Core Infrastructure Initiative

http://www.linuxfoundation.org/programs/core-infrastructure-initiative

by chiachun • 12 years ago

251 86 12 years ago

gnu82• 12 years ago

Their web page says OpenSSL group is their first candidate for funding. It's puzzling that they would choose to fund such a corrupt and incompetent organization over LibreSSL, which is actually fixing the code and ultimately is what will actually be used.

Or maybe it's not so mysterious, the principle companies involved have a long record of benefiting from OpenSSH and never contributing to that either.

privong• 12 years ago

LibreSSL is a fork for OpenBSD and doesn't have all the functionality of openSSL (e.g., no Windows support), so it's not a given that LibreSSL will actually become the standard. Also, despite the issues with openSSL, there is significant name recognition for it. That means that funding and improving openSSL can potentially lead to a better outcome than funding libreSSL. I mean this in the sense that funding something else (e.g., LibreSSL) could result in a situation where people still use openSSL because they know the name but that the improvements are going elsewhere. Sure, you can say that people should switch, but name recognition can be tough to overcome.

jbk• 12 years ago

This is untrue. It removed Windows build support, not Windows support.

nayden3• 12 years ago

To make the code auditing easier a number of code paths irrelevant to OpenBSD were removed.

Once the code is audited and bugs corrected portability is next. This will only happen if the right team is in place, the community wants it, and sufficient funding is secured.

dlgeek2• 12 years ago

I think as long as LibreSSL plans on ripping out the FIPS stuff, it's not going to replace OpenSSL in a huge number of places. Don't get me wrong, I think it's the right decision for the OpenBSD guys, and for the security of the library, but it's definitely going to limit adoption.

clarry6• 12 years ago

I don't mind it if people fund and contribute to OpenSSL. Improved software is improved software whether you prefer another fork or not.

However, I will personally refrain from funneling money into any project if it is not clear that money will make a difference. It's like donating to charities who cannot ensure the money actually ends up in the right place and actually helps the lives of the people who they (cl)aim to help. I'm more likely to donate to projects that have proven their worth, like OpenBSD. The proof, hard work, should come first. Donations might follow.

davidw2• 12 years ago

The proof, hard work, should come first. Donations might follow.

Part of the problem with funding open source is that an agent acting only in their own short term interests is going to say: "ok, someone already did the hard work, the results are free!", and won't donate anything.

cryptolect• 12 years ago

I don't know about corrupt and incompetent... maybe under-resourced and apathetic babysitters of a legacy-ridden codebase.

zimbatm• 12 years ago

The OpenBSD guys are applying their knowledge in system designs to sanitize the code and making it more standard. It doesn't qualify them to work on the algorithm parts.

How many years have you been benefiting from the work that was put behind OpenSSL ? What about being a bit grateful for the amazing work they did with basically no funding ?

skrause• 12 years ago

It doesn't qualify them to work on the algorithm parts.

Since they also develop OpenSSH, wouldn't that qualify them to also work on the algorithm parts?

DanBC• 12 years ago

It is amazing to me that I buy a computer with an OS and aparently zero of that money goes to the people writing some of the important code used in that OS.

Windows used to use BSD stuff for the network stack. OSX uses a lot of BSD stuff. These are not poor companies. Including a per-licence donation of a few US cents would have been a significant contribution.

JonnieCache• 12 years ago

How exactly are they corrupt?

remon2• 12 years ago

I think it's spectacularly naive to assume LibreSSL will be widely adopted beyond FreeBSD just because it's a cleaner codebase.

clarry6• 12 years ago

Just because.

What if it also had fewer bugs, is more receptive to contributed bug fixes, runs clean in Valgrind, etc.?

midas0077• 12 years ago

The point of LibreSSL is to be a potential competitor and an apparent existential threat to scare OpenSSL into getting its house in order.

nayden3• 12 years ago

The primary goal of LibreSSL is to fix the OpenSSL codebase for OpenBSD. If other communities like the changes there could be a portable versions as alluded by the LibreSSL web site.

