31 comments

  • ninjagoo 19 minutes ago
    > We are joined by Amazon Web Services, Anthropic, Chainguard, Cisco, Citi, Endor Labs, Ericsson, Google, IBM, JPMorganChase, Microsoft and GitHub, NVIDIA, OpenAI, RapidFort, Red Hat, Rust Foundation, Sonatype, Vodafone, and Zscaler

    A lot of open source folks are going to be very skeptical, rightly so, of this group of players.

    > ... to find, fix, and responsibly disclose vulnerabilities in critical open source software ...

    How this is implemented is going to be key. Are they going to contribute through (a) existing channels, pull requests etc. or (b) are they going to fork the projects under the guise of 'security' or (c) offer bug bounties or (d) contribute financially?

    Approach (a) brings the community along. (b) alienates the community, splits resources, and in the long term will likely cause many open-source projects to die. (c) has potential but timing and speed can be unfavorable for critical bugs, and doesn't mesh with 'responsible disclosure'. (d) can be ineffective for critical bugs unless paired with support for maintainers, which can be incredibly helpful for the opensource ecosystem.

    • asdfaoeu 6 minutes ago
      > one confidential, trusted place to coordinate discovery, remediation, and disclosure

      I read this they would build the patches privately (or with maintainers if confidential) and then share amongst their supporters before public release.

    • amouat 7 minutes ago
      My best understanding from reading this is a) where possible and b) where necessary. This is the Linux Foundation, so it must put OSS and community first, surely.

      People talk about contributing financially, but how and to what end? Most projects aren't set up to accept or utilise donations. That said, I would say we should be providing all OSS projects with significant access to AI in order to review their codebases and PRs and hopefully relieve some of the maintenance burden. I know there are some initiatives in this area already.

  • cryo32 2 hours ago
    No we won’t. We’ll make grand statements about it, leave it for commercial entities to corrupt it, then complain loudly about the state of it when we really did nothing about it.

    I expect we’ve got a future of “undo forks” as I’ve called them which is rolling back to pre-insanity times and rethinking again. That’s only something people unencumbered by commercial requirements can do.

    • warumdarum 37 minutes ago
      Its worse. Open source will be hijacked by hype warfare companies to extract free labour and build the things they want instead of the things we want.
    • noufalibrahim 32 minutes ago
      In a certain way, moving from "Free Software" to "Open Source" started this transition and it's not slowing down.
      • p-e-w 20 minutes ago
        Imagine if the AGPL had become the default license for open source projects, as it was intended to when the service provider loophole in the GPL became apparent. The software industry would be unrecognizable.

        Instead, millions of developers now gift corporations their work by releasing everything under MIT or Apache, and those corporations take from that treasure trove what they want and give back what they want, which is very often nothing.

    • fithisux 1 hour ago
      Spot on!!!
    • Forgeties79 38 minutes ago
      Idk I swapped to a Linux-only PC last April and have been steadily shifting over to open source software for basically everything in my life. I haven’t done everything, I doubt I ever will hit 100%, but well over half the stuff I use on a daily basis I have real control over now and can audit.

      Keep in mind I am not a coder/engineer, I’m just kind of a tourist in that world, so if I can do it it’s clearly very achievable for many people.

      No reason to throw up your hands in defeat. We don’t need everyone to shift over everything. We just need to make sure there’s always space and demand for open source software to keep it alive.

      • necrotic_comp 20 minutes ago
        One of the reasons why a source-based system like Gentoo is particularly nice is that you can compile your binaries with debug flags, so if you hit bad behavior you can inspect, write a patch, compile into your running system, and then push the same patch upstream.

        I barely have to do it, but imho, this is how software should work and what running a computer should feel like.

      • latexr 4 minutes ago
        > I have real control over now and can audit.

        > Keep in mind I am not a coder/engineer

        How do you control and audit something you don’t understand? What specific steps are you taking?

