By EditorDavid from Slashdot's don't-forget-to-FLOSS department
An anonymous reader writes:
I'm interested in creating really good open source software. However, unless programmers have an incentive to work on their projects for long periods, many projects are be abandoned.
There's many business models surrounding free/libre open source software: support (pay for help, or additional features), premium (pay for more advanced software), hosting (pay for using the software on someone else's servers), donation (two versions of the same app, pay because you want to be nice to the developers), etc. Not all of those business models align the interests of the developer and the customer/user in the same way: support-based models for example, benefit developers who introduce certain mistakes or delay introducing features. (In the short term. In the long run, it opens a door for competitors...) Which of those align the interests of both?
The original submission also asks if any of these models are "morally questionable" -- and if there's other business models that have proven successful for open source software. Leave your best thoughts in the comments. What's the best business model for an open source developer?Read Replies (0)
By EditorDavid from Slashdot's online-overlords department
Long-time Slashdot reader Zorro quotes the San Diego Union-Tribune:
To many Americans, large technology firms embody much of what's good about the modern world. Franklin Foer has a different perspective. In his new book, "World Without Mind," the veteran journalist lays out a more ominous view of where Big Tech would like to take us -- in many ways, already has taken us... These firms have a program: to make the world less private, less individual, less creative, less human... Big Tech has imposed its will on the resident population with neither our input nor our permission.
The reviewer summarizes the book's argument as "Once hooked, consumers are robbed of choice, milked for profit, deprived of privacy and made the subjects of stealth social engineering experiments."
Interestingly, Foer was fired from The New Republic in 2014 by its new publisher -- Facebook co-founder Chris Hughes -- and Foer's new book includes strong criticism of the way companies are assembling detailed profiles on their users. "They have built their empires by pulverizing privacy; they will further ensconce themselves by pushing boundaries, by taking even more invasive steps that build toward an even more complete portrait of us."Read Replies (0)
By EditorDavid from Slashdot's wait-wait-hear-me-out department
Adobe's VP of Mobile (and a former intellectual property lawyer) sees "a very possible future where Microsoft doesn't merely accept a peaceful coexistence with Linux, but instead enthusiastically embraces it as a key to its future," noting Microsoft's many Linux kernel developers and arguing it's already innovating around Linux -- especially in the cloud. An anonymous reader quotes InfoWorld:
Even seemingly pedestrian work -- like making Docker containers work for Windows, not merely Linux -- is a big deal for enterprises that don't want open source politics infesting their IT. Or how about Hyper-V containers, which marry the high density of containers to the isolation of traditional VMs? That's a really big deal...
Microsoft has started hiring Linux kernel developers like Matthew Wilcox, Paul Shilovsky, and (in mid-2016) Stephen Hemminger... Microsoft now employs 12 Linux kernel contributors. As for what these engineers are doing, Linux kernel maintainer Greg Kroah-Hartman says, "Microsoft now has developers contributing to various core areas of the kernel (memory management, core data structures, networking infrastructure), the CIFS filesystem, and of course many contributions to make Linux work better on its Hyper-V systems." In sum, the Linux Foundation's Jim Zemlin declares, "It is accurate to say they are a core contributor," with the likelihood that Hemminger's and others' contributions will move Microsoft out of the kernel contribution basement into the upper echelons.
The article concludes that "Pigs, in other words, do fly. Microsoft, while maintaining its commitment to Windows, has made the necessary steps to not merely run on Linux but to help shape the future of Linux."Read Replies (0)
By EditorDavid from Slashdot's pernicious-packages department
An anonymous reader quotes BleepingComputer:
The Slovak National Security Office (NBU) has identified ten malicious Python libraries uploaded on PyPI -- Python Package Index -- the official third-party software repository for the Python programming language. NBU experts say attackers used a technique known as typosquatting to upload Python libraries with names similar to legitimate packages -- e.g.: "urlib" instead of "urllib." The PyPI repository does not perform any types of security checks or audits when developers upload new libraries to its index, so attackers had no difficulty in uploading the modules online.
