Avoiding a Geopolitical open-source Apocalypse

https://thenewstack.io/avoiding-a-geopolitical-open-source-apocalypse/

by benocodes • 2 years ago

34 50 2 years ago

a sort of United Nations of Open Source that equally represents all.

If you think the UN equally represents all, you are mistaken. The UN basically exists as a forum for the major powers at the end of WWII to wield influence with a veneer of respectability (see Permanent Security Council).

Ultimately, developers live in nation states, and need to eat, pay taxes, avoid getting throw in prison, etc.

Nation states are also well aware of the power of software and won’t ignore it like they did before. Software, including open source is part of the full-spectrum competition.

Given the geopolitical rivalries, I have approximately zero hope that open source will avoid these rivalries

whatshisface• 2 years ago

Up to this point nations have shown no interest in funding open source software and that's likely to continue. (This is despite the fact that Linux fuffills the public benefit argument for science funding better than most research.)

Retric• 2 years ago

Governments have minimal incentives to fund things that are working without their funding.

kayo_202110303• 2 years ago

I have no doubt that governments will fund the planning and implementation of exploits, polluting OSS libraries and systems, when it's in their interest to do so. Possibly over the long-term, using a combination of social engineering and code itself.

floren2• 2 years ago

"nation-state" has a particular meaning and it's not "a smarter-sounding way to say country"

ARandomerDude• 2 years ago

Your comment would be much more helpful if you explained your thoughts. Currently, it just sounds like "you're stupid."

tptacek• 2 years ago

For those wondering, the actual smarter-sounding way to say "country" is "state-level actor".

So, open source developers live in state-level actors, is the cool way to say it.

kayo_202110303• 2 years ago

Yes, I'd go with the zero hope option too.

Nation states are also well aware of the power of software and won’t ignore it like they did before.

In 2020, DARPA instituted the CyberSocial project. One of its goals was to find ways to identify code introduced maliciously (for lulz, patriotism, or profit) to OSS projects where the intention of that code is to create or exploit vulnerabilities.

There's a decent, accessible discussion of the issues at

https://www.ifri.org/en/studies/software-power-economic-and-...

amelius• 2 years ago

Nation states are also well aware of the power of software and won’t ignore it like they did before. Software, including open source is part of the full-spectrum competition.

Why then is OSS not funded like scientific research?

pmontra• 2 years ago

Because the tools to write OSS are cheap. A laptop and a brain are enough. Everybody already got them. About time and paying one own bills: some people volunteer and somebody are paid by their employees to write open source or to occasionally contribute to it. I did it myself years ago. We needed to add some functionality to an OSS library and I asked to my customer if I could send the patch to the project on GitHub. They told me yes and I believe it's still there. GitHub inflicted 2FA to me for that later on, but that's another story.

Some scientific research tools are as cheap as what we use to write software. Other tools cost a lot, from the 10 thousands to the billions. They are funded in several ways from universities, research labs to transnational entities.

That could change with AI models because collecting data and training cost a lot, but they are not the usual OSS piece of code so I'm not sure that they belong to this thread.

specproc• 2 years ago

I've worked around (and occasionally in) UN agencies for a good deal of my career, and it's getting to the point where I'd be surprised if it lasts another decade at this rate.

I'd like to avoid a very dicey political hole here, but let's just say the inability of its governance structures to prevent recent conflicts or protect its peacekeepers puts it squarely in League of Nations territory.

nradov• 2 years ago

The UN has also been unable to prevent terrorists from infiltrating it's agencies.

https://news.un.org/en/story/2024/08/1152841

MichaelZuo2• 2 years ago

How does it make sense for there to be ‘splits’ on a regional basis?

By definition, there cannot be any effective barriers between any part of ‘open source’ and any other part, assuming they are not made under mutually contradictory licenses.

So there cannot possibly be any differences lasting much longer than the time it takes to review the relevant codebase.

__MatrixMan__• 2 years ago

"Open source" doesn't require that the readme, comments, issues, and PR's use a language that you know. So depending on who you are, reaching the point where you're able to effectively collaborate could be the work of years.

Aside from that though, I agree. I can't see and technical reasons why one wouldn't mix oss from both communities, thereby bridging it into a single community.

MichaelZuo2• 2 years ago

There are plenty of translation tools available to overcome linguistic barriers with a few clicks. Which is more effort than zero clicks, but hardly a significant barrier.

