Sovereign Lumber(mill.plainopen.com) |
Sovereign Lumber(mill.plainopen.com) |
However, I know that the only reason my company is using it is because it makes compliance really easy, and they just don't have the bandwidth to take on more. This is further complicated by microsofts, let's say not great security record, which indicates that security compliance is really more of a box checking activity than anything else.
This is where Europe could come in. By lowering the barrier or, even better, coming up with requirements that required something closer to real security, you could seriously challenge these US companies.
Being in security for years now, I'm not sure that's possible. At the end of the day real security is a massive onion with lots of layers. Most of the time I'm dealing with crappy security consultants I would not say their recommendations are made up whole cloth. I would say misapplication of requirements from different security contexts is one of the most common problems, and after that examining shallow issues for checkboxes rather than fundamental issues of applications.
Yup. Same at my job, new FIPS requirements. Current functional hardware is now e-waste because not compliant. And, of course, the few vendors who do support FIPS are the usual incumbents like MS and Cisco. So buy new Dell hardware with TPMs, Cisco switches, Windows 11 and server 2025. Forced obsolescence and waste stream for check boxes.
I think there was a one-two punch that sort of destroyed common sense.
First the rise of cloud computing where some data went remote.
Then the pandemic where people were remote too.
And I think most corporations sort of GAVE UP. Now everything including employee lists, business strategy, code, internal documents, chat sessions, email, meetings... it's all just out there.
The article says that the main conflict is part one of the OSS license, "The license shall not restrict any party from selling or giving away the software as a component… [and] shall not require a royalty or other fee for such sale." Which makes it very hard to sell OSS software (read the article for nuance).
Business cannot do this because the business needs to capture the value (ie. through sales) in order to fund creating the value (the software).
A government, however, would not have this restriction, because they don't need to sell it to capture the value the software creates.
This is, in fact, what government is best at doing and where business fails. Business is great when value capture is linked with value creation, think hamburger stand (the value is the burger, and the customer trades money for burger).
Goverment is optimized for when value creation is separate from value capture. Svilven mentions roads. The burger stand couldn't create or sell the burger without roads to freight in raw materials and customers, but only a fraction of the value of the road network is in the burger. Because the road also supplies value to a number of other enterprises.
So the best way to capture the value of the road is via a similarly diffusive system, i.e. a tax. Government.
And for certain fundamental types of software systems, i.e. web browsers, search engines, messaging services, perhaps a government can build them better than a company. Certainly the economic incentives align better.
OSS provides value (let's say, large) uncorrelated to a large extent with those externalized costs (often almost zero). The multiple is enormous.
Commercial software companies capture that value, because they can; they're not stupid.
But, Commercial software companies also create an undeniable value above the captured value - they provide support, security, documentation, even familiarity, a "throat to choke", etc. The captured value, often at zero initial cost, is the margin.
There is no change that can be made to any OSS license that will change that dynamic. Unless it's not OSS anymore.
Governments can do very little; most OSS developers, as cost, will not work, for free, for a government. Maybe the patriots will, but not many others - so that idea will go nowhere unless the developers are government employees. That has its own issues, not all of which are necessarily bad.
Government sponsored software infrastructure will probably not be as good as the OSS projects, or the Commercial products we use today. That's certainly not a given, but overlay it all with leadership, administration and bureaucracy, and you're probably on a hiding to nothing. Governments have little vision beyond the next election cycle.
Software isn't the same as roads. A citizen knows what a road is; they see it, they use it directly, and also see its obvious value for many other purposes - they intuitively understand why they're paying, and for what they're paying. A citizen doesn't easily see the value of some OSS project embedded in the operations of their government - they see the chair and couldn't care less about the lumber. (I'll grant that taxes paid to a general fund might work.)
That's also often the view of people and organizations that buy commercial products based on OSS software. They care about the chair, not the tree, or the process that turned the tree into the chair.
OSS should, and probably will, always exist. People like doing things. It gives them pleasure. But, we can't really mix the open with the closed by screwing around with licenses. It's open or it's closed.
The real issue in the EU is not that they don't understand the problems in outcome, but that in the US people can get rich by selling software products (particularly SAAS & advertising) and people in the EU cannot. Therefore, the US has a huge structural advantage because they control everything. We know they have the people - Torvalds and Sergey Brin spring to mind. Big European success stories, except for the fact that they aren't really European any more.
Lumber is organically grown without tending or supervision, fits a generally homogeneous form factor, processed with a small number of tools to produce near-identical mass produced products.
But the essence of the argument is there. Government should be funding open source as necessary infrastructure like roads and bridges.
But not just that. Funding open source is necessary for national defense.
There are hundreds of billions of dollars in budgets out there that should be sent to funding open source developers.
As for overcoming the tension between user autonomy and developer compensation, my hope is that evolving decentralized platforms and AI tools will bring about a time when all users can collaborate in the creation and maintenance of most software they are using.
One may say that it is only the hardware (bare metal), or hardware plus virtualisation (IaC).. or even include OS in it.. but that would be up to road. You can walk on road - as end-user of that alone. Most people - end-users - would use a bus. Or train. Which is end-user software.
if the human society has entered the Information age, then these things that allow information to flow and to be entered or consumed, should become part of the society-funded infrastructure. Kind-a information (hardware+software)-tax, yes. With proper rules to spend that on proper topics.
Having roads is deemed strategic. Having communication-channels as well. So.. having information-level-fabric is too, no?
Edit: just saw this tangentially related: UN+OSI https://unite.un.org/news/osi-first-endorse-united-nations-o... https://news.ycombinator.com/item?id=43340682
How would this happen without AGPL licenses exactly?
Not open source yet. I firmly believe (and we have lived experientially in the last several decades) that all software will eventually be supplanted by an open source solution that becomes the industry standard.
Just take a bunch of open-source code and then "re-sell" it with a US HQ. Solves a lot of government compliance problems and I can use my 100% profit margin to actually do security testing on the packages.
This is a video about Digital Sovereignty in Europe:
If this is something you truly believe in, lead by example.
But don't worry, the decoupling is happening.
1. Tech CEOs, probably like other CEOs, are easily bought.
2. Tech CEOs are terrified of retributive and/or deserved antitrust action and/or regulation changes from Trump.
3. Tech CEOs never really were the progressive allies of the Left, but needed Trump to make it safe for them to drop the mask.
The likely reality is a combination of all three.