Think OpenSSH -> OpenSSH-portable.

Twirrim• 12 years ago

It's worth noting that a number of the businesses that are contributing will have a need to provide FIPS compliant services, something LibreSSL has completely thrown out the window.

a2079648• 12 years ago

Looks like somebody is trying hard to prevent LibreSSL from becoming widely adapted.

By raising funds at a neutral organization like The Linux Foundation, the industry can effectively give projects the support they need while ensuring that open source projects retain their independence and community-based dynamism.

I somehow can't imagine an organization named "Linux Foundation" to give money to OpenBSD and other non-Linux related open source projects.

gnu82• 12 years ago

If the money was given to the Linux Foundation by Microsoft, I guess anything goes.

angrybits• 12 years ago

I think you're over-thinking it. I imagine this was done solely in response to heartbleed itself, not OpenBSD's fork. It's a good charter, I'm happy it's being done.

danielweber2• 12 years ago

Yes, they've obviously been working on this announcement for a few weeks. You can't get all those big players on board in the time since libressl was announced.

boklm• 12 years ago

I somehow can't imagine an organization named "Linux Foundation" to give money to OpenBSD and other non-Linux related open source projects.

Why not ? I could imagine them giving money to OpenSSH developers at least, seeing how it is part of the core infrastructure.

Also, would you have imagined Microsoft giving money to an organization named "Linux Foundation" ?

ausjke• 12 years ago

OpenBSD is great but it has its own agenda. Linux Foundation does have a Linux in it, maybe that tells something. Plus, Libressl can pull in whatever changes future openssl will have. I think it's a win-win for both sides. I used OpenBSD in the past, but nowadays it's all Linux for everything, from server to desktop to my cellphone.

baq• 12 years ago

also i don't think there's anything stopping the Linux Foundation from sponsoring libressl porting effort.

the_ancient• 12 years ago

I think the opposite will be true... openssl will be pulling in what libressl does, and it probally not be long before many of the distro's drop openssl...

sliverstorm• 12 years ago

Alternative possibility: OpenSSL & LibreSSL pull from eachother, but OpenSSL incorporates more new features sooner. Banks run LibreSSL- much as they run OpenSSL 0.98 today- and hip new startups that want New Feature X run OpenSSL- much as they run OpenSSL 1.0.1f today.

matt__rose2• 12 years ago

Basically, through a combination of clever marketing and actual impact, Heartbleed hit the Open Source community HARD, and left most people in the Open Source Community asking two questions: 1. How did this happen? 2. How can we stop this from happening again?

LibreSSL and openSSLRampage is the OpenBSD response, and, it's absolutely in keeping with their character. I admire the "Fuck it, let's just fix this shit" attitude that goes along with it.

The Core Infrastructure Initiative is the Linux Foundation's response.

They're two valid ways of dealing with the problem. the LibreSSL way is more direct, targetted, and, in a way, satisfying, especially if you run OpenBSD, and can gain from these efforts relatively quickly.

The "Core Infrastructure Initiative" is looking at it from a more holistic perspective and saying: OK, OpenSSL was in trouble and nobody noticed, what other projects are in the same situation, and how can we prevent what happened to OpenSSL from happening to other projects.

Neither way is necessarily "The only right way", or even better than the other way. In fact, both approaches complement each other. OpenBSD fixes the actual current problem child, Linux Foundation is on the hunt for the next problem child

remon2• 12 years ago

I think pretty solid arguments can be made for the position that the Linux Foundation approach is the better route actually.

clarry6• 12 years ago

You think they can be made, but can you make them?

Money on its own can't code though. Money or no money, you need people who can and will start fixing shit.

matt__rose2• 12 years ago

As also noted, pretty solid arguments can be made that the OpenBSD approach is the better approach. My point was that they're not mutually exclusive, and this is definitely a win-win scenario, as we have the potential to get 1. A rock-solid open source SSL library 2. Less surprises in the future.

filmgirlcw2• 12 years ago

Indeed! I 100% agree.

