Anything they "maintainer of last resort" would actually be forks, or collectively a distribution. We already have hundreds of distributions acting as maintainer of last resort many times over, only with actual developers and not presuming to make themselves the new upstream for anyone else.
We all depend on open source. We will defend it together
11–20 of 257 posts
Re: We all depend on open source. We will defend it together
#12> We are joined by Amazon Web Services, Anthropic, Chainguard, Cisco, Citi, Endor Labs, Ericsson, Google, IBM, JPMorganChase, Microsoft and GitHub, NVIDIA, OpenAI, RapidFort, Red Hat, Rust Foundation, Sonatype, Vodafone, and Zscaler Many of the names on the list makes the initiative rather suspect. Companies who do a lot to undermine free and open-source software, who hide critical software behind their walls, preven…
Yeah, a bunch of the worst free riders and malicious consumers all in one place.
All they're really missing is Oracle and Bambu Lab.
Re: We all depend on open source. We will defend it together
#13[deleted]
Re: We all depend on open source. We will defend it together
#14[flagged]
Re: We all depend on open source. We will defend it together
#15[dead]
Re: We all depend on open source. We will defend it together
#16Anything they "maintainer of last resort" would actually be forks, or collectively a distribution. We already have hundreds of distributions acting as maintainer of last resort many times over, only with actual developers and not presuming to make themselves the new upstream for anyone else.
Microsoft controls NPM and GitHub. I would not put it past them to truly take over a project if they gauged it in their best interest (though it would be a massive violation of trust, so I'd imagine they'd tread carefully before going there).
If it's sent to Akrites, they can even pretend it's done responsibly – even though only megacorps get a seat around that table.
Re: We all depend on open source. We will defend it together
#17> Additionally, when a critical package has no one maintaining it, Akrites will stand as the maintainer of last resort so a fix can still reach everyone in a timely fashion. Ambitious and interesting. I wonder how long this will last and on whose dime and time? Akrites employs no engineers, so who will make the fixes and who'll pay them?
Who they employ then? AI?
> Today, the undersigned commit real resources — engineering talent, security expertise, and funding — to harden the software we share
Re: We all depend on open source. We will defend it together
#18Why only a focus on Open Source? I feel like vulnerabilities in closed source products like Microsoft Office, Microsoft Windows, and Google Chrome to name a few can be just as essentially and foundational as other open source software for many businesses.
I think the idea is that automated source code processing is making it possible to find vulnerabilities at great speed and in an overwhelming way in software that does not have paid maintainers, whereas closed source software in active use has both less accessible code and paid maintainers. A charitable foundation might be plausible to help companies secure their closed for-profit software but it doesn’t really have…
>both less accessible code
Yet still important to be secured due to the impact vulnerabilities can have. And LLMs can work without source code access via utilizing things like debug symbols, disassembly, reverse engineering, etc.
>paid maintainers
Just like open source maintainers their time is already being spent on other things which they see as more important over making the project 100% security bug free. Just because they are being paid, that doesn't make security their number 1 priority.
Re: We all depend on open source. We will defend it together
#19Unforteuately I think it's moot to post this on hacker news. The majority of people here drink deep from the AI pool and just don't care.
Besides many of the companies on the list are suspext numero uno for the state of open source
Re: We all depend on open source. We will defend it together
#20> Additionally, when a critical package has no one maintaining it, Akrites will stand as the maintainer of last resort so a fix can still reach everyone in a timely fashion. Ambitious and interesting. I wonder how long this will last and on whose dime and time? Akrites employs no engineers, so who will make the fixes and who'll pay them?
Yeah, very commendable. Now I just wish the closed-source software that have lost support could similarly be supported this way, with the help from AI, so we don't have to throw away that many hardwares when their software can no longer be updated.