Developers who mistyped the package name loaded the malicious libraries in their software's setup scripts. "These packages contain the exact same code as their upstream package thus their functionality is the same, but the installation script, setup.py, is modified to include a malicious (but relatively benign) code," NBU explained. Experts say the malicious code only collected information on infected hosts, such as name and version of the fake package, the username of the user who installed the package, and the user's computer hostname. Collected data, which looked like "Y:urllib-1.21.1 admin testmachine", was uploaded to a Chinese IP address. NBU officials contacted PyPI administrators last week who removed the packages before officials published a security advisory on Saturday."
The advisory lays some of the blame on Python's 'pip' tool, which executes arbitrary code during installations without requiring a cryptographic signature. Ars Technica also reports that another team of researchers "was able to seed PyPI with more than 20 libraries that are part of the Python standard library," and that group now reports they've already received more than 7,400 pingbacks.Read Replies (0)
By EditorDavid from Slashdot's click-here-to-find-out department
turkeydance shares a story from ZeroHedge:
Category 1 storm clouds are gathering over what has traditionally been one of the most lucrative, and perhaps only profitable, sectors to come out of Silicon Valley in decades: online advertising. Two months ago, it was P&G which fired the first shot across the "adtech" bow when not long after it announced it was slashing its digital ad spending because it thought it was not getting the kind of return on investment it desired, it made a striking discovery: "We didn't see a reduction in the growth rate." CFO Jon Moeller said "What that tells me is that that spending that we cut was largely ineffective"...
So fast forward to last week, when during Thursday's Global Retailing Conference organized by Goldman Sachs, Restoration Hardware delightfully colorful CEO, Gary Friedman, divulged the following striking anecdote about the company's online marketing strategy, and the state of online ad spending in general... What Friedman revealed - in brief - was the following: "we've found out that 98% of our business was coming from 22 words. So, wait, we're buying 3,200 words and 98% of the business is coming from 22 words. What are the 22 words? And they said, well, it's the word Restoration Hardware and the 21 ways to spell it wrong, okay?"
Stated simply, the vast, vast majority of online ad spending is wasted, chasing clicks that simply are not there....One wonders how long before all retailers - most of whom are notoriously strapped for revenues and profits courtesy of Amazon - and other "power users" of online advertising, do a similar back of the envelope analysis, and find that they, like RH, are getting a bang for only 2% of their buck?Read Replies (0)
By EditorDavid from Slashdot's sitting-pretty department
Ars Technica's health reporter argues that a new study suggesting sitting will kill you "is kind of a raging dumpster fire. It's funded by Big Soda and riddled with weaknesses -- including not measuring sitting." An anonymous reader quotes this report:
Let's start with the money: It was funded in part by Coca-Cola... [I]t's hard to look past the fact that this is exactly the type of health and nutrition research Coke wants. In fact, Coca-Cola secretly spent $1.5 million to fund an entire network of academic researchers whose goal was to shift the national health conversation away from the harms of sugary beverages. Instead, their research focused on the benefits of exercise -- i.e., the health risks of sedentary and inactive lifestyles. The research network disbanded after The New York Times published an investigation on the network's funding in 2015...
It didn't actually measure sitting... In their words, "Our study has several limitations. First, the Actical accelerometer cannot distinguish between postures (such as sitting vs. standing); thus, we relied on an intensity-only definition of sedentary behavior." The "intensity-only" definition of sedentary behavior is based on metabolic equivalents, basically units defined by how much oxygen a person uses up doing various activities. But those definitions are also not cut and dried. There are no clear lines between lying down, sitting, standing in place, or light movement... Then there's the participant data: It's not representative -- like, at all... At the time of wearing the accelerometer, the most active group's mean age was 65. The mean age of the least active group: 75.
Groups were assigned based on just a week's worth of data -- or less. And the people placed in the least-active group were already more likely to be smokers, to have diabetes and hypertension, and to have a history of coronary heart disease and stroke.Read Replies (0)
By EditorDavid from Slashdot's extracurricular-activities department
Slashdot reader eatvegetables writes:
The U.S. National Security Agency launched Codebreaker Challenge 2017 Friday night (Sept 15) at 9 p.m. EST. It started off as a reverse-engineering challenge a few years ago but has grown in scope to include network analysis, reverse-engineering, and vulnerability discovery/exploitation.