I know you didn't say this, but I do think its important to dispel the notion that this is somehow a "response" to LibreSSL. As far as I can tell, it's not; the two initaitives started in parallel. The Linux Foundation started reaching out to companies to join them in supporting projects that are important and not necessarily visible -- starting with OpenSSL -- at the same time the LibreSSL project was starting.

When I asked Jim Zemlin (Linux Foundation executive director) about LibreSSL yesterday, he wasn't familiar enough with the project -- but was certainly open to the idea of all projects working together (or even having CII support something like LibreSSL if it had the type of adoption that would make it a core part of the open web).

Even if this project had been in place when Theo and the OpenBSD guys forked OpenSSL, I still think they would have forked it and started LibreSSL. After all, they have their own ideas about crypto and security and their own plans for how to run a project.

And even assuming LibreSSL can become a true drop-in replacement for all existing OpenSSL installations (which I truly doubt), that doesn't mean it will. Look at MySQL vs. MariaDB. Maria is finally gaining default status in important projects, but it's hardly replaced MySQL and realistically speaking, it probably won't.

So even if you want to argue that LibreSSL is going to do a better job with fixing OpenSSL's flaws (which may or may not be true), the reality is, OpenSSL is not going to go away.

Given that reality, doesn't it make sense to at least have the biggest stakeholders in the project offer it support so that the small dev team can stop with the contract work and work on making OpenSSL better?

midas0077• 12 years ago

OpenSSL needs a competitor to keep them honest, because clearly they've failed at their duty to push back on TLS WG features, failed at deprecating old code (Tandem multiplication, really?) and failed at writing secure code.

pnathan• 12 years ago

My impression is that the CII is far more corporate, just from the quick-skim overview. That can be good, but can also up a whole can of competitive interest worms.

Fuxy• 12 years ago

Both very good solutions although i prefer the Linux Foundations answer.

I'm amazed however that it took the Heartbleed incident to make big companies realize that hey we have been using these free and open source pieces of software everywhere maybe we should contribute back with some money or a few full time employees working on it.

tedks• 12 years ago

Holy crap, Microsoft donating to the Linux Foundation. Cats and dogs, living together. It's the end of days for real this time.

My one real question: How well has the Linux Foundation managed its money in the past? Are they going to be an effective steward of this fund?

filmgirlcw2• 12 years ago

I asked Jim Zemlin -- the Linux Foundation boss -- about Microsoft and if he ever could have predicted this would happen. He just laughed, but I could tell he enjoyed the irony too.

The Linux Foundation handles the Linux kernel, so they have a good track record in that regard. They also have worked on some less-successful (but very well-managed) initiatives like Meego and now Tizen.

The members are big corporations and as a result, the auditing process and outlay of funds isn't something I'd be concerned with.

The greater (potential) concern would be over how the corporate sponsors could influence a project. Zemlin assured me that the SOP is not to interfere with existing operational structures or governances of a project -- so they wouldn't have any impact on how the OSF is run, for instance -- and certainly, in the case of the Linux kernel, corporate sponsorship hasn't dictated Linus's direction of the project.

That said, I think the level of influence a corporation could have over a project is probably directly related to how a project is initially structured. Tizen, as an example, is in partnership with the Linux Foundation, but is largely led by Samsung and Intel. That's totally fine, and was that way by design.

I would be concerned about projects that might not have strong leaders (like Linus). Of course, one could argue that if that's the case, the project might have bigger problems than being co-opted by other entities.

anandrm• 12 years ago

There was time ,maybe a year back, where Microsoft turned out to be one of the Top contributors to Linux Kernel. They had to fix some issue on Linux kernel to run on HyperV

midas0077• 12 years ago

The Linux ecosystem has a shit-load of money and OpenBSD claims to not seen a dime of it, despite Linux'es use of OpenSSH Portable. [0] One would think something as vital as OpenSSH would get a reasonable share of funding, rather than a huge lump-sum being showered on a single project in turmoil with questionable stewardship.