    • eastbound 1 hour ago
      Commercial entities are 95% of useful open-source (Linux, Postgres and similar — excluding leftstr-type of utilities).
      • tetris11 1 hour ago
        Commercial entities latch onto useful open-source because it is a successful product they simply cannot compete with.
        • jackdoe 1 hour ago
          why would they compete with it when its open?
          • dspillett 50 minutes ago
            They wouldn't. But the GPP seemed to be implying that we should be grateful to commercial entities for the existence of those useful open projects, when in fact if the commercial entities had their preferred way the projects would not be (as) open.
      • LtWorf 36 minutes ago
        Debian, KDE…
    • pydry 1 hour ago
      Defeatism is easy
      • fg137 5 minutes ago
        Commenting on an Internet forum is what's easy.
      • dspillett 53 minutes ago
        Which is a large part of why what cryo32 said will come to pass.
        • doginasuit 8 minutes ago
          Acknowledging the result of defeatism should push us toward a different mindset, not more defeatism.
        • AnthonyMouse 22 minutes ago
          Only if people succumb to defeatism. There have been documented instances of that not happening.
      • p-e-w 18 minutes ago
        Do you have any concrete plan to make things better that doesn’t involve magical thinking or pseudo-appeals like “everyone just needs to…”?
      • chrinic7294 55 minutes ago
        > Defeatism is easy

        I prefer easy.

        If you prefer difficult, more power to you.

        • AnthonyMouse 32 minutes ago
          It's the same easy as falling out of a plane without a parachute. Gravity will do all the work but you'll not like what happens at the bottom.
        • latexr 10 minutes ago
          > I prefer easy.

          Clearly you don’t feel that strongly about it. You know what would’ve been easier than making an account just to post that comment? Not doing that.

          Have you also stopped working, paying your bills, showering, eating, interacting with other people? Not doing any of that is easier than doing it.

      • doublerabbit 46 minutes ago
        So is taking without giving back.
  • Ekaros 1 minute ago
    Seems like obvious solution for issues that CRA and RED causes. Have to fix those vulnerabilities one way or an other. Having a team or making teams using those to fix them when absolutely necessary is something they need. And that that point have to have way to push that stuff upstream so stuff can be marked resolved in tools...

    So things do get fixed, but it is not due to their graciousness.

  • bingemaker 1 hour ago
    > We are joined by Amazon Web Services ...

    There goes all the credibility of this post

  • zx8080 8 minutes ago
    This reads as centralization and control effort. It will only provide the power to control opensource to whoever Akrites is (with the major bigtech including Google).

    Thank you very much, but I remember what Google is doing with Android this September (closing third party installs using .apk).

  • tpoacher 1 hour ago
    Nice name, "Akrites".

    Probably not as impressive to a non-Greek, but to a Greek person it creates very strong imagery.

    • Fnoord 4 minutes ago
      [delayed]
    • oersted 1 hour ago
      To save others a search:

      > The akritai (singular akrites) is a term used in the Byzantine Empire in the 9th–11th centuries to denote the frontier soldiers guarding the Empire's eastern border, facing the Muslim states of the Middle East. (Wikipedia)

      Akron means edge or border, so "frontiersman" or "those of the border".

      • adamo 44 minutes ago
        This is a very simplified and uninformed view of what the Akritai were. The name choice is so wrong, it cannot even be called out as cultural appropriation, because it is far worse than that. LF just stick with languages you understand.
        • oersted 11 minutes ago
          I would be glad to learn if you are willing to explain, this what I found from trusted sources, but it would be great to know if there’s additional nuance.
      • mohamedkoubaa 10 minutes ago
        Sigh
      • throwaw12 1 hour ago
        > facing the Muslim states of the Middle East.

        if true, then choosing this name was a very bad decision.

        Imagine how Muslims would feel, demonizing them even more, before they were terrorists, now they are attacking open source and hence some organizations need akrites to defend from them.

        I really wish such organizations which try to demonize anyone, to fail miserably

        • adamo 37 minutes ago
          To be fair, the Akritai was the Byzantine Empire's effort to use the local population to defend the land, instead of having to deploy regular Army or mercenaries. It happened to be Muslim states that was the border. It bears no anti-muslim connotations as a word in Greek. In fact the epic of Digenes Akritas, speaks of Basil, an Akritas of a Greek mother and an Arab father (hence the name Digenes, of two descents).

          But still, the name is a bad, uninformed choice.

        • asfodelsu 20 minutes ago
          Α better translation is "defender of the borders" or "Knights of the borders". Form "Akri" = edge, border.

          It's not Muslim related even at the time they exists.

