypto messaging systems…

Aren't you ever tired of being wrong all the time? I swear, the only time I comment on this Digg-clone website is to counter your incredible BS. Lots of people would love to work on it. But who can work for free? No one that I know of.

And the reason OpenSSL and OpenSSH and, I don't know, every other open source project that has spare-time developers have developers committing code for free would be...

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#337

Post by mholt »

unreal37 wrote: post #176
kylec wrote: post #70

I wish there was a sort of "Patreon for open source" nonprofit service where I can support projects like GnuPG, OpenBSD, etc all in one place.

Would Patreon or Gittip (which has changed its name to something I can't recall at the moment) not work for this? In fact, Gittip's original mission was tips for open source projects.

Gratipay. Unfortunately their execution has been a bit poor, and it's under-delivering. There's too high a barrier to start donating and there's no clear option for one-time donations.

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#338

Post by BjoernKW »

Retra wrote: post #255
BjoernKW wrote: post #69

The problem boils down to "Really I am better at programming than this business stuff.". Someone with his talent and expertise should have no problem with getting highly paid consulting gigs. Then he could continue working on GPG in his free time and even use the consulting income for hiring additional programmers to work on GPG. There are quite a few product-based businesses that could be built upon GPG as well (sec…

>There's also a problem with the purism put forth by some of the 'free as in freedom' enthusiasts, most notably Richard Stallman, who seem to gloss over the fact that coders have to make a living, too or who even frown upon making money with software altogether. Software eats the world but even RMS can't eat software. Here you are saying "free as in freedom", while obviously referring to "free as in beer." Your earni…

You're right. The problem is though that it's not always that easy to distinguish between beer and freedom in this context. Depending on the software and the industry those two might be intrinsically connected.

Besides, you might need a large number of lawyers anyway, for example if a company decides to simply disregard your carefully crafted open source license.

Re: Email Encryption Software Relies on One Guy, Who Is Going Broke

#340

Post by Alupis »

sophacles wrote: post #80
hf wrote: post #71

Earlier quoted context omitted.

I freely confess to being flabbergasted by these displays of less-than-rigorous thought processes. How would a free software project 'pay it forward'? They are in a very similar position, aren't they? Edit: For some reason, I can't reply to child comments (probably a cool-off time-out at work?). Just a short note here, then: $1.25e6 for the FSF translates to 10 developers like Koch being paid (the donation page quote…

There are many free software projects that are decently or well funded. They have no problem meeting their donation requests, and having a good budget year over year. These projects are usually end user facing, in a way that their dependencies aren't. It seems reasonable that these projects should consider adding items to their budget to redistribute funds to projects that they depend on. Some probably do this, howev…

> There are many free software projects that are decently or well funded. They have no problem meeting their donation requests, and having a good budget year over year.

Too bad OpenSSL wasn't one of them until after the big "heartbleed" incident.

The core infrastructure projects don't seem to get as much funding as they ought to, especially given almost everyone relies on them (even if they don't realize it).

Prior to Heartbleed and the industry rallying to fund critical projects, OpenSSL only received an average of $2,000 USD a year[1]... that's pathetic.

[1] http://arstechnica.com/information-technology/2014/04/tech-g...

Post reply on HN