And some of those tools could actually be better, in pretty much any language pair, then the majority of native speakers themselves.

rightbyte• 2 years ago

"As a community, we must look beyond geopolitical conflicts"

Is this even a problem? People in most FOSS projects does not seem to care at all about nationality, race and etnicity. I think most people don't care at all about 'geopolitics' in the first place. It is some pissing contest for the elite.

And even if they did, any user can be anonymous, and many projects accept pseudo-anonymous contributions.

homebrewer• 2 years ago

Well, it depends. Several nginx core developers were laid off in 2022 for no fault of their own. Then we have examples like this:

https://news.ycombinator.com/item?id=35137213

I also wouldn't say it's all roses, some of my Russian and Jewish friends have felt very uncomfortable participating in FOSS projects during the past couple of years, although it has cooled off somewhat recently. (I have many in both countries for historical reasons.)

It's easy to think there is no discrimination when you're not on the receiving side of it -- some significant minorities in the US should know this very well.

hdjjhhvvhga3• 2 years ago

I also wouldn't say it's all roses, some of my Russian and Jewish friends have felt very uncomfortable participating in FOSS projects during the past couple of years

Yeah, this is something I often argue about with my colleagues. They claim that Russians brought it upon themselves, that they should oppose Putin etc. These arguments are ridiculous when you dig deeper, as an individual in Russia, whether a powerful one like Navalny once or almost unknown like the pianist hero Pavel Kushnir, you mean nothing. You will disappear just like that and nobody will even say a word.

Of course when you start advocating the war online and spread putinist propaganda, that's another question. But normal Russians are normal people like you and me, if anything they are more hostages of this terrible situation than Westerners.

joshdavham• 2 years ago

Is this even a problem?

Nope it’s not! I’m a little befuddled as to why this article was even written. I’ve collaborated with a bunch of Chinese devs and we never feel that politics are relevant or are suspicious of each other. We’re just a bunch of nerds hacking on projects across a large timezone.

michaelt• 2 years ago

People in most FOSS projects does not seem to care at all about nationality, race and etnicity.

Largely true - but have your parser report "ERROR: Expected T_PAAMAYIM_NEKUDOTAYIM" and see how the user/contributor community reacts :)

lynx232• 2 years ago

Anyone else notice the irony? We're talking about Open Source, right? Then, "will the west adopt chinese software", which has a xenophobic touch. But wait, a paragraph later "Can I sell this to our clients?" Well, you know, I am too long into FLOSS to not notice this corporate bullshit. Its open source, you dont have to be able to sell it, MBA.

portaouflop• 2 years ago

Right and OSS maintainers live off hugs and kisses.

Screaming treason whenever someone tries to make a living off OSS is the main reason the community is so toxic/in constant crisis.

lynx232• 2 years ago

I am all for maintainers getting something for their work. What I object to, is a guy sitting in the west, xenophobically pointing at the east, and at the same time, asking themselves if they can sell that stuff from over there. Thats a different situation, and you know it.

emilamlom2• 2 years ago

One reason for the somewhat separate open source ecosystems that the author doesn't touch on is language. In my experience, the dev communities are already pretty separate simply because the languages are so different from each other. Japanese dev communities follow a similar pattern from what I know.

While I'm sure the geopolitical issues cause some division, I'd be willing to bet the main reason is much more fundamental and the two ecosystems just naturally developed separately.

ikanreed• 2 years ago

Google is too "helpful" in assuming what I want instead of what I say for me to find it anymore, but there was a Linus Torvalds quote about how it didn't even occur to him to write linux in anything but english, even though that's not his native language.

Those days are done. The world now has plenty of internet for any language you speak, and there's no need for standardizing on the "biggest" language.

emilamlom2• 2 years ago

Agreed. I think a lot of native english devs don't realize just how much english permeates every aspect of software. Another post on HN talking about the process of digitizing Tibetan mentioned how line breaks aren't really a thing in that language. But of course, they're everywhere in software and required for things to even function. So many decisions are based on language that go beyond actual communication. It's kinda wild to think about.

alexisread3• 2 years ago

I guess you could look at this as a restatement of the 'Reflections on trusting trust' paper (https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...), in that the whole software chain needs securing ideally (though there is value in even doing parts of it).