  • smartmic 1 hour ago
    The most important information is this:

    > participants will contribute engineering resources

    If it works out as planned, we will see. Apart from this, I am not overwhelmed by the claim of this project. It favors centralization and corporate circles, exactly the opposite of what the hacker ethics promotes for good reasons.

    • shevy-java 1 hour ago
      You can even shorten that. This is some corporate hollo-bollers takes-your-time-and-gives-nothing-in-return fakery-roo.

      > exactly the opposite of what the hacker ethics promotes for good reasons.

      Yup. Seems kind of like those zombie plants in the movie "Invasion of the Body Snatchers" (the first remake; though the original is also great, but it was more about communism as threat, whereas the first remake added a bit of alien horror motifes).

      • habinero 51 minutes ago
        Silicon Valley is not as large as it might seem, and knowledge sharing and consortiums and working groups happen a lot.

        You can complain about supply chain problems, or you can actually try to work on it. They're trying to work on it.

  • fhub 16 minutes ago
    If members of Google Project Zero team are involved then I have hope. If they are not then I have many doubts.
  • javascripthater 25 minutes ago
    yeah open source is cool and all but can we talk about how literally everything is written in javascript now. even your toaster probably runs on node. its an infection.
  • witx 2 hours ago
    Unforteuately I think it's moot to post this on hacker news. The majority of people here drink deep from the AI pool and just don't care.

    Besides many of the companies on the list are suspext numero uno for the state of open source

    • fithisux 1 hour ago
      All voices have a place.
      • cryo32 1 hour ago
        Some should be at the bottom of a well.
      • witx 1 hour ago
        Ok, and? Where did I say otherwise?
        • fithisux 1 hour ago
          I just asserted you statement. I did not attack you.
          • witx 53 minutes ago
            Sorry
    • shevy-java 1 hour ago
      I don't drink the AI slop and I also don't see where you derive to this conclusion. Most of the comments are very much against the AI slop.

      > Besides many of the companies on the list are suspext numero uno for the state of open source

      On this I agree. This seems indeed just promo advertising to white-wash these companies. They don't really care about ethics in open source.

  • luipugs 1 hour ago
    Interestingly no Apple. *edit: Or any non-American companies for that matter .
  • jdw64 25 minutes ago
    After reading this. I realize how different Asian and Western consciousness really are.

    My entire technology stack was built on Microsoft's ecosystem, not on open source. This was Microsoft's attempt to expand their base for the corporate hiring market and OS market share.

    Conversely, open source was a huge barrier for me. When I have a product I've built, I have to get past open source, but accessing open source comes with the barrier of English. And once you get past the English barrier, you hit the cultural barrier.

    My hobby projects do integrate with open source, but all the technology that actually makes me money depends entirely on the Microsoft ecosystem. Most of the Asian developers around me are also tied to specific vendors. On the other hand, the Korean companies that do have a culture of contributing to open source are large corporations, and entry is determined by academic pedigree.

    Because the entire context of open source is in English, and learning English reliably is expensive in itself. So to properly work as a developer in Korea, you actually need to be vendor dependent. The corporate ecosystem is not oppression; it is the only viable path to education and survival. If you want to grasp the latest trends, you ultimately need curation from a specific company. Some people say Hangul is a great writing system, but to me, this is where it becomes a curse and a shackle.

    So when I read Hacker News, I feel just how large the gap in thinking is between the West and the East. The Japanese developers I have talked to mostly talk about coding within corporate environments rather than open source, and Chinese developers are also shaped by their corporate environments. But the posts on HN talk about their 'gardens' being ruined and absorbed by corporations, and they resist that. But since I was raised in a corporate environment from the start, I cannot imagine a different one, so this resistance tends to feel like an aristocratic hobby to me.

    On the flip side, HN might see corporations as predators. Technology should be a commons, and developers should be free, not tenant farmers of a platform.

    But the irony I personally feel is that to protect this 'garden commons,' they end up creating centralized, non-public coordination mechanisms with the very corporations that plunder the commons. That feels contradictory to me.

    For security vulnerability response, non-public coordination may be necessary. If a vulnerability is disclosed before a patch is ready, attackers can create exploits. But the principle of open source is transparency and open discussion, while the Akrites-style security principle is non-public coordination and a single point of contact.

