Huge Open Source Drama
www.youtube.com
Red Hat just erected a paywall in front of the source code to their Linux distribution.Are they burning bridges to the wider open source ecosystem?Referenced...

An exceptionally well explained rant that I find myself in total agreement with.

  • Max-PEnglish
    14•1 year ago

    They could try that but I suspect it would be rather easy to find anomalies like that. These are ultimately patches to an upstream and already open-source project, so one can just diff the RHEL version with the release it’s based on and quickly notice that random GUID in the sources or random spaces/indentation. Or have multiple sources leak the code independently, and then you can diff them all between eachother to verify if you got exactly the same code or if they injected something sneaky to track it, and remove it.

    Lots of companies in enterprise also want to host their own mirror because the servers are airgapped, so they can’t even track who downloaded all the sources because many companies will in fact do that. And serving slightly modified but still signed packages sounds like it would be rather computationally expensive to do on the fly, so they can’t exactly add tracking built into the packages of the repos either. And again easy to detect with basic checksumming of the files.

    • @RIotingPacifistEnglish
      3•1 year ago

      I don’t think that many companies have their shit together well enough to mirror the source code, besides the RHEL repos aren’t small, so that’ll cost.

      The companies I’ve helped either had a minimalist mirror to reduce the surface area of what was installable or to save on cost.

      It’s possible that a few enterprises do a full mirror of all RHEL sources, but i doubt it’s many

      • Max-PEnglish
        5•1 year ago

        I don’t know, I’ve worked in Debian/Ubuntu companies mostly. Last two had thousands of servers and both had an apt-mirror custom repo including the deb-src ones. Otherwise we just get ourselves banned from the official mirrors when thousands of VMs pull updates from the same NAT IP.

        Not sure how that works exactly on the RHEL side, maybe it’s not nearly as easy or common to do that.

        • @RIotingPacifistEnglish
          1•1 year ago

          TBF i was a contractor so i was almost exclusively working for disfuncional companies.

          IIRC If you pay RHEL money it’s pretty easy to do with Satellite, otherwise you had to JerryRig Spacewalk to do the same thing, but it’s been a while and i never actually set up Satellite as the enterprise companies I’d worked for were cheap.

    • The_PeteEnglish
      2•1 year ago

      There are like 3 or 4 downstream distros they needed to keep track of. They probably aren’t going to police everyone, but if rocky and Oracle keep churning out releases like this, they will probably target them, and because it’s a simple one off specific customer, they can dedicate a couple people to tracking that down without making big changes or embedding guids and such.