I don't think that will be possible with federated governance, rather the chain is probably best secured mathematically and in a distributed fashion. Potential use for the blockchain/merkle-clock event log/zksnarks etc. ?

kayo_202110303• 2 years ago

I don't think it's as much a technical problem as it is a social, or process, problem. Math and distribution won't solve those. If the introduction of an exploit is done well (e.g. the XZ exploit), the provenance of the malicious code will pass muster. It'll just be doing bad things, at least from the OSS consumer's perspective.

fsflover3• 2 years ago

Can't it be solved with the reproducible builds?

alexisread3• 2 years ago

Somewhat yes, but compilers can inject vulnerabilities, and you also require composable code to avoid composition vulnerability.

saagarjha2• 2 years ago

That’s not really what the paper is about.

alexisread3• 2 years ago

As far as I can see, the article is somewhat about whether we can trust open source software, given political tensions, language barriers, and malicious actors.

To that, the article suggests a central authority with global membership to create trust. If the W3C is representative of that, then regulatory capture is a real possibility, or balkanisation if there is disagreement.

Trust in balkanised orgs is of course a problem, and hence trust in the code - the paper deals with a similar issue ie. How to trust code. In this case though, the idea is to be able to verify the code yourself, rather than trust an org.

The paper centres on whether you can trust the compiler ie. The bootstrap problem, and while tech alone will never solve the issue, the capability to create trust in the code yourself can be a basis for better layered trust on top.

To add to this, signed builds/source on their own are not a solution as a compiler or malicious actor can inject bad code.

As such, yes I don't believe a central, or federated orgs alone can be a solution, you're likely to need a solid bootstrap and chain of trust (and maybe content-addressed code) to underpin the quality of the code.

clwg• 2 years ago

I'm not really following — is the author discussing funding/foundations for Open Source software and supply chain security? The rise of "communities" in other countries doing open source development? Or how the East can't trust the West, and vice versa? The geopolitical aspects and cyber norms discussions are already happening[0] but in ways and at a pace that usually frustrate technical people.

I like DHH's take on Open Source[1]: "Using open source software does not entitle you to a vote on the direction of the project. The gift you've received is the software itself and the freedom of use granted by the license."

We should welcome these new communities and thank them for their contributions and perspective. As long as I have the freedom to choose, and censorship isn't a barrier I don't see an issue - they can do what they want. With OSS I can at least review the code and form my own opinion on who and what I should trust.

[0] https://www.csis.org/analysis/creating-accountability-global... [1] https://world.hey.com/dhh/open-source-is-neither-a-community...

AStonesThrow2• 2 years ago

Headline's word choice amuses me, because the literal meaning of "apocalypse" is "uncovering, revelation" which is quite appropriate for anything "Open Source", isn't it?

squigz• 2 years ago

I imagine you also get amused when people use 'literally' figuratively?

AStonesThrow2• 2 years ago

Yes and I return to this series https://youtube.com/playlist?list=PLGVpxD1HlmJ-dLBoRLP91gvRJ...

liminal• 2 years ago

This has already happened. We won't use software, open-source or otherwise, from an adversarial nation.

015a• 2 years ago

I'm not sure I understand why this is an apocalypse. Diversity is great. While I'm sure the CNCF would love a world where literally everything ran on kubernetes, as one example, the reality is that making kubernetes the one tool for everything everywhere all at once will only turn it into a piece of certification design-by-committee garbage (which, let's be real, it basically already is). We should not want one unified world of open source; I love the idea that anyone, whether divided by race, nationality, or just thought process, is out there approaching problems from a different angle and rethinking from first principals. We should share ideas, not code.

greatgib• 2 years ago

In my opinion, this article doesn't really have a real argument but is more trying to capitalize on FUD on open source.

syngrog66• 2 years ago

its complicated by fact that the Russian and Chinese govs run ops to try to compromise software and systems worldwide, partly to help achieve certain goals like stealing IP or acquiring blackmail, to cite just a subset. And while not in a hot (shooting) war with the US/NATO/EU we are de facto in a soft/hybrid one.

Current generation is far too trusting of any ole rando FOSS code or SaaS they see pitched. Recklessly naive. If I had the amorality to be a black hat I'd be having the time of my life right now. GitHub alone is one of the best malware injection vectors ever.

johnea• 2 years ago

Who cares if open source dies?

We'll still have free software...

Avoiding a Geopolitical open-source Apocalypse

Related Stories