    On top of that, corporations used open source as free infrastructure, and now that the risk has grown, they are building corporate-led governance systems based on that risk. That feels ambiguous to me. Of course, open source sponsorship has always had some tension, but if that was buying a craftsman's work, this looks more like buying the craftsman's workshop.

    I wonder how Westerners would read this. I am curious. To me, this looks like a political struggle to take control of governance over the commons. Do Westerners see it as the Avengers? The difference in mindset is sometimes painful.

    • justincormack 16 minutes ago
      The corporate environments were here too, most companies used to run on Windows server. 20 years ago companies used to pretend they didnt use Linux, but they were, it was just introduced to places they didnt know about, as it was free so it didnt have to go through purchasing. The rise of the early web in the post dotcom years was the catalyst, Perl, PHP, Linux servers etc. Before mobile, that did bring back proprietary development to some extent, for clientside. That was the era when Microsoft said "Linux was a cancer". Many companies still have large Windows (dot Net pre dotnet core) codebases, but Java mostly runs in Linux now.

      The language barrier is interesting, there is more Chinese open source now too, but yes so much is English. I remember using google translate for Nginx from Russian back in the day, and openresty from Chinese, but yes we are lucky,

      • jdw64 2 minutes ago
        [dead]
  • highway900 51 minutes ago
    This is fear that humans will stop software development. Think about it, the backbone of modern enterprise is open source. What if maintainers just stopped, the free ride big tech has had would be left with the slop the maintainers have to deal with now. Which without checks and balances would introduce vulnerabilities.
  • rjzzleep 4 hours ago
    I'm extremely concerned about the state of Open Source. The gamification of the whole thing & devstats means that people that are good at gaming metrics are rising up the ranks and people that are genuine high quality contributors and pushed to the sidelines unless they have a very popular profile. Mass generated AI slop and AI content gives people massive devstats boosts.
  • rurban 49 minutes ago
    So they spend tokens to fix their backbones. Only fair. even required for GPL.
  • einpoklum 4 hours ago
    > We are joined by Amazon Web Services, Anthropic, Chainguard, Cisco, Citi, Endor Labs, Ericsson, Google, IBM, JPMorganChase, Microsoft and GitHub, NVIDIA, OpenAI, RapidFort, Red Hat, Rust Foundation, Sonatype, Vodafone, and Zscaler

    Many of the names on the list makes the initiative rather suspect. Companies who do a lot to undermine free and open-source software, who hide critical software behind their walls, preventing both its scrutiny and its adaptation and improvement, and two of the LLM giants - they'll "defend open source"? I don't know about that.

    > Akrites gives critical infrastructure stakeholders a confidential, structured place to coordinate vulnerability discovery, remediation, and disclosure across the open source projects they depend on

    So, a bunch of large corporations - some of who are known to be in bed with the US government - will share vulnerabilities among themselves, out of the public eye? Fishy.

    • Fordec 3 hours ago
      Yeah, a bunch of the worst free riders and malicious consumers all in one place.

      All they're really missing is Oracle and Bambu Lab.

    • justincormack 15 minutes ago
      It won't be out of the public eye if it is part of Linux Foundation, it will be open.
    • hobofan 1 hour ago
      That's just your typical list that makes up the Linux foundation.

      It might not be the idealistic flavour of open source you prefer, but it's the flavour of open source that's actively in use in most tech companies, and that also forms the makeup of most corporate open source participation (e.g. also the top corporate Linux contributors).

    • nwellnhof 1 hour ago
      > All members must be current Linux Foundation members and sign the participation agreement and NDA.

      Just another opaque and exclusive subproject of the Linux Foundation.

    • habinero 37 minutes ago
      Not...really? It's pretty normal. Tech companies share intelligence and knowledge all the time -- there are a lot of birds of a feather and consortium groups out there.

      Since a lot of places are close in proximity, companies sometimes run private fiber lines and such to let peers download updates without competing with the entire world lol.

      Everyone's fighting the same fight. Sharing and collaborating are normal things.