This year's challenge story centers around hackers attacking critical "supervisory control and data acquisition" (SCADA) infrastructure. Your mission, should you choose to accept it, is to figure out how the SCADA network is being attacked, find the attack vector(s), and stop the bad guy(s)/gal(s)/other(s).
Codebreaker-Challenge is unusual for capture-the-flag(ish) contests due to the scope/number of challenges and how long the contest runs (now until end of year). Also (this year, at least), the challenge is built around a less than well-known networking protocol, MQTT. It's open to anyone with a school.edu email address. A site leader-board shows which school/University has the most l33t students. Carnegie Mellon and Georgia Institute of Tech are at the top of the leader-board as of Saturday morning.
Last year, 3,300 students (from 481 schools) participated, with 15 completing all six tasks. One Carnegie Mellon student finished in less than 18 hours.
A resources page offers "information on reverse engineering," and the NSA says the first 50 students who complete all the tasks ths year will receive a "small token" of appreciation from the agency.Read Replies (0)
By EditorDavid from Slashdot's leaving-over-licenses department
An anonymous reader quote TechCrunch:
But he said he has changed his mind after seeing Facebook dig in behind the patent clause -- which was recently added to the Apache Software Foundation's list of disallowed licenses... [H]e writes that he cannot, in good conscience, require users of the very widely used open source WordPress software to inherit the patent clause and associated legal risk. So he's made the decision to ditch React.
Facebook can revoke their license if a React user challenges Facebook's patents.Read Replies (0)
By EditorDavid from Slashdot's dubious-distinctions department
An anonymous reader writes:
"The 27th First Annual Ig Nobel Prize Ceremony" happened Thursday at Harvard's Sanders theatre, recognizing real (but unusual) research papers from all over the world "that make people laugh, then think." This year's prize in the physics category went to Marc-Antoine Fardin, who used fluid dynamics to probe the question "Can a cat be both a solid and a liquid?"
Six prize-winning Swiss researchers also demonstrated that regular playing of a didgeridoo is an effective treatment for obstructive sleep apnoea and snoring, while two Australians tested how contact with a live crocodile affects a person's willingness to gamble. And five French researchers won the medicine prize for their use of advanced brain-scanning technology to investigate "the neural basis of disugst for cheese."
You can watch the ceremony online -- and Reuters got an interesting quote from the editor of the Annals of Improbable Research, who founded the awards ceremony 27 years ago. "We hope that this will get people back into the habits they probably had when they were kids of paying attention to odd things and holding out for a moment and deciding whether they are good or bad only after they have a chance to think."Read Replies (0)
By EditorDavid from Slashdot's proposing-protocols department
An anonymous reader writes: Ed Foudil, a web developer and security researcher, has submitted a draft to the IETF — Internet Engineering Task Force — seeking the standardization of security.txt, a file that webmasters can host on their domain root and describe the site's security policies. The file is akin to robots.txt, a standard used by websites to communicate and define policies for web and search engine crawlers...
For example, if a security researcher finds a security vulnerability on a website, he can access the site's security.txt file for information on how to contact the company and securely report the issue. According to the current security.txt IETF draft, website owners would be able to create security.txt files that look like this:
#This is a comment
Disclosure: FullRead Replies (0)
By EditorDavid from Slashdot's what-could-go-wrong department
phalse phace quotes MarketWatch: Following on the heels of a story that revealed that Equifax hired a music major with no education related to technology or security as its Chief Security Officer, Equifax announced on Friday afternoon that Chief Security Officer Susan Mauldin has quit the company along with Chief Information Officer David Webb. Chief Information Officer David Webb and Chief Security Officer Susan Mauldin retired immediately, Equifax said in a news release that did not mention either of those executives by name. Mark Rohrwasser, who had been leading Equifax's international information-technology operations since 2016, will replace Webb and Russ Ayres, a member of Equifax's IT operation, will replace Mauldin.
The company revealed Thursday that the attackers exploited Apache Struts bug CVE-2017-5638 -- "identified and disclosed by U.S. CERT in early March 2017" -- and that they believed the unauthorized access happened from May 13 through July 30, 2017.
Thus, MarketWatch reports, Equifax "admitted that the security hole that attackers used was known in March, about two months before the company believes the breach began." And even then, Equifax didn't notice (and remove the affected web applications) until July 30.Read Replies (0)