Still want to support your FOSS Supply Chain with money but do not know how?
You can still be the first company to do so with my help! This consultation has not yielded any interest from anyone!
Prove me wrong and support your Supply Chain!
And yes. I am doing this because i really do need the money. I got some unexpected bills piling up this month and I really would appreciate the money.
So let's help each other!
If you have ever wanted me to answer some of your questions at work or help you figure something out... You can!
I still have a small consultancy on the side, and I will happily bill you for just a consultation. No need to make it big. Anything from a look at the quality of your codebase with a nice report, helping you analyse your incident management or just help run a postmortem.
Anything.
You can find all my contacts at the bottom of my page
https://www.softwaremaxims.com/consulting
Open question, maybe for @joshbressers .
We know vulnerable Log4j version to log4shell are still downloaded to this day.
How many actual breach have used it?
I ask because it is a useful way to analyse the whole "apocalypse of vulnerability". If even multiple years non patched one that attackers knows about are not used....
Why am I not scared of "AI hacking"?
Well because of this. You see, it is such an easy target rich environment that getting more capabilities would not change anything to the game.
And that is if it even works at all.
So i just read the anthropic post on their own inadvertent "hack" ....
I am screaming. Everything in this post screams both incompetence and deep wrong models of the world. Even the solutions they offer.
This is... This is not even wrong. I don't even know where to start, every single paragraph is fundamentally wrong.
Like. Please for the love of everything listen to the experts.
https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals
When people wonder why I wrote https://www.softwaremaxims.com/blog/open-source-hobbyists-turf and why I am angry...
I just received the OpenSource Summit schedule from a LF newsletter.
And it is fascinating how much it can be all stuff from Alpha Centauri that have nothing to do with the realities of FOSS.
Like, I know for who it is. I get it. But also, why do you happily pay to be misinformed if you are in a decision making position?
I mean, I know why. I get it. But still, this is such a waste of money and time that is precious for everyone.
Before I spend time writing it, is anyone interested in my take about the HuggingFace/OpenAI situation ?
Three themes.
1. How to obfuscate and scare with languages
2. Oh No! The door was open and there was light, so I entered
3. It is uneconomical. And the only fix is better FOSS quality
Why I do not see a future in coding with genAI/LLM. And why I am an AI skeptic.
This post has been waiting for me to polish it for a year now, but I never found the energy. So you are going to get it raw. No pass through any of the beta readers I usually do.
I may do a pass later to clean it up, but I am just too tired these days to spend a lot of time on my hobby. So it may stay that way.
If you want references, feel free to ask, but they should not be hard to find.
On my way to #GUADEC , as they nicely invited me to give a keynote. Looking forward to seeing you all there!
And I am around tonight if you want to organise something.
Damn do I hate travelling by plane though. It is not the plane. It is the airports.
RE: https://tldr.nettime.org/@kdawson/116885702874242574
We Kill People, Case study n 52477
If you don't know, a regular answer I get when I talk about Quality in Software is "it is not like we are doing Safety Critical stuff here, we do Sprockets".
At which I usually respond "well, we DO Kill People regularly, because Sprockets end up everywhere". So I keep a regular look out for this kind of cases.
Hence the We Kill People serie.
"find ways to decrease the burden on maintainers in the long run."
How can you do that when you have no idea what the problems actually are and do not even talk about what is the burden.
I don't care about this kind of report, like nearly all hobbyists maintainers. Do you know why?
Because it doesn't even register. These reports are far low on the hierarchy of urgency. The urgency for a hobbyist maintainer is
1. Keep the build system running
2. Keep the tests running/CI running (that matters less than the build system)
3. Keep the code working despite all the change in our environment. Like if you are a JS library, you need to adapt to change in Node, Deno, Chrome, Firefox, Safari and their mobile versions.
4. Update dependencies and all the breakage it creates.
5. Fix old fucked up mitigations made for the previous points
6. Keep the documentation updated
7. Ok, I can look at the security stuff report maybe, and possibly fix some
8. Keep documentation working
9. New features
Some of this hierarchy is a bit murkier, but the top is *really there*.
As you can see, the security report will never get met, because the top 4 already take more time than available to hobbyists. If you want to ease their burden, you need to act on these top 4. The rest can be as easy as possible, it will *still never reach the level of importance*.
So I have so many problems but my main one is this one
"Its goal is to front-run a serious problem facing open-source maintainers"
*Why is this a problem for FOSS Maintainers?*
People will file reports? That is what we consider a *problem for FOSS Maintainers?*
I keep breaking my build which takes hours to fix due to our build systems being built with chewing gum and wire since the 90s, our C compilers can barely output multi line errors, we have nearly no way to know if our code update will break our downstream...
But a serious problem is a dozen useless report being filed on us?
*what the fuck are we doing here?*
https://blog.trailofbits.com/2026/07/02/field-reports-from-patch-the-planet/
If you ever wonder what I mean when I keep going back to "if you want better FOSS infrastructure, fix the tools", consider the time spent on this build problem. Then compare it to the average budget of "2 to 4h per quarter" of a hobbyist maintainer.
The problem is not that we have little ressources. The problem is that we spend it in useless build system and dependencies side quests.
Of note, I don't think this i *bad*. I think this solves the problem the EUC has, which is decoupling from the US. So it focuses, really heavily, on end-user shrinkwrapped software and things that focus on Digital Rights for the end-user.
This is not a bad thing. They are doing exactly what they need for their goal and for Digital Rights.
But as I will keep arguing, most of the problem that the FOSS infrastructure of the world encounters right now are not Digital Rights problems. They are Roads and Bridges problems.
Different problems, different models, different solutions.
So uh. I had a look at the EU Open Source Strategy.
It is deeply rooted in a mindset from the 90s and totally misses the mark for open source infrastructure. I am not surprised, nor am I disappointed. This is in line with the kind of lobbying and models of FOSS that has been developed and pushed by all the Foundations.
At least we have something. There are a few nods to the real solutions and problems in there, hidden, but they do not fit in the overarching plan and it shows.
Time for us to keep trying to offer more realistic models!
https://digital-strategy.ec.europa.eu/en/policies/open-source-strategy
It is sadly not the first time I made that analysis toward Jen Easterly propositions for policies. Seems there is a lot more work to do talking to policy makers
I hate that reference for so many reasons but....
This is so far from reality that it is not even wrong. It is just written for the ecosystem of Alpha Centauri.
Sadly we are not from Alpha Centauri. I don't know where to start to comment on it. There are so many layers of models that are actively dangerous in this post.
To everyone working in a #foss or #opensource foundation. Your ideology flamd advocacy for Libre/Free/OpenSource is great. It is also totally separated from the problems and advocacy maintainers needs.
In the same way that the local band that play music in your local pub as hobbyists have very specific needs and doesn't care that much about piracy. They just need to be able to play.
As maintainers, we do not need subsidies to compete with commercial software, help to become commercial. And we don't care a lot about making everything FOSS. We care about being able to do the job society needs us to do.
Think about that a bit.
"Have you considered going commercial yet!?!?!?" Yes and it is a bad idea. Here is why it is actually really hard to give money and support most FOSS projects. In a blogpost rant.
This is probably my second to last blog in that improptu serie about Hobbyists Maintainers, slowly reaching its conclusion of a model of Hobbyists Maintainers situation and how we can actually help them.
Because believe it or not, I know how to say something else than "no" or "it will not work".