    • throwaway72587 3 hours ago
      [dead]
  • bitlad 21 minutes ago
    You can start by paying maintainers really really well.
  • Brian_K_White 3 hours ago
    Anything they "maintainer of last resort" would actually be forks, or collectively a distribution. We already have hundreds of distributions acting as maintainer of last resort many times over, only with actual developers and not presuming to make themselves the new upstream for anyone else.
    • sakjur 3 hours ago
      Microsoft controls NPM and GitHub. I would not put it past them to truly take over a project if they gauged it in their best interest (though it would be a massive violation of trust, so I'd imagine they'd tread carefully before going there).

      If it's sent to Akrites, they can even pretend it's done responsibly – even though only megacorps get a seat around that table.

  • dmitrygr 4 hours ago
    > Additionally, when a critical package has no one maintaining it, Akrites will stand as the maintainer of last resort so a fix can still reach everyone in a timely fashion.

    Ambitious and interesting. I wonder how long this will last and on whose dime and time? Akrites employs no engineers, so who will make the fixes and who'll pay them?

    • wwind123 2 hours ago
      Yeah, very commendable. Now I just wish the closed-source software that have lost support could similarly be supported this way, with the help from AI, so we don't have to throw away that many hardwares when their software can no longer be updated.
    • npodbielski 4 hours ago
      Who they employ then? AI?
      • NSUserDefaults 3 hours ago
        > Today, the undersigned commit real resources — engineering talent, security expertise, and funding — to harden the software we share
        • fmbb 2 hours ago
          Human talent or LLM talent?
  • charcircuit 4 hours ago
    Why only a focus on Open Source? I feel like vulnerabilities in closed source products like Microsoft Office, Microsoft Windows, and Google Chrome to name a few can be just as essentially and foundational as other open source software for many businesses.
    • dofm 4 hours ago
      I think the idea is that automated source code processing is making it possible to find vulnerabilities at great speed and in an overwhelming way in software that does not have paid maintainers, whereas closed source software in active use has both less accessible code and paid maintainers.

      A charitable foundation might be plausible to help companies secure their closed for-profit software but it doesn’t really have the same urgency for the fabric of the internet (or the same moral clarity)

      • graemep 2 hours ago
        Its a worry, but its too early to be sure what the long term effects will be. We will have many eyes on a lot more code. There might be a rush of reports that slows as all the old vulnerabilities are found.

        Closed software still has many people with access to the code. Governments or researchers have been given access to lots of critical source code. It can also be leaked. I wonder whether attackers are going to be more willing to bribe people with access to source now they have better odds of finding vulnerabilities with limited effort.

        • dofm 2 hours ago
          > Closed software still has many people with access to the code.

          But in the examples cited (and really any other large closed piece of code of any significance in this era) it also has owners with money, and they should be compelled to fix their own stuff.

          Or open the source code to be fixed, I guess ;-)

      • charcircuit 3 hours ago
        >both less accessible code

        Yet still important to be secured due to the impact vulnerabilities can have. And LLMs can work without source code access via utilizing things like debug symbols, disassembly, reverse engineering, etc.

        >paid maintainers

        Just like open source maintainers their time is already being spent on other things which they see as more important over making the project 100% security bug free. Just because they are being paid, that doesn't make security their number 1 priority.

        • behindsight 2 hours ago
          Project Glasswing is already a thing, and the other labs have started their own initiatives too if they want to collaborate and work on securing closed-source software.

          Still not addressed the moral clarity point being brought up, nor the ramifications of the Linux Foundation choosing which closed source projects to focus on and alienating their mission statement.

          Again, your idea is noble but why should the Linux Foundation be saddled with it when those other options exist? OSS needs their focus as their mission outlines.

        • dofm 2 hours ago
          > that doesn't make security their number 1 priority.

          Well perhaps the companies who employ them to make that software they sell for profit should let them do that first rather than tokenmaxxing, and the great big non-profit effort can get round to them to help a little bit later after it has helped secure all the open-source stuff the internet actually runs on.

  • throw_a_grenade 2 hours ago
    Will they hire the actual maintainers of the software in question, to have time dedicated to the project, or will they as usual, dump AI-generated patches unto maintainers, but this time with even more time pressure to merge, lest them consider projects “unmaintained” if they don't push a fix in 3 femtoseconds, and use it as a rationale to take over the project?
    • LaSombra 2 hours ago
      I'm pretty sure it'll be an AI dump fest with barely any humans except the long term maintainers having to cope with it all.
      • throw_a_grenade 1 hour ago
        I mean, it won't be neither the first nor the last slopdump, but it's the first that's backed by a threat of project takeover.