[0] http://www.openbsd.org/openssh/

atmosx3• 12 years ago

Agreed, I think the Linux foundation can fix this issue along with others by financially contributing to OpenSSH, OpenSSL, LibreSSL and other tools that we use (iptables, OpenSMTPD, Postfix, Dovecot, etc).

hga• 12 years ago

A wise Microsoft, which we might be seeing, would know that a bad Linux security foundation is just plain bad for business, for the Internet ecosystem and general trust in it (after all, most people don't know what sort of server they're connecting to), for sales of desktop Windows to surf in that ecosystem, etc.

A pragmatic Microsoft might be edging away from a "Windows or Death!" attitude. Didn't we read that after they bought Skype they replaced its skeezy "volunteer" supernodes with 10,000 systems running Linux? E.g. https://www.google.com/search?q=microsoft+skype+linux+supern...

neurobro• 12 years ago

I interpreted that as part of their legal obligation to add eavesdropping capability to Skype, which was probably quite difficult with the more decentralized network. But overall, I'm pleasantly surprised by the number of pleasant surprises coming from Microsoft lately.

general_failure• 12 years ago

As expected no Apple. I have always been fascinated how Apple gets a lot of developer love and yet is completely absent in most (all?) conference/event sponsorship, initiatives etc.

dorfsmay• 12 years ago

No Apple fan here, but to be fair they give some apps back (eg: cups)

atmosx3• 12 years ago

He has a point though, Apple and other deep-pockets should in someway contribute and/or endorse software they use since ages and donate some $$ to Open/Net/Free BSDs.

awalton2• 12 years ago

They hired the main developer of CUPS to adapt it for OS X. The license of CUPS ensures they continue to share it - the GPL and LGPL - they even had to explicitly add a licensing exception for Apple's (and other company's) binary printer drivers. I would bet money if Apple had CUPS under a BSD license they would not be sharing their improvements so leisurely.

jstsch• 12 years ago

They have their own Unix.

danudey3• 12 years ago

Apple uses a lot of different technology than Linux does, though. Even down to their fileutils, cp, find, mv, chmod, etc. are all BSD-variants and not GNU; they ship with cURL and not wget; and they use/prefer LLVM/Clang over GCC, and so on.

They also ship software like OpenSSL, but they actively discourage its use in Mac software in favour of SecureTransport.

Don't get me wrong, they should give back (and they do), but it's kind of surprising how much of the standard Linux stack they don't actually ship.

IgorPartola• 12 years ago

You mean GNU stack :). They use plenty of FreeBSD code.

iloveponies• 12 years ago

What for? Apple discourages the use of OpenSSL[1] and instead use their own open source library[2] which also has an API present inside of Cocoa and iOS.

1: https://developer.apple.com/library/mac/documentation/securi...

2: http://opensource.apple.com/source/Security/Security-55471/

sanxiyn• 12 years ago

I hope that OpenSSH developers get some funding too. OpenSSH is clearly a core infrastructure, and they had financial difficulty in the past.

Mozilla Foundation once donated 10K USD to OpenSSH after OpenSSH's call for donation. Not many others did.

wmf• 12 years ago

Are the OpenBSD people still saying that money donated for OpenSSH will be used to develop OpenBSD?

zatkin• 12 years ago

I get the feeling that these companies are throwing money at trying to fix the problems (in other projects besides OpenSSL that are fundamental), and not talent/manpower.

rubyfan• 12 years ago

So to get this straight, the Linux Foundation has responded to OpenSSL problems by creating a web page, a committee and are soliciting dollars from sponsors and grass roots?

OpenBSD responds by rolling up sleeves and fixing the problem.

Core Infrastructure Initiative

Related Stories