        “Maintainers of last resort”, my [back].

  • benj111 1 hour ago
    I'm not really a Stallman fanboy but I do find the Free software / Open source distinction really stick out in situations like this.

    There isn't a call out for contributors. This is all done behind closed doors. It's the antithesis of free/open source software, presented as defending it.

    I don't particularly have any better ideas. And I'm not particularly criticising. It's just a lot of the time the terms are synonymous, but here they starkly different.

  • fithisux 1 hour ago
    Corporates terrorized people with the financial crisis they created and the unemployment weapon.

    They terrorized them to abandon their free time. They terrorized them to find easy solutions in the workplace instead of coming up with solutions that require technical expertise and deep thinking. They terrorized people to not conform to standards, or create standards but instead patch around lack of standardization. They terrorized people to not question, but accept. To become slaves. They did not help them get wide knowledge but be specific on the work, like mass produced meat. They swept all problems under the carpet and said "This time it will be different". No victories, just silence on the defeats.

    It has been happening in the past, has accelerated and made worse as they seized more power.

    The leap to AI era is the latest and more violent step of this attack on fundamental human rights.

    The problem is political in my opinion. People ought to demand a better life and more free time to work on open source or do their hobbies. They ought to demand human centric laws that stop the greed and by enforcing the laws at last.

    Free time is not for consumption, but for production of higher intellectual artefacts.

    • eastbound 1 hour ago
      The French famously got the Congés Payés (paid holidays) in 1936 after the big strike. You have great pictures of entire trains of Parisians going to the beach in Deauville by droves.

      Meanwhile the Germans were working overnight to manufacture bombs. That, alone, is already a sufficient explanation on why we got invaded and lost our country to one of the evilest powers of Earth. France had to be rescued by the Russian, the English and the Americans after losing millions of inhabitants. Because we literally took too much holidays.

      The one who works the most reaps the entire benefits. And it’s clearly not good to ask for less work all the time. Today France is peanuts on the international market, we are second at everything. Who heard of DailyMotion, which was once as big as Youtube, or Mistral, which was supposed to be our OpenAI?

  • shevy-java 1 hour ago
    So this corporate project wants to spam down more repositores via AI slop. No, I don't like it. And no, I am not feeling encouraged to "defend it together" at the slightest, even more so as many of these companies don't really contribute anything at all back.
  • pedromlsreis 3 hours ago
    [flagged]
  • pedromlsreis 3 hours ago
    [dead]
  • opentestudox 2 hours ago
    [dead]
  • doublerabbit 1 hour ago
    All those open statements are just business wank.

    > Amazon Web Services

    We really don't give a shit, We will continue to not give a shit. We might give you a credit if threatened by the EU but really? We don't give a shit. Keep sending us that sweet dosh for AWS.

    > Anthropic

    We underpin the front page of the internet with Ai and in so we allow it to train upon the collective with no recognition. It's great to take and not give back. By the way your vibe coded app is looking ownage.

    > Cisco

    We are Cisco and we'll license you if we could. We invented the subscription model to charge you per Ethernet port on your router. Opensource is great, we don't even have to contribute upstream. We did once upon a time, isn't that enough?

    > Citi

    In partnership with Linux Foundation, we will do nothing and keep doing nothing. Linus enjoys his dosh and handjob now and then.

    > CNCF

    Working on the right fixes before the window closes, we prefer that to be left to the developers and we are very proud to support that effort. Unfortunately, no treats for the developers is written in to our company policy. How does pizza sound?

    > RedHat

    Open source is the foundation of modern software innovation so we hide answers behind a paywall. We sold ourselves to IBM so we could keep lubing that stripper pole to fill our filthy pockets. Larry Ellison will be here soon for his next lap-dance.

    > Microsoft & GitHub

    We decided to throw legal action at a security analyst for finding exploits in our OS for laughs. Open source all the way, we don't even allow you to search on GitHub without a rate limit; it's healthy to laugh. How's your mother doing? She seems a keen user of Windows 11 and as she is very important to us we've removed that